Admin rollout playbook
This playbook guides system administrators and IT owners through a structured Passwork deployment from initial infrastructure setup to full organizational rollout and post-launch monitoring.
The playbook is organized into five phases. Each phase has a defined scope, estimated time, and links to the relevant configuration documentation.
Deployment model
Before starting, decide which deployment model applies to your organization.
| Model | Description | Recommended when |
|---|---|---|
| Cloud | Passwork runs on servers managed by Passwork. | Your organization requires fast deployment, has no dedicated infrastructure team, or wants a turn-key solution. |
| On-premise | Passwork runs on your own servers. Full control over data residency. | Your organization has data sovereignty requirements, an internal security policy requiring self-hosting, or a dedicated team to manage the infrastructure. |
Both models support LDAP, SSO, the full API, and all enterprise features. The onboarding phases below apply to both, with infrastructure-specific steps noted where they differ.
Stakeholder matrix
Identify and involve the following roles before starting the deployment. Not all roles are required for every organization — adjust the matrix to your team structure.
| Role | Responsibilities | Required |
|---|---|---|
| Project lead | Coordinates the deployment, tracks phase completion, communicates with Passwork support | Yes |
| Executive sponsor | Approves the rollout plan and communicates the initiative to the organization | Recommended |
| Server admin | Provisions the server, manages Docker or installer, handles OS-level configuration | On-premise only |
| Network / Firewall admin | Opens required ports, configures reverse proxy, manages SSL certificate | On-premise only |
| Database admin | Manages MongoDB, backup and restore procedures | On-premise only |
| IdP / SSO admin | Configures SAML/OIDC application in the identity provider | If using SSO |
| LDAP / Active Directory admin | Provides LDAP service account credentials, configures DN filters | If using LDAP |
| SMTP / Email admin | Configures outbound email for invitations and notifications | Yes |
| Security / Compliance lead | Reviews encryption model, audit log configuration, access policies | Recommended |
| Help desk lead | Prepares support materials, handles user questions during rollout | Yes |
Rollout phases
Phase 1: Infrastructure & Authentication (~4 h)
Phase 2: Structure & Roles (~2 h)
Data Migration (varies by dataset size)
Phase 3: User Rollout (~2 h per 100 users)
Phase 4: Communication & Activation (~1 h preparation)
Phase 5: Monitoring & Ongoing Management (ongoing)
| Phase | Focus |
|---|---|
| Phase 1 | LDAP/AD integration, SSO configuration, SMTP email, global auth policies |
| Phase 2 | Vault types, custom roles, RBAC, CSE decision, emergency access setup |
| Data Migration | Import existing credentials from Bitwarden, LastPass, KeePass, CSV |
| Phase 3 | Bulk user import, LDAP group synchronization, auto-assignment to vaults |
| Phase 4 | Internal communication strategy, help desk preparation, Activation Kit |
| Phase 5 | Security Dashboard monitoring, adoption tracking, offboarding procedures |
Proof-of-concept (PoC) checklist
Use this checklist to run a structured PoC before full deployment. A PoC typically involves 5–20 pilot users across one or two departments.
| Step | Responsible | Estimated time | Success criteria |
|---|---|---|---|
| Provision server or activate hosted instance | Server Admin / Passwork | 0.5 h | Passwork accessible at target URL over HTTPS |
| Apply license | Project Lead | 0.1 h | License accepted, correct user count visible |
| Configure SMTP | SMTP Admin | 0.5 h | Test invitation email received |
| Configure LDAP or SSO (for PoC group) | LDAP/IdP Admin | 1–2 h | Pilot user authenticates via corporate credentials |
| Create vault structure for pilot department | Manager / Project Lead | 0.5 h | Vault and folders visible to pilot users |
| Import or manually add sample credentials | Manager | 0.5 h | ≥20 passwords visible in vault |
| Invite pilot users | Project Lead | 0.3 h | All pilot users receive invitation and can sign in |
| Pilot users install browser extension | Pilot users | 0.2 h/user | Extension connects and autofill works |
| Pilot users enable 2FA | Pilot users | 0.2 h/user | 2FA active on all pilot accounts |
| Test sharing workflow | Pilot users | 0.3 h | Password shared between two users successfully |
| Test LDAP group sync (if applicable) | LDAP Admin | 0.5 h | Group membership reflected in Passwork |
| Review activity log | Project Lead | 0.2 h | All pilot actions visible in audit trail |
| Collect pilot feedback | Project Lead | — | Feedback documented, blockers identified |
| Go/No-Go decision | Executive Sponsor | — | Decision to proceed to full rollout |
Infrastructure operations reference
If your team is also responsible for deploying and maintaining the Passwork server — Docker installation, high availability, updates, MongoDB backups, health check monitoring, and SIEM integration — see Infrastructure deployment and operations. That guide is intended for the DevOps or server admin role; it is separate from the rollout phases above.
Prerequisites
Before starting Phase 1:
- Passwork license obtained from passwork.pro (cloud activation) or via Customer Portal (on-premise)
- Server provisioned and accessible (on-premise only) — see Technical requirements
- DNS record pointing to the Passwork URL
- SSL certificate available (on-premise only)
- SMTP server credentials available
- LDAP/AD service account credentials available (if using LDAP)
- IdP SAML/OIDC application pre-created (if using SSO)