Admin console

The overview shows members, two-factor sign-in, recovery enrollment, the average security score, the policy and the state of the log. Below it is what needs your attention: people waiting for confirmation, open recovery requests, vaults that need a new key or members without required two-factor sign-in.

A table with role, status, two-factor sign-in, recovery, last sign-in and security score. Filters show, for example, who is waiting or has no two-factor sign-in. Here you invite, confirm, change roles, pause access and offboard.

The overview counts members and guests separately. Guests are free and do not count as members.

Policies set rules for all members. When you change something, choose Review and sign. Passbox signs the policy with your key, and members' apps check that signature. A manipulated server therefore cannot loosen a policy or bring back an older version.

If a member belongs to several organizations, the strictest setting applies to their account.

The log records what happens in the organization: sign-ins and failed attempts, changes to members, groups and vaults, changes to items in shared vaults, recoveries and policy changes. With "Log item usage" on, opening, revealing, copying and filling are added. Item contents never appear in the log.

• Filter by action, person, target and time range.
• Export as CSV for spreadsheets or as JSON that can be verified.
• Verify: Every entry contains a hash of the previous one, so a changed or deleted row stands out. You can also verify the chain on your own device.
• Retention: In the settings you choose how long entries are kept, from 30 days to ten years or forever. Passbox deletes older entries automatically. The rest of the chain stays verifiable.

Whoever controls the database could recompute the chain from some point on. So export the log regularly or forward it to a SIEM (see Integrations). You then have an independent copy.

• Security: per member, the security score and how many logins are weak, reused or unsecured, plus whether the master password meets the policy. Apps report this once a day after unlocking, as numbers only. Only problems filters, Export CSV takes the table with you.
• Breached websites: per breach, how many members are affected and how many already have a new password. Only logins in the organization's vaults count here.
• Access: who can open which vault with which permission, directly or through groups.
• Unused vaults: vaults without changes and without logged use for 90 days.

Admins can help members who forget their master password, without seeing vault contents. In new organizations this is set up from the start. Here you see who is enrolled and use Let another admin approve to allow more admins to approve requests. How a request works and what an admin could technically see is described in Account recovery.

To turn recovery off for everyone, first turn off Require recovery enrollment in the policy. Then choose Turn off recovery for everyone. If you set it up again later, members enroll again.

When an admin who could approve recoveries is demoted, the server deletes their copy of the key. If they copied it before, they would keep it. The app cannot replace the key for this case yet.

When someone leaves the company, choose Offboard… for the person:

1. Review: Passbox lists the vaults the person can open, their groups and vaults only they manage.
2. Hand over: For each such vault you choose a new manager. This works for vaults you are a member of yourself. For others, ask the person beforehand to hand the vault over to someone.
3. Sign out: By default Passbox signs the person out on all devices. Until they sign in again, this also ends access to their personal vaults. Nothing is deleted.
4. Offboard: Access ends at once. Your device replaces the keys of the vaults and groups you manage.

Vaults you do not manage get their new key as soon as one of their managers unlocks next. Until then the console shows them as "waiting for a new key". Finally, change the passwords the person had access to. What they saw before, they may remember.

Forward the activity log to your SIEM, for example Splunk, Microsoft Sentinel, Elastic, Graylog or Wazuh:

• Events API tokens: A token lets a collector read this organization's log and nothing else. It is shown only once.
• Webhooks: Passbox sends new entries in batches to an HTTPS address. Each delivery is signed with a secret that you check in the X-Passbox-Signature header. Failed deliveries are retried with growing pauses.

Technical details for developers are in the API reference.

Under Billing you manage your Business subscription, see Set up Business. Under Settings you change the name and log retention, leave the organization or delete it.