nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Support Articles

Set up LastPass federated login with Microsoft Entra ID

Federated login for LastPass enables LastPass Business users to authenticate using their organization's Active Directory (Microsoft Entra ID) without creating a separate LastPass. This setup requires a Premium tier Microsoft Entra ID subscription and an active LastPass Business account, with specific limitations for federated user access.

Important: Before you begin setting up the connection between the LastPass new Admin Console and the Microsoft Entra ID portal, review the account requirements and limitations that apply to federated users.

https://vimeo.com/819920880?fl=pl&fe=sh

Note: In this set of instructions, Microsoft Entra ID is defined as the Identity Provider (IdP) used for authentication.

Account requirements

To sync your Microsoft Entra ID with LastPass, you need the following:

A Premium tier subscription for Microsoft Entra ID Active Directory
An active trial or paid LastPass Business or LastPass Business Max account
An active LastPass admin account (required to activate your trial or paid subscription)
A non-federated super admin to reset master passwords

Note: The LastPass Microsoft Entra ID SCIM endpoint for federated login does not require any software installation.

Restriction: LastPass directory integrations have limitations, including the use of different directory instances or multi-domain and multi-forest configurations. For more information, see What are the limitations for LastPass users with federated login?.

Important: LastPass clients (such as browser extensions and mobile apps) receive an OAuth Access Token with user.readwrite access, which allows them to read and write only the LastPassK1 attribute. However, if you have other Microsoft Entra ID apps with user.read.all or user.readwrite.all access, those applications can also read the LastPassK1 attribute.

Limitations for federated users

Review What are the limitations for LastPass users with federated login?
Linked personal accounts must be verified on each new device that a federated user uses to log in and access their LastPass vault.

In this section: