• Review the limitations that apply to federated user accounts.
  Restriction: LastPass directory integrations have limitations, including the use of different directory instances and/or multi-domain & multi-forest configurations. Learn more about federated login limitations.
• It is highly recommended that you create a non-production Active Directory environment with Federation Services so that you can familiarize yourself with AD FS for LastPass Business.
• Your test environment should also include a non-production version of the components in Step #1 (including creating a separate LastPass Business trial account for testing). Please follow all of the setup steps below using your non-production LastPass Business account with your test environment first to avoid any unintentional user account data loss.
• It is also highly recommended that in a live environment you implement Multifactor Authentication for your users, however, please be aware of the following:
  • You must set up Multifactor Authentication at the Identity Provider level (AD FS), and not at the LastPass level (via the Admin Console and/or end user Account Settings). Using Multifactor Authentication within LastPass is not supported for federated users, and will result in those users being unable to access their vault.
  • You cannot enforce Multifactor Authentication policies in the LastPass Admin Console because this authentication will occur outside of LastPass, between your Identity Provider (AD FS) and your authentication service. For this reason, we recommend enforcing Multifactor Authentication policies in AD FS.

By default, we recommend to use the company-wide key, as the steps outlined here do not require a change to your Active Directory Schema. If you still want to set up a unique key for each of your users, please follow these setup instructions.