LastPass

Overview

LastPass is a password management and identity solution designed to help individuals and organizations secure digital credentials. Founded in 2008, it operates as a cloud-based service that encrypts and stores user passwords, secure notes, and other sensitive data in a digital vault [LastPass Support]. The core functionality centers on generating strong, unique passwords for each online account, reducing the risk associated with password reuse. Users can access their vault through browser extensions, desktop applications, and mobile apps, enabling automatic login to websites and applications.

For individual users, LastPass offers a free tier that provides basic password management features across one device type (either computers or mobile devices) [LastPass Pricing]. Paid personal plans, such as LastPass Premium and LastPass Families, extend functionality to unlimited device types, secure file storage, and emergency access features. LastPass Families allows multiple users to have their own private vaults while enabling secure sharing of selected items within the family group.

For businesses, LastPass provides solutions like LastPass Teams, LastPass Business, and LastPass Identity, which include centralized administration, user provisioning, and reporting capabilities. These business-focused offerings aim to enhance organizational security by enforcing strong password policies, enabling secure sharing among employees, and integrating with existing identity providers for single sign-on (SSO) [LastPass Business SSO]. The platform supports compliance requirements such as SOC 2 Type II, GDPR, CCPA, and HIPAA, addressing data privacy and security mandates for various industries.

While LastPass primarily serves end-users through its applications, its integration capabilities for enterprise identity management are relevant for technical buyers. Businesses can integrate LastPass with directory services like Active Directory and Okta to streamline user management and implement SSO for employee access to various applications [LastPass Support]. This focus on user-facing applications and enterprise integrations distinguishes its developer experience, which does not currently include public APIs for direct programmatic access to vault data.

Key features

• Password Vault: Securely stores encrypted passwords, secure notes, and other sensitive data [LastPass Support].
• Password Generator: Creates strong, unique passwords for new and existing accounts.
• Autofill & Autosave: Automatically fills login credentials on websites and saves new ones.
• Secure Sharing: Allows users to securely share passwords and notes with others, with revocable access.
• Multi-Factor Authentication (MFA): Supports various MFA options for enhanced vault security.
• Dark Web Monitoring: Alerts users if their stored email addresses or other data are found in known data breaches.
• Security Dashboard: Provides an overview of password strength and identifies weak or reused passwords.
• Emergency Access: Designates trusted contacts who can access the vault in an emergency.
• Single Sign-On (SSO): For business plans, integrates with identity providers to enable SSO for cloud applications [LastPass Business SSO].
• Centralized Administration: For business plans, allows administrators to manage users, policies, and reporting.

Pricing

LastPass offers a free tier and various paid plans for individuals, families, and businesses. Pricing is typically billed annually.

Common integrations

• Active Directory: Synchronize users and groups for streamlined provisioning and deprovisioning [LastPass Support].
• Okta: Integrate with Okta for single sign-on (SSO) and user lifecycle management [LastPass Support].
• Azure Active Directory: Connect with Azure AD for user synchronization and authentication for LastPass Business [LastPass Support].
• Google Workspace: Integrate with Google Workspace for user provisioning and SSO.
• Duo Security: Use Duo for additional multi-factor authentication with LastPass [LastPass Support].
• Microsoft ADFS: Integrate with Active Directory Federation Services for enterprise authentication.

Alternatives

• 1Password: Offers a similar secure vault approach with strong focus on family and business plans, known for its user interface.
• Bitwarden: An open-source password manager providing free and paid options, often chosen for its transparency and self-hosting capabilities.
• Dashlane: Combines password management with VPN and dark web monitoring features, catering to both individuals and businesses.

Getting started

While LastPass does not offer a public API for direct programmatic access to vault data, developers integrating LastPass into an enterprise environment typically configure it via administrative consoles for user provisioning and SSO. The following example demonstrates a conceptual configuration step for integrating LastPass Business with an identity provider, rather than a code-level interaction with a LastPass API. This example uses a simplified JSON structure to represent the kind of configuration data an administrator might provide to set up SCIM provisioning, which is a common method for syncing user identities between an identity provider and a service like LastPass [Microsoft Learn on SCIM].

{
  "provisioning_method": "SCIM",
  "identity_provider": {
    "name": "Azure AD",
    "scim_endpoint": "https://api.lastpass.com/scim/v2",
    "tenant_url": "https://provisioning.microsoftonline.com/your-tenant-id/scim",
    "secret_token_placeholder": "YOUR_SCIM_SECRET_TOKEN",
    "attribute_mappings": {
      "userName": "userPrincipalName",
      "active": "accountEnabled",
      "emails[type eq \"work\"].value": "mail",
      "name.givenName": "givenName",
      "name.familyName": "surname"
    }
  },
  "lastpass_settings": {
    "auto_create_users": true,
    "default_policy_profile": "Standard_Employee_Policy"
  }
}

This JSON represents a configuration payload that an administrator would use within their identity provider (e.g., Azure AD) to set up SCIM provisioning for LastPass Business. The scim_endpoint for LastPass would be provided by LastPass during the setup process, and the secret_token_placeholder would be replaced with an actual API token generated within the LastPass admin console. This setup automates the creation, updating, and deactivation of user accounts in LastPass based on changes in the identity provider, aligning with common enterprise identity management practices.