The client vault: passwords and secrets clients can see, and ones they cannot

What you will have

• Turn on MSP Only for a credential meant only for your own techs, never the client.
• Turn on Visible to all client users for a credential the whole company should be able to read.
• Leave a credential hidden and see Visible to specific users, the third option, for naming one person instead of everyone.
• Read the lock icon and the Shared chip on the vault list itself, without opening a single entry.
• Sign in as a client contact and see their own Password Vault hold only what was actually shared.

Why it works this way

Steps

1. 1

   Open Microsoft 365 Global Admin and turn on MSP Only.

   The panel reads MSP Only: never shared with the client, and the Visible to all client users toggle below it greys out - it cannot be turned on while MSP Only stays on.

   Note: Turning MSP Only on clears Visible to all client users and removes anyone already named under Visible to specific users.

   

2. 2

   Open Guest WiFi and turn on Visible to all client users.

   The eye icon turns from grey to green, and the hint underneath changes to All client users can see this item. Add specific users for targeted visibility.

   

3. 3

   Open Practice Owner Personal Banking and leave it hidden.

   Both toggles stay off, and Visible to specific users sits ready underneath with its own Add User button - the third option, for one named person instead of the whole company or nobody.

   

4. 4

   Back on the vault list, read the lock icon and the Shared chip on each row.

   An amber closed lock is MSP Only, an open grey lock with no chip is hidden, and an open grey lock with a Shared chip is visible to all client users - all three without opening a row.

   

5. 5

   Sign in as a client contact and open Documentation.

   Priya Shah signs in to Bluebird Dental's own portal, where Documentation sits under Resources in the client sidebar.

   

6. 6

   Open Password Vault and see only what was actually shared.

   Guest WiFi is the only entry listed - Microsoft 365 Global Admin (MSP Only) and Practice Owner Personal Banking (hidden, nobody named) never appear here.

   

The pages behind each click

• Document a client →
• The client record at a glance →

Other ways to do this

If it did not work

• If Visible to specific users finds nobody when you search a name, this client's Microsoft directory has not synced any accounts yet - Add User only searches synced Microsoft 365 users, not the names on the client's Portal Access list.
• If an entry still will not show for a client, open it and check MSP Only first - it is the one control that always wins over the other two.

Questions this page answers