Docs

Appearance

Keeper Credential Guide ​

Overview ​

Keeper is the credential vault for Cirius Group. All privileged account passwords, break-glass credentials, shared service account passwords, and emergency contact numbers live in Keeper — not in email, Teams messages, spreadsheets, or your personal password manager.

Deployment: Keeper Business, SaaS (cloud vault), accessed at https://keepersecurity.com/vault
Authentication: Entra SSO (@ciriusgroup.com) → Keeper SAML — your Microsoft login is your Keeper login. MFA is required at the Entra layer.
Admin accounts: Rory, Greg (access to all shared folders + admin console)

Accessing Keeper ​

  1. Install the Keeper browser extension (Chrome/Edge/Firefox)
  2. Click the Keeper icon → Sign in with SSO → enter your @ciriusgroup.com address
  3. You'll be redirected to Microsoft login → complete MFA → Keeper opens
  4. The extension auto-fills credentials on pages it recognizes

Web Vault ​

  1. Go to https://keepersecurity.com/vault
  2. Enter your email → click Sign In with SSO → Microsoft login
  3. Full vault view — useful for managing records, viewing shared folders, adding new credentials

Mobile App ​

Download Keeper on iOS or Android. Sign in with SSO same as above. Mobile is good for accessing emergency contacts and break-glass credentials when you're away from a workstation.

Keeper Commander CLI (Admin Use) ​

Keeper has a Python CLI tool (keeper-commander) for bulk operations, exports, and scripting. Only Rory uses this directly. If you need a CLI operation, ask.

Vault Organization ​

Keeper organizes credentials into Shared Folders. Each shared folder has its own access permissions — only members of the folder can see its contents.

Shared Folder Structure ​

FolderContentsAccess
Break-Glass — EntraEntra PROD and DDE break-glass account passwordsRory, Greg
Break-Glass — AWS RootAWS root account credentials for all 7 accountsRory
Break-Glass — Palo AltoLocal admin credentials for all 4 Palo Alto firewallsRory
Break-Glass — On-Prem ADDomain break-glass AD accountsRory, Kevin, Greg
PanoramaPanorama admin credentials (AWS DR, DDE)Rory
Infrastructure — SharedService account passwords, API keys, shared infra credsRory, Greg
IT OperationsVendor portals, licensing portals, admin consolesRory, Greg
Emergency ContactsMobile numbers for Rory, Kevin, Greg, Adriana, Arctic WolfRory, Greg, Kevin, Adriana
Vendor AccountsArctic Wolf portal, Cortex XDR, KnowBe4, OneLogin adminRory
Staff PasswordsIndividual staff accounts (each person has their own folder)Per-user only

Folder membership is managed by Rory in the Keeper Admin Console.

Naming Conventions ​

Records follow consistent naming so they're findable without browsing every folder.

Break-Glass Accounts ​

AWS Root — Management
AWS Root — Production
AWS Root — Logging
AWS Root — Networking
AWS Root — Identity
AWS Root — Backup
AWS Root — Dev
Entra Break-Glass — PROD
Entra Break-Glass — DDE
Palo Alto Admin — Azure PublicFW
Palo Alto Admin — Azure PrivateFW
Palo Alto Admin — DDE Firewall
Palo Alto Admin — AWS DR Firewall
Panorama Admin — AWS DR
Panorama Admin — DDE
AD Break-Glass — Primary DC
AD Break-Glass — RODC
AD Break-Glass — Domain Admin (DR)

Service Accounts and Infrastructure ​

SecOps API Key — Production
SecOps API Key — Agent Orchestration
Azure OpenAI — Production
Container Registry — ciriusagentsprod
GitHub Token — kobe-bot
Arctic Wolf — MDR Portal
Veeam — Console Admin

Vendor Portals ​

OneLogin Admin — ciriusgroup.com
KnowBe4 Admin
Zendesk Admin
Cortex XDR Admin
Arctic Wolf Portal
DigiCert / Certificate Vendor

What Goes in Keeper ​

Must be in Keeper:

  • All break-glass account credentials (Entra, AWS root, AD, Palo Alto local)
  • Service account passwords used by infrastructure
  • Shared admin portal credentials (where SSO isn't available)
  • Emergency contact mobile numbers
  • API keys for third-party services (Arctic Wolf, Cortex, etc.)
  • Certificate private keys (if not stored in Key Vault)
  • Recovery codes for MFA-protected accounts

Does NOT go in Keeper:

  • Azure secrets and API keys for automated tools → use Azure Key Vault (cirius-openai-kv-prod)
  • AWS secrets for automated tools → use AWS Secrets Manager
  • Individual employee passwords for SSO-enabled apps (SSO is the credential — Keeper isn't needed)
  • Terraform state encryption keys → managed by Azure Storage CMK
  • Short-lived tokens (access tokens, session tokens) — these expire and don't need vaulting

If you're unsure where something goes: Azure Key Vault for machine-to-machine secrets, Keeper for human-accessed credentials.

Adding a New Credential ​

When you create a new shared account, service account, or vendor portal credential:

  1. Generate a strong password — Keeper's password generator (16+ chars, mixed case, symbols, numbers). Never reuse passwords.
  2. Create a new record in the appropriate shared folder:
    • Click the folder in the left panel → + button
    • Record type: Login (most cases), or use a type-specific template if available
    • Title: follow the naming convention above
    • URL: the login page URL (helps the browser extension auto-fill)
    • Username and Password
    • Notes: any relevant context (account purpose, what it's used for, rotation date)
  3. Verify another admin can see it — check with Rory or Greg that the new record appears in the shared folder for those who need it

Credential Rotation Policy ​

TypeRotation Frequency
Break-glass accountsAnnually + immediately after any use
Service account passwordsAnnually
Vendor admin portalsAnnually
AWS root MFA recovery codesAfter any root account access
Palo Alto local adminAnnually + after any local login

After rotating a credential, update the Keeper record immediately. Do not leave old credentials in Keeper — delete or update them so there's never ambiguity about which is current.

Emergency — Can't Access Keeper ​

If Keeper is unavailable (SSO down, Keeper service outage):

  1. Try the Keeper mobile app — mobile sessions are cached and may work offline or independently of SSO
  2. Try https://keepersecurity.com/vault directly — sometimes the browser extension fails but the web vault works
  3. If both fail and you need a break-glass credential immediately: Rory has a printed emergency credential sheet in the office for true offline access (location in Rory's emergency notes)
  4. For AWS root access specifically: AWS root MFA is a hardware/app token — the password is the blocker if Keeper is down. Contact Rory directly.

If the SSO federation is broken (Entra down), Keeper master password authentication is a backup for the Keeper Admin account. Credentials for this are in the physical emergency kit, not in Keeper itself.

Keeper Admin Console ​

Rory and Greg have admin access at https://keepersecurity.com/console.

Admin tasks:

  • Add/remove users from the organization (users must have @ciriusgroup.com accounts)
  • Manage shared folder membership — who can see which folders
  • Audit log — every credential access, copy, and change is logged (required for HIPAA)
  • Enforce policies — MFA requirements, password complexity, approved 2FA methods
  • Offboarding — when a user leaves, immediately lock their Keeper account from the admin console before disabling their Entra account (prevents one last access)

Offboarding a User from Keeper ​

  1. Keeper Admin Console → Users → find the user
  2. Click Lock immediately — this prevents vault access
  3. Transfer vault to their manager or Rory if they had any personal records with shared context
  4. After 30 days, Delete the account (align with Entra account deletion timeline)

Audit and Compliance ​

Keeper logs every record access, including:

  • Who viewed a record (by name and email)
  • When credentials were copied to clipboard
  • Changes to records (title, password, notes)
  • Folder access events

For SOC2 / HIPAA audits: Keeper Admin Console → Reports → User Activity and Record Activity export. This is evidence for HIPAA §164.312(b) Audit Controls.

Arctic Wolf MDR can be granted read-only access to Keeper audit logs if needed for security monitoring — this is not currently configured but available if required.

Document History ​

DateChangeAuthor
May 2026Initial draft — vault structure, naming conventions, what goes in Keeper, adding credentials, admin operations, offboarding, audit.Rory

Internal use only — Cirius Group