How to Migrate from LastPass to Keeper Enterprise SSO (2026 Step-by-Step Guide)

To migrate from LastPass to Keeper Enterprise SSO, export your LastPass vault as a CSV, import it into Keeper Security using the Keeper Commander CLI or web importer, then configure Keeper's SSO Connect Cloud via your identity provider (Okta, Azure AD, or similar) under the Admin Console's Provisioning tab. The full process takes 2–4 hours for most IT teams and requires no downtime for end users if staged correctly.

What You'll Accomplish — and Why It Matters

LastPass's 2022–2023 breach disclosures permanently damaged enterprise trust in the platform. If your organization is still on LastPass Business ($4.00/user/month, billed annually, 5-seat minimum) or LastPass Teams ($4.00/user/month, billed annually, 50-seat maximum), moving to a zero-knowledge architecture with native SSO support closes a real attack surface. Keeper Security is the platform I recommend for this migration — it supports SAML 2.0 and OIDC natively, integrates with every major identity provider, and passed a SOC 2 Type II audit. Our Best Enterprise Password Manager Review (2026) covers how Keeper stacks up against the field if you want the full comparison first.

By the end of this guide your team will have:

All LastPass credentials imported into Keeper with folder structure preserved
SSO Connect Cloud active and tested against your identity provider
MFA enforced at both the IdP and Keeper layers
Verified zero credential gaps via Keeper's audit report

Prerequisites / What You'll Need

LastPass account type: LastPass Business or Teams (admin access required for bulk export)
Keeper plan: Keeper Enterprise — $5.00/user/month billed annually, 10-seat minimum (SSO Connect Cloud is Enterprise-only; it is not available on Keeper Business at $4.00/user/month)
Keeper Commander CLI: v16.6 or later (Python 3.9+, available on Windows 10/11, macOS 12+, Ubuntu 20.04+)
Identity provider: Okta, Azure AD, Google Workspace, JumpCloud, Ping Identity, or any SAML 2.0 / OIDC-compliant IdP
Admin rights in both LastPass and your IdP tenant
Keeper Admin Console access at admin.keepersecurity.com
MFA method ready: TOTP app (Google Authenticator, Authy), WebAuthn/FIDO2 hardware key (YubiKey 5 series), or Duo push — Keeper Enterprise supports all three plus SMS (SMS not recommended for enterprise)
Staging environment recommended: create a test Keeper node with 3–5 pilot users before full rollout

Step 1: Export All Credentials from LastPass

Log into the LastPass web vault at lastpass.com as an admin. Navigate to Account Options → Advanced → Export → LastPass CSV File. If you manage shared folders, you must export each shared folder separately: go to Sharing Center → [Folder Name] → Export.

Expected output: One or more .csv files with columns: url, username, password, totp, extra, name, grouping, fav.

Gotcha: LastPass enforces a re-authentication prompt before export. If your org uses LastPass's "Master Password Re-prompt" policy, every admin will need their master password handy — SSO credentials alone won't satisfy the prompt. Also, secure notes export as plaintext in the CSV; treat these files as highly sensitive and store them only on an encrypted drive (BitLocker or FileVault) for the duration of the migration.

For bulk enterprise exports, use the LastPass Enterprise API (requires Admin Console access under Enterprise → Reporting → Export Users) to pull a full credential report in JSON format — useful if you have 50+ users with shared folder structures.

Step 2: Prepare and Clean the Export File

Open the CSV in a tool that doesn't auto-format data — VS Code or a plain text editor, not Excel (Excel corrupts leading zeros and special characters in passwords). Run a quick check:

Remove any rows with blank password fields (these are usually form-fill entries, not credentials)
Check for duplicate entries across personal and shared folder exports
Confirm TOTP seeds exported correctly in the totp column — LastPass exports these as otpauth:// URIs

Command to deduplicate on Linux/macOS:


sort -u -t',' -k1,1 -k2,2 lastpass_export.csv > lastpass_clean.csv

Step 3: Import Credentials into Keeper

Download and install Keeper Commander CLI:


pip install keepercommander

Authenticate to your Keeper account:


keeper shell
> login [email protected]

Run the import command against your cleaned CSV:


> import --format=lastpass lastpass_clean.csv

Keeper Commander maps LastPass CSV columns to Keeper record fields automatically. Shared folder entries import into Keeper Shared Folders if you pre-create folders matching the grouping column values.

For shared folders specifically:


> import --format=lastpass --shared lastpass_sharedfolder.csv

Expected output: Imported X records, 0 errors — any errors are logged to ~/.keeper/report.log.

Gotcha: Keeper's free import maps flat CSVs into your root vault. If you have a nested folder hierarchy in LastPass (e.g., IT > Dev > Staging), you'll need to pre-create the nested folder structure in Keeper's Admin Console before importing, or use the --folder flag to assign a parent folder per import batch.

Step 4: Configure Keeper SSO Connect Cloud

Log into the Keeper Admin Console at admin.keepersecurity.com. Navigate to Admin → Nodes → [Your Node] → Provisioning → Add Method → SSO Connect Cloud.

Keeper will generate:

SP Entity ID: https://keepersecurity.com/api/rest/sso/saml/
ACS URL: https://keepersecurity.com/api/rest/sso/saml//sso
Metadata URL: downloadable XML for your IdP

In your Identity Provider (example: Okta):

Create a new SAML 2.0 application
Set Single Sign On URL to the Keeper ACS URL
Set Audience URI (SP Entity ID) to the Keeper SP Entity ID
Map attributes: email → Email, firstName → First, lastName → Last
Download the IdP metadata XML and upload it in Keeper Admin Console under SSO Connect Cloud → Identity Provider Metadata

For Azure AD: use the Enterprise Applications → New Application → Non-Gallery flow and paste the ACS URL into the Reply URL field. For Google Workspace: use Apps → Web and Mobile Apps → Add Custom SAML App.

Expected output: Keeper Admin Console shows "SSO Configuration Active" with a green status indicator after you save.

Step 5: Enable and Test SSO Login for Pilot Users

In the Keeper Admin Console, navigate to Admin → Users → [Pilot User] → Edit → Login Method → SSO. Set 3–5 test users to SSO before rolling out to the full org.

Have a pilot user navigate to your SSO-enabled Keeper URL:


https://keepersecurity.com/vault/#sso/<your-node-id>

They'll be redirected to your IdP login page, authenticate, and return to their Keeper vault — no separate Keeper master password required for daily login. Keeper still uses a Device Approval step on first login per device, which confirms the device's locally-generated EC elliptic curve key pair before decryption proceeds.

MFA enforcement: Go to Admin → Roles → [Role] → Enforcement Policies → Two-Factor Authentication. Enforce TOTP or WebAuthn/FIDO2 here independently of whatever MFA your IdP enforces — this is Keeper's second factor at the vault layer.

Step 6: Migrate Remaining Users and Deprovision LastPass

Once pilot users confirm vault parity (all records present, SSO login functional), proceed with bulk SSO assignment:

In Keeper Admin Console: Admin → Users → Select All → Bulk Action → Change Login Method → SSO

Set a 2-week parallel-run window where both LastPass and Keeper are active. After the window, go to LastPass Enterprise Admin Console → Enterprise → Users → Disable Accounts, then cancel your LastPass subscription from Account Settings → Billing.

Verification — Confirm the Migration Succeeded

Run the Keeper Security Audit report: Admin Console → Reporting & Alerts → Security Audit. You should see:

Security Score populated for all migrated users
Breach Watch alerts flagging any imported LastPass credentials found in known data breaches (Keeper pulls from HaveIBeenPwned's dataset)
Zero users still assigned to the "Master Password" login method (all should show "SSO")
Event log showing user_login events via SSO for all pilot users

Cross-check record count: export a Keeper vault report (Reporting → Records) and confirm the total record count matches your LastPass export row count minus any intentional deduplication.

Recommended Tools

Keeper Security (Enterprise)

Keeper Security is the platform this entire migration targets, and for good reason. The Enterprise tier ($5.00/user/month, billed annually, 10-seat minimum) is the only Keeper tier that includes SSO Connect Cloud, Advanced Provisioning (SCIM via Okta, Azure AD, or JumpCloud), and role-based access controls granular enough for regulated industries.

Encryption: AES-256-GCM at rest, TLS 1.3 in transit, with PBKDF2-SHA256 key derivation. The architecture is zero-knowledge — Keeper's servers never see plaintext vault data, and SSO tokens from your IdP are used only to authenticate device key approval, not to decrypt vault records. Keeper is headquartered in Chicago, Illinois, USA, and operates under US jurisdiction with SOC 2 Type II certification (audited by Schellman). Platforms supported: Windows 10/11, macOS 12+, iOS 16+, Android 10+, Chrome, Firefox, Safari, Edge, and Linux CLI.

MFA supported: TOTP, WebAuthn/FIDO2 (YubiKey 5, Google Titan), Duo Security push, RSA SecurID, and SMS (available but discouraged in policy).

For regulated industries using Keeper, our Best Password Manager for Healthcare & HIPAA Compliance in 2026 covers how Keeper satisfies BAA requirements specifically.

Try Keeper Security — the only password manager with native SSO Connect Cloud and zero-knowledge architecture at the Enterprise tier.

1Password (Business — as a Comparison Benchmark)

If your organization is still evaluating whether Keeper Enterprise is the right SSO-capable destination, 1Password Business ($7.99/user/month, billed annually, no seat minimum) offers SSO via Unlock with SSO (formerly SCIM Bridge) and supports the same SAML 2.0 / OIDC providers. It uses AES-256-GCM encryption with PBKDF2-SHA256 and adds a Secret Key as a second encryption factor — which complicates SSO-only provisioning slightly, since each device still needs the Secret Key on first setup.

1Password is headquartered in Toronto, Ontario, Canada, subject to Canadian privacy law (PIPEDA). SOC 2 Type II audited. Platforms: Windows, macOS, iOS, Android, Linux, Chrome, Firefox, Safari, Edge.

In my experience, 1Password's SCIM Bridge requires a self-hosted Docker container or cloud-hosted instance for SSO provisioning, adding infrastructure overhead that Keeper's fully cloud-native SSO Connect Cloud avoids. That's the concrete reason I recommend Keeper for this specific migration path.

Try 1Password — a strong alternative if you want the Secret Key as an extra encryption layer alongside SSO.

Troubleshooting

Issue 1: "Import failed — invalid CSV format"

Exact error: Error: Unsupported CSV column header 'grouping'

Fix: Keeper Commander's LastPass importer expects the column header to be grouping (lowercase). If LastPass changed its export headers, rename the column manually in a text editor before re-running the import command.

Issue 2: SSO redirect returns "SAML Response Signature Invalid"

Exact error: SSO Authentication Error: SAML Response Signature Invalid (Error Code: 2001)

Fix: Your IdP is signing with SHA-1. Keeper requires SHA-256 signatures. In Okta: Application → Sign On → Advanced Sign-On Settings → Signature Algorithm → RSA-SHA256. In Azure AD: Enterprise App → SAML Signing Certificate → Signing Algorithm → SHA-256.

Issue 3: Users see "Device Approval Pending" loop

Exact error: Users complete SSO login but land on a perpetual "Waiting for device approval" screen.

Fix: An admin must approve the device in Admin Console under Admin → Devices → Pending Approvals, or enable Auto-Approve Devices for the node under Provisioning → Device Approval → Automatic. Auto-approve is acceptable for managed corporate devices enrolled in MDM; require manual approval for BYOD.

Issue 4: TOTP seeds from LastPass aren't populating in Keeper

Exact error: No error shown — TOTP fields are simply blank after import.

Fix: LastPass exports TOTP seeds as otpauth://totp/... URIs in the totp column. Keeper Commander v16.6+ parses these correctly. If you're on an older version, upgrade: pip install --upgrade keepercommander, then re-import.

Issue 5: Shared folder permissions not replicating

Exact error: Users report they can see imported shared folder records but cannot edit them.

Fix: LastPass shared folder permission levels (View Only, Can Edit, Can Edit & Share) don't map 1:1 to Keeper Shared Folder permissions (View Only, Can Edit, Can Edit & Share, Can Manage). After import, manually review shared folder permissions in Keeper Admin Console under Shared Folders → [Folder] → Users and reassign edit rights as appropriate.

FAQ

Does Keeper's SSO login mean my identity provider can access my vault passwords?

No. Keeper's SSO Connect Cloud uses your IdP (Okta, Azure AD, etc.) only to verify your identity and authorize device key approval. The actual vault decryption uses an AES-256-GCM key derived from your device's locally-stored EC elliptic curve key pair — never from the SSO token itself. Keeper's zero-knowledge architecture means Keeper's servers and your IdP servers never receive or store your plaintext passwords. Even if your IdP were breached, the attacker would get authentication access but not vault dec