Bitwarden for Business: Organisations, Collections and Policies Done Right

Businesses that have made the password-manager decision all ask the same next question: "So how do we set it up?" This guide is the answer — Bitwarden-specific, though the logic (organisation, collection, policy) works similarly in other business vaults. The goal is precise: an arrangement where the notebook under the keyboard and "passwords.xlsx" are retired, sharing is recorded, and departure takes one move.

Concepts: Vault, Organisation, Collection

Bitwarden has three layers, and most confusion comes from skipping the distinction: the personal vault is the user's own space; the organisation is the company's shared roof; collections are the folders within the organisation — passwords go into collections, and users are granted collection access. The corporate principle follows: no work password lives in a personal vault; every work password sits in a collection. The "who had that password?" question dies — the password is with nobody; it is in a collection, and who can reach the collection is written in the admin panel.

Collection Design: Your Access Map

Collection	Example contents	Access
General / Office	Wi-Fi, printer panels, courier portals	Whole team
Sales	CRM, marketplace panels, listing accounts	Sales team
Finance	Bank screens, e-invoice portal, accounting software	Finance + management only
IT / Infrastructure	Servers, firewall, domain, hosting	IT administrators only
Management	Official portal logins, signature/registry accounts	Partners only

The design rule is simplicity: one collection per department plus two or three restricted zones covers most SMBs. Over-fragmentation (a collection per tool) exhausts administration; one giant collection carries the "everyone everything" arrangement into the vault — do not repeat the departure scenario's lesson inside the vault itself.

Roles and the Invitation Order

Users are invited with roles: owner (at least two people — a single-owner organisation is a locked vault during that person's holiday), admin (collection and member management) and user (access to assigned collections). The practical invitation order: management and IT first, the team after the collections are filled — a user invited into an empty vault labels the tool "useless"; one invited into a full vault sees its value on day one.

Policies: the Screws of the Corporate Arrangement

• Master-password requirements: length and complexity minimums enforced centrally; the vault's door must be as strong as what is inside.
• Mandatory MFA: organisation membership is bound to two-step login — the vault does not open on an MFA-less account.
• Sharing hygiene: end the culture of passwords travelling by screenshot and message: "if you need a password, look in the collection; if it isn't there, have it added." Bitwarden's one-time secure sharing (Send) is also the right channel for the occasional password that must leave the company.
• The recovery arrangement: business plans offer account recovery/admin access policies — an employee who forgets their master password is recovered without data loss. Without that policy, a forgotten master password is the end of that user's vault.

Migration Day: from the Spreadsheet to the Vault

The existing password sources (spreadsheets, browser-saved logins, notebooks) are planned into one day: the list is reviewed (dead entries culled), imported, records distributed into the right collections, and — the critical step — the old sources are destroyed: the spreadsheet deleted (recycle bin included), browser-saved passwords cleared, and browser password-saving switched off by policy. A vault migration with the spreadsheet still around is not security; it is duplication. The migration's second wave is rotation: passwords for the most critical accounts (bank, domain, servers) are replaced with strong vault-generated values — because you cannot know how many eyes the old passwords passed through in the old regime.

Rollout: Extension, Mobile, Habit

The vault's daily value lives in the browser extension: autofill is both comfort and security (the extension will not fill on a clone site — a living phishing litmus test). The deployment package includes the browser extension and the mobile app; vault usage is a standard topic of onboarding's 15-minute IT welcome. Self-hosting is technically possible; for businesses without the IT maturity to own its maintenance and backups, we recommend the cloud edition — a mismanaged self-host is riskier than a well-managed cloud.

A Vault Build with Yamanlar Bilişim

Our password-vault projects are packaged as a half-day build plus short team training: organisation and collection design shaped to your work, the mandatory policy set, and migration plus old-source destruction on the same day. For maintenance-agreement customers, vault health (owner count, MFA coverage, dormant memberships) is a periodic check item, and the offboarding flow runs the "remove from vault + rotate shared credentials" step from our list.

FAQ

What if the team resists — "another app?"

Engineer the first week: the vault arrives full, the extension arrives installed, and on day one the team experiences autofill instead of password-hunting. Resistance typically yields within two weeks to "how did we work without this" — because the vault is a comfort tool as much as a security one.