Vaulting Credentials Across Every Client an MSP Manages

It's common for a small MSP to reuse a single set of remote access credentials across clients, because managing dozens of unique logins by hand is tedious. The problem surfaces the first time one client's environment is compromised: if the attacker finds that shared credential, every other client using it is exposed too, turning a contained incident into a portfolio-wide one.

A working checklist names, for every client, who on your team currently has access, when that credential last rotated, and whether it's scoped to that client alone or shared across accounts. Run through it before comparing tools, because a vault applied on top of shared, unscoped credentials only makes the underlying problem look organized without fixing it.

For every client, record these items:

• Who on your team currently has access to that client's environment, checked against the secrets tool's own access list rather than ticket notes.
• When each credential last rotated, and whether rotation follows a fixed schedule instead of only happening after an incident.
• Whether the credential is scoped to that client alone or shared across several client accounts.
• How many minutes it would take to revoke a technician's access if their laptop were compromised.
• Which access changes are tied to a ticket, so grants and revocations leave a searchable record.

For the API keys and integration credentials your team uses to manage client accounts in RMM or PSA platforms, Doppler's fast setup and cross-platform sync fit an MSP's pace: new clients get onboarded often, and a new Doppler project takes minutes to stand up scoped to that one account.

Once an MSP manages dozens of clients with standing administrative access, Vault's dynamic secrets and detailed policy engine let you issue a short-lived credential for a specific task instead of holding a permanent password for every client indefinitely. A client that gets breached through a credential your team controlled gets treated the way a regulator treats a known exploited vulnerability sitting unpatched, as something with a clock already running¹.

A client's security review will eventually ask how fast your team can revoke access to their environment if a technician's laptop is compromised. Whichever tool you use, be able to answer with a specific number of minutes, not a description of your general process, because that answer is now part of what you're selling alongside the managed service itself.

A common failure mode in MSP operations is relying on a ticketing system's notes to track who currently has access to a client's environment, rather than checking the secrets tool's own access list directly. Notes drift out of date quickly: a technician's access gets granted in a rush during an incident and the ticket gets closed without anyone removing it afterward.

Make the vault itself the source of truth for who has access, and treat any access grant that isn't reflected there as something to investigate, not assume was handled elsewhere. A quarterly review that compares the vault's actual access list against your ticketing history will surface these gaps before a client's own audit does.

Pick one client at random and list every person on your team who currently has some form of access to their environment, whether through a shared credential, an RMM agent, or a direct login. Most MSPs doing this for the first time find at least one name on that list who left the company or moved to a different account months earlier.

Once you've done it for one client, the process for the rest goes faster, since you're now checking a known pattern of stale access rather than starting from nothing. Repeat this quarterly rather than treating it as a one-time cleanup, since access naturally accumulates again as technicians rotate onto and off of accounts.

An MSP juggling many clients tends to accumulate a shadow record of who has access to what: a spreadsheet, a sticky note, a chat thread nobody can search later. That record drifts from reality within weeks, and it's the first thing an auditor or a new hire will find unreliable.

Route every access change, granting a technician access to a client's secrets store, revoking it when they roll off a contract, through your ticketing system, with the ticket number referenced in the change itself. Vault's audit log and Doppler's activity history both let you attach that reference, so a review months later can trace exactly why a given technician had access on a given day.

This also protects you when a client asks, after an incident, who could have touched their systems. A ticket-linked access history answers that in minutes. A spreadsheet someone forgot to update does not.