Additional enterprise options for least privilege access control | Bitwarden Blog (2024)

Collections are how organizations are able to manage access to logins, credit cards, and other sensitive items with teams in Bitwarden Password Manager. They enable speedy collaboration and make logging in and getting to work more convenient for users, and collections management settings offer both security and flexibility to adapt to the needs of the business.

A collection can be thought of like a shared folder of vault items, with three major advantages:

Vault items can be in more than one collection

A vault item can belong in more than one collection without needing to duplicate the item. This means that an item that’s shared between two teams, such as Finance and HR teams, can be updated just once and those two teams have instant access to the changes. This eliminates administration overhead of having to find instanced or duplicated items to make updates in multiple locations.

Access control for groups and individual users is granular and scalable

Every vault item is assigned to one or more collections. Users can be added to one or more groups. Then groups and/or individual users are assigned to one or more collections. This scalable framework brings access management to any organization size, from small teams to large enterprises.

Additionally, permission levels for each group or individual user can be set to allow for as wide – or narrow – management control the organization prefers. Combined with collection management settings, organizations have the flexibility to choose how they want collections to function, from fully self-serve all the way to requiring complete admin oversight.

Nested (sub) collections have independent access permissions

A collection can contain another nested collection and the access permissions of the top folder are not inherited by the subfolder. This ensures that access to specific collections are intentional and prevents accidental access through misplaced folders. This allows for organization of collections by project, where some members may have the same function (e.g. IT) but do not need access to other team projects (e.g. Cloud Infrastructure).

Owners and admins can manage all collections and items

When this option is checked, administrator roles will have the ability to view, edit, and manage all collections and vault items in them. When this option is unchecked, administrator roles will only have access to collections where they have direct collection permissions assigned.

Limit collection creation and deletion to owners and admins

When this option is checked, administrator roles will be the only members in the organizations that can create and delete collections. When this option is unchecked, all members in the organization will have the ability to create collections.

More details on how these settings affect your organization and how they can be used are available in Resource: Collections Management Settings.

For enterprise customers, a custom role (pictured above) can be assigned to individual users to delegate administrative overhead. For example, help desk team members might have this custom permission to help manage the organization collections without having access to more sensitive organization settings, such as SSO.