---
path: onboarding/admin-onboarding/intro.mdx
title: Admin rollout playbook
sidebar_label: Overview
sidebar_position: 1
slug: admin-rollout-playbook
pagination_next: null
pagination_prev: null
description: >-
  Step-by-step Passwork deployment guide for IT administrators and system owners:
  five rollout phases covering infrastructure, structure, user rollout, activation,
  and ongoing monitoring. Includes stakeholder matrix and PoC checklist.
keywords:
  - Passwork
  - admin
  - administrator
  - rollout
  - deployment
  - onboarding
  - LDAP
  - SSO
  - vault structure
  - PoC
  - proof of concept
  - stakeholder
---

This playbook guides system administrators and IT owners through a structured Passwork deployment from initial infrastructure setup to full organizational rollout and post-launch monitoring.

The playbook is organized into five phases. Each phase has a defined scope, estimated time, and links to the relevant configuration documentation.

## Deployment model

Before starting, decide which deployment model applies to your organization.

| Model | Description | Recommended when |
|-------|-------------|-----------------|
| **Cloud** | Passwork runs on servers managed by Passwork. | Your organization requires fast deployment, has no dedicated infrastructure team, or wants a turn-key solution. |
| **On-premise** | Passwork runs on your own servers. Full control over data residency. | Your organization has data sovereignty requirements, an internal security policy requiring self-hosting, or a dedicated team to manage the infrastructure. |

Both models support LDAP, SSO, the full API, and all enterprise features. The onboarding phases below apply to both, with infrastructure-specific steps noted where they differ.

## Stakeholder matrix

Identify and involve the following roles before starting the deployment. Not all roles are required for every organization — adjust the matrix to your team structure.

| Role | Responsibilities | Required |
|------|-----------------|----------|
| **Project lead** | Coordinates the deployment, tracks phase completion, communicates with Passwork support | Yes |
| **Executive sponsor** | Approves the rollout plan and communicates the initiative to the organization | Recommended |
| **Server admin** | Provisions the server, manages Docker or installer, handles OS-level configuration | On-premise only |
| **Network / Firewall admin** | Opens required ports, configures reverse proxy, manages SSL certificate | On-premise only |
| **Database admin** | Manages MongoDB, backup and restore procedures | On-premise only |
| **IdP / SSO admin** | Configures SAML/OIDC application in the identity provider | If using SSO |
| **LDAP / Active Directory admin** | Provides LDAP service account credentials, configures DN filters | If using LDAP |
| **SMTP / Email admin** | Configures outbound email for invitations and notifications | Yes |
| **Security / Compliance lead** | Reviews encryption model, audit log configuration, access policies | Recommended |
| **Help desk lead** | Prepares support materials, handles user questions during rollout | Yes |

## Rollout phases

```
Phase 1: Infrastructure & Authentication  (~4 h)
Phase 2: Structure & Roles                (~2 h)
         Data Migration                   (varies by dataset size)
Phase 3: User Rollout                     (~2 h per 100 users)
Phase 4: Communication & Activation       (~1 h preparation)
Phase 5: Monitoring & Ongoing Management  (ongoing)
```

| Phase | Focus |
|-------|-------|
| [Phase 1](./phase-1-infrastructure.mdx) | LDAP/AD integration, SSO configuration, SMTP email, global auth policies |
| [Phase 2](./phase-2-structure.mdx) | Vault types, custom roles, RBAC, CSE decision, emergency access setup |
| [Data Migration](./data-migration.mdx) | Import existing credentials from Bitwarden, LastPass, KeePass, CSV |
| [Phase 3](./phase-3-rollout.mdx) | Bulk user import, LDAP group synchronization, auto-assignment to vaults |
| [Phase 4](./phase-4-activation.mdx) | Internal communication strategy, help desk preparation, Activation Kit |
| [Phase 5](./phase-5-monitoring.mdx) | Security Dashboard monitoring, adoption tracking, offboarding procedures |

## Proof-of-concept (PoC) checklist

Use this checklist to run a structured PoC before full deployment. A PoC typically involves 5–20 pilot users across one or two departments.

| Step | Responsible | Estimated time | Success criteria |
|------|-------------|----------------|-----------------|
| Provision server or activate hosted instance | Server Admin / Passwork | 0.5 h | Passwork accessible at target URL over HTTPS |
| Apply license | Project Lead | 0.1 h | License accepted, correct user count visible |
| Configure SMTP | SMTP Admin | 0.5 h | Test invitation email received |
| Configure LDAP or SSO (for PoC group) | LDAP/IdP Admin | 1–2 h | Pilot user authenticates via corporate credentials |
| Create vault structure for pilot department | Manager / Project Lead | 0.5 h | Vault and folders visible to pilot users |
| Import or manually add sample credentials | Manager | 0.5 h | ≥20 passwords visible in vault |
| Invite pilot users | Project Lead | 0.3 h | All pilot users receive invitation and can sign in |
| Pilot users install browser extension | Pilot users | 0.2 h/user | Extension connects and autofill works |
| Pilot users enable 2FA | Pilot users | 0.2 h/user | 2FA active on all pilot accounts |
| Test sharing workflow | Pilot users | 0.3 h | Password shared between two users successfully |
| Test LDAP group sync (if applicable) | LDAP Admin | 0.5 h | Group membership reflected in Passwork |
| Review activity log | Project Lead | 0.2 h | All pilot actions visible in audit trail |
| Collect pilot feedback | Project Lead | — | Feedback documented, blockers identified |
| Go/No-Go decision | Executive Sponsor | — | Decision to proceed to full rollout |

## Infrastructure operations reference

If your team is also responsible for deploying and maintaining the Passwork server — Docker installation, high availability, updates, MongoDB backups, health check monitoring, and SIEM integration — see [Infrastructure deployment and operations](./infrastructure-operations.mdx). That guide is intended for the DevOps or server admin role; it is separate from the rollout phases above.

---

## Prerequisites

Before starting Phase 1:

- Passwork license obtained from [passwork.pro](https://passwork.pro) (cloud activation) or via Customer Portal (on-premise)
- Server provisioned and accessible (on-premise only) — see [Technical requirements](https://passwork.pro/tech-guides/technical-requirements/)
- DNS record pointing to the Passwork URL
- SSL certificate available (on-premise only)
- SMTP server credentials available
- LDAP/AD service account credentials available (if using LDAP)
- IdP SAML/OIDC application pre-created (if using SSO)