Hi,
I used 1Password before. There, you simply created a new shared vault with a person, and you could copy or create items in it. I don’t quite understand it with Bitwarden yet.
Isn’t all organizations the same as vaults?
Is the name of the organization important for its functionality?
Or are collections the vaults?
Do I have to assign the user what they have access to and where they don’t, or where nothing is set up, they don’t have access?
I am not personally familiar with how 1Password works, but from the description in your post above, it seems that the closest thing to a 1Password “shared vault” in Bitwarden is a so-called Collection inside an Organization Vault.
See above. An organization is an umbrella term. It has one owner and one vault, but it may have multiple members and multiple collections.
Not at all. You can name an organization “Foobar”, if you wish.
See above. Most likely, what you know as a “shared vault” in 1Password, is similar to a collection in a Bitwarden organization.
When a new member has joined the organization, they initially don’t have access to anything (assuming that they joined the organization with a Role of user, not administrator). You then need to specify which collections they should have access to, and what level of Permissions they should have in those collections (e.g., view-only access vs. ability to edit & add items).
There is no correct or incorrect way to name the organization or collections. But yes, what you have proposed above seems like a sensible way of organizing things (provided that there are no vault items that you plan to share between all family members — although you could certainly create an additional collection for such purposes).
Maybe you can describe a little bit what type of data would be stored in your shared organization, and who will have access to what — then it would be easier for use to determine what type of collections would be needed.
In a Family plan, there is only a single organization, but you can create an unlimited number of collections within that organization.
If you wish to use other organizations for sharing with completely different groups of people, then you can also create separate organizations. You can only create a single free organization (limited to sharing with one other person, using at most two collections), but you can create any number of paid organizations (Family, Teams, or Enterprise plans).
I just wanted to write down what it’s like with 1password.
In 1Password, you create a new vault and invite the person to it. My understanding now is that I create a collection in the organization and invite the person to it. This way, I can create a collection for each person individually. In 1Password, I also had a vault for each person.
No, that’s not quite how it works in Bitwarden. You first invite the person to join the organization (not the collection), which is a 3-step process: invite → accept → confirm.
For each invited user, you then configure the desired permission level for any collections to which they should have access. Alternatively, after all users have joined the organization, you can edit the collection access (either during or after collection creation).
You can do this in a single Bitwarden organization, as shown below.
Collection structure:
flowchart TD
Z[Family Organization] -->|Vault|A[Family Vault]
A -->|Collection| B(MyCollection)
A -->|Collection| C(SpouseCollection)
A -->|Collection| D(ChildCollection)
Members and Permissions:
flowchart TD
Z[Family Organization] -->|Members|E((Role))
E -->|Admin| F(Me)
E -->|User| G(Spouse)
E -->|User| H(Child)
F -->|Manage|B(MyCollection)
F -->|Manage|C(SpouseCollection)
F -->|Manage|D(ChildCollection)
G -->|Edit|C
H -->|View|D
However, the above is not the most effective structure if you also have items that must be shared between the Spouse and Child users, or for items that would be shared among all three organization members.
I suspect that the issue may in part be that you’re attempting to shoehorn your 1Password configuration into Bitwarden’s organizational structure, and that there is not a good fit between the two (because the two products have fundamentally different designs). Like I said above, if you provide a little information about what you’re actually trying to accomplish (i.e., what pools of vault items should be shared between what groups of users), then we may be able to provide some advice for how to configure this in a simpler way using Bitwarden’s system.
Its not a crazy configuration.
In 1Password is just have two shared vaults for two different Family Members.
In every Vault me and the person can create and share in this vault. For sharing different Accounts.
Thanks for the information. In Bitwarden, you would create your organization, then create two collections (C1 and C2) within that organization. After members M1 and M2 have joined the organization (with a role of User), then you would give “Edit Items” access to M1 for collection C1, and to M2 for collection C2. You automatically have a personal/private vault associated with your account as soon as you register for Bitwarden (same for M1 and M2 — they each automatically get their own personal vault when creating their Bitwarden accounts).
Alternatively, you can assign the desired collection permissions at the time that you invite each user, as part of the invitation process (that way, there would be no delay between the time that M1 and M2 join the organization until they have access to the shared collections). Or, if the users join the organization before the collections are created, you can assign the collection permissions at the time that you create each collection, as part of the collection creation.
I tried this and ohh… boy this is a mess…
1Password is top notch in comparison, regarding family management.
When you move or save entries to the collections, the owner changes to the organization.
Isn’t there another way? So that you can also see who created or modified them?
For my Parents the Passwords where saved in a shared Vault. So i could access this from Home when this was needed and could help. So they don’t even own it anymore.
Can I grant permission so that the person can save, edit, and delete entries in the collection without having access to the organization?
Is it possible to copy the saved entries from the private vault to the shared vault?
What is the reason that you need this kind of auditing? Auditing functionality of this kind is available in Bitwarden, but only in the Enterprise plans. Can you provide some information about your use-case?
Are your parents M1 and M2? Or did you have additional sharing needs that were not described in your post above? Did you have a question in relation to this setup?
No, but why would you want this? There is no drawback of having a person get “access to the organization”.
Normally, you would assign the items to the organization (so that the shared items are owned by the organization). You do have an option to clone an item from your individual vault (creating a copy), and then assigning the cloned item to the organization. This has the drawback that if the password must be changed, then you will need to change it in two different places (in your personal vault and in the shared collection).
Again, I don’t understand why you would want to do this? Why are you reluctant to let the shared items be owned by the organization?
Let’s say M1. In 1Password, all new items are saved to the shared vault by default. So I can access them from home if needed. Or I can create logins for them and have them immediately. I’d like to keep it that way.
I think I expressed myself incorrectly. That they can create, edit, and delete without having access to the organization’s settings, etc.
And with the hidden passwords, they can’t see or copy them, right?
But I can also update the entries from the organization, and the person has the most up-to-date information?
If you enter different login information in the form and log in, Bitwarden asks in the top right corner whether you want to update the saved login. Does this also work for the owner organization?
When I’m in my vault, I see that I’m the owner. So why is this display even there?
In the organization, the badge might look like this: “Organization/User xy.”
It’s also possible that I’m too used to managing 1Password and it’s now difficult for me.
Yes, the two products are different, each with its own advantages and disadvantages, but with different designs and work flows, regardless. You should definitely expect some learning curve as you adjust to switching from 1Password to Bitwarden (or vice versa).
OK, so M1 is actually a group consisting of two individuals (your parents)? To comply with Bitwarden’s Terms of Service, they will each need their own Bitwarden account, as sharing of an account login is not permitted (1Password has similar terms). You would thus need to invite them both to join the organization, and give both of them access to the C1 collection.
This is unfortunately not possible (yet) in Bitwarden. You can specify the collection at the time that you create a new vault item, but the default is for new items to be created in the personal vault (there is an active feature request here: “Default ownership and default collection/folder when creating new vault item”).
There is no reason why you couldn’t continue to do so with a Bitwarden shared collection.
The other organization members (other than you) will not have any access to such settings, unless you deliberately elevate their role to Admin or Owner (instead of the default User role, which has no such permissions), or assign them “Can Manage” access to one or more collections (as opposed to “Edit Items” level of access, which does not permit any changes to collection configuration).
To clarify, the ability to delete shared items from a collection is temporarily disabled for users with “Edit Items” access to a collection, as a result of a recent feature redesign that is going to be rolled back in an upcoming release. However, in the meantime, there is no restriction on creation or editing of shared items by users who have no management or admin access, as long as they have been assigned the “Edit Items” permission for the relevant collection(s).
What, specifically, do you mean by “the hidden passwords”? And under what scenarios to you not want a user to see/copy them? It would seem odd that you give a user edit permissions, so that they can create a shared password, but then you no longer want them to see the password afterwards. Please clarify your question.
Any organization member who has been assigned “Edit Items” or “Can Manage” access to a collection will be able to update the login items stored in that collection. Once the item has been updated, the changes will be immediately visible to all organization members who have permission to view, edit, or manage a collection containing the updated item.
These questions, I’m afraid I don’t understand. Feel free to clarify.
However, there are logins I want to share that can only be used and not edited. Then I need to create a new collection with different permissions, right?
Whether the popup that appears in the top right corner and asks “Do you want to update the saved login” also appears for saved logins in the organization.
Yes, a user who has been given the permission level “Can view, except passwords” or “Can edit, except passwords” to a collection will not be able to use a Bitwarden app or browser extension to view or copy passwords stored in that collection.
However, they could use the drag-and-fill function to transfer the password into any visible form field outside the extension or , or they could autofill the password into the password field on the login form and then toggle the visibility of the password field.
Thus, these options provide only a minor level of protection for the passwords. As noted in the documentation: “treat hidden passwords as you would any shared credential”.
Yes, permissions are set at the collection level, not at the level of individual items.
This, however, seems to be a deviation from the needs you had described previously. Again, the more information you provide about what you’re actually trying to accomplish, the better we will be able to assist.
I’ve been using the configuration for a while now.
When the save popup appears in the top right corner, I can’t select the shared collection. Then I noticed that the owner is listed in the saved logins. If I change it to the organization, the collection can be selected.
Am I correct in thinking that I then have to click Edit for each login/item I want to save and change the owner?
You should be able to select this directly in the popup. This additional step is simply unnecessary.
I personally never use the “Ask to add/updated existing login” features, so I can’t say for sure (unless I set up a test later).
It makes sense (to me) that the “Ask to add login” function for saving new logins would present a simple yes/no interface instead of opening the full “New login” screen in the browser extension. Thus, I am not surprised that it would save the login in the default location (which is the user’s individual vault); as I mentioned previously, there is a feature request proposing the ability to customize the default ownership/collection for new items.
If that is the case, you would indeed need to move the added new login into an existing collection, if you want the item to be shared. You can do this in bulk, using the Web Vault.
However, if you have enabled “Ask to updated existing login”, then I assume that confirming a password update using the interactive prompt will directly update the credentials in the shared collection, no additional steps required.
Yes. But you can also select a folder directly in the popup. There you could select the respective collection and the owner would be automatically adjusted to it. The option is already there, but it should be possible.
And I gave it a +1. But there’s no current news on the topic.