Enterprise Policies

Enterprise polices allow Enterprise organizations to enforce security rules and default settings for all members, like mandating the use of a two-step login.



warning

We recommend setting enterprise policies prior to inviting users to your organization. Some policies will revoke non-compliant users when turned on, and some are not retroactively enforceable.

Organization owners and admins can apply enterprise policies. To update a policy:

1. Within the Bitwarden web app, open the Admin Console.

2. Select Settings.

3. Select Policies.

4. Select the name of the policy you want to change:
   

   

5. Check or uncheck Turn on.

6. (Optional) If more options appear, configure them.

7. Select Save.

Turn on the Require two-step login policy to require members to use any two-step login method to access their vaults. If you are using an SSO or identity provider's 2FA functionality, you don't need to enable this policy. This policy is enforced even for users who have only

invitation to your organization.



warning

Organization members who are not owners or admins and do not comply with this policy will have access revoked when you activate this policy. Users who have access revoked as a result of this policy will be notified via email, and must take steps to become compliant before their access can be restored.

Turn on the Master password requirements policy to enforce a configurable set of minimum requirements for users' master password strength. Organizations can enforce:

• Minimum master password complexity

• Minimum master password length

• Types of characters required

Password complexity is calculated on a scale from 0 (weak) to 4 (strong). Bitwarden calculates password complexity using the

.

Use the Require existing members to change their passwords option to require existing, non-compliant organization members, regardless of role, to update their master password during their next login. Users who create a new account from the organization invite will be prompted to create a master password that meets your requirements.

Turn on the Remove Unlock with PIN policy to prohibit members from configuring or using

on web apps, browser extensions, and desktop apps. This policy applies to all organization members when turned on, including admins and owners.



note

Support for enforcing this policy on mobile apps is planned for a future release.

Members who are using unlock with PIN prior to the policy will have it enforced on their next log in, meaning if they have an already logged-in session they will still see the option in the UI and be able to unlock with PIN until they log out or turn off the unlock with PIN option in the client.

Turn on the Account recovery administration policy to allow owners and admins to help members regain access to their account. With this policy, owners and admins can send members enrolled in

a link to reset their master password. By default, users must

self-enroll in account recovery

to be eligible.

To simplify account recovery enrollment, check Require new members to be enrolled automatically when activating the policy. This enrolls new members when their

and prevents them from withdrawing from account recovery. Current organization members are not retroactively added, so they still need to self-enroll.

The Account recovery administration policy is required for your organization to use

.



note

The 

Single organization

 policy must be turned on before activating this policy.

Turn on the Password generator policy to enforce a configurable set of minimum requirements for any user-generated passwords for all members, regardless of role. Organizations can enforce:

• Password, passphrase, or user preference

For passwords:

• Minimum password length

• Minimum number (0-9) count

• Minimum special character (!@#$%^&*) count

• Types of characters required

For passphrases:

• Minimum number of words∂

• Whether to capitalize

• Whether to include numbers



warning

Existing non-compliant passwords will not be changed when this policy is turned on, nor will the items be removed from the organization. When changing or generating a password after this policy is turn on, configured policy rules will be enforced.

A banner is displayed to users on the password generator screen to indicate that a policy is affecting their generator settings.

Turn on the Single organization policy to restrict non-owner/non-admin members of your organization from being able to join other organizations or from creating other organizations. This policy is enforced even for users who have only

invitation to your organization, however this policy is not enforced for owners and admins.



warning

Organization members who are not owners or admins and do not comply with this policy will have access revoked when you activate this policy. Users who have access revoked as a result of this policy will be notified via email, and must take steps to become compliant before their access can be restored.

The Single organization policy must be turned on before activating the following policies:

• Account recovery administration

• Require single sign-on authentication

• Default URI match detection

• Session timeout

If you are unable to turn off the Single organization policy, verify that all of the above policies are deactivated, that you don't have a

, and then try again.

Turn on the Require single sign-on authentication policy to require non-owner/non-admin users to log in with SSO. If you're self-hosting, you can enforce this policy for owners and admins using

. For more information, see

Using Login with SSO

. This policy is not enforced for owners and admins.

Members of organizations using this policy will not be able to

.



note

The 

Single organization

 policy must be turned on before activating this policy.

Turn on the Enforce organization data ownership policy to prevent private ownership of vault items. This adds

, an organization-owned location that can only be accessed by that member. My items replaces the individual's My vault, shifting ownership from the user to the organization. While the member is active in the organization, administrators are unable to edit or export the user's My items.



note

This policy only affects members who are not organization owners or admins. Organization owners and admins can continue using My vault.

Once turned on, all new saved items are placed in that member’s My items by default. When on the Add Item screen, a banner informs users that a policy affects item ownership options.

After a

, the data in that member’s My items stays with the organization. Owners, admins, and some custom role users can assign other members access to the removed members’ My items.



warning

At this time, Bitwarden recommends only organizations that have not started onboarding members to turn on the

Enforce organization data ownership policy

.

If your organization activated the policy before version

2025.11.0

, My items will be created for members confirmed since that release. Preexisting members will not have My items and can continue using their My vault. A future release will allow organizations that already began onboarding members and use individually-owned vaults to migrate all credentials to organization ownership.

Turn on the Remove Send policy to prevent members who are not an owner or admin from creating or editing a Send using

. Members subject to this policy will still be able to delete existing Sends that have not yet reached their

deletion date

. This policy is not enforced for owners and admins.

A banner is displayed to users in the Send view and on opening any existing Send to indicate that a policy is restricting them to only deleting Sends.

Turn on the Send options policy to allow owners and admins to specify options for creating and editing Sends. This policy is not enforced for owners and admins. Options include:

Turn on the Remove card item type policy will prevent members from creating or importing credit cards to organization and individual vaults.

Users who are members of multiple organizations will still be able to use cards only in an organization that allows it, even if a different organization has activated this policy.

Existing cards will be automatically hidden, however the data will not be deleted and cards will re-appear should administrators disable the policy.

Turn on the Default URI match detection policy to set the

for your members. This helps you configure

autofill

to best meet your organization's security and policy needs.

When turning on this policy, select your organization's Default URI match detection from the dropdown menu:

• Base domain

• Host

• Exact

• Never



note

Users not subject to this policy have two more options when setting their individual account's default match detection: Starts with and Regular expression. These options are not offered for an organization's default because they can match unintended pages and expose credentials.

Once the policy is activated, members cannot view or change their account's Default URI match detection in  Settings → Autofill. They can, however, still choose a URI match for individual login items. This policy does not affect organization owners or admins.



note

The 

Single organization

 policy must be turned on before activating this policy.

Turn on the Session timeout policy to set limits and control members'

behavior. You can customize two options:

• From the Maximum allowed timeout dropdown menu, set a limit to how long sessions can remain active:

  • Immediately: When the user stops interacting with Bitwarden

  • Custom: After the amount of time entered in Hours and Minutes

  • On system lock: When the device is locked or the screensaver activates (browser extension and desktop app only)

  • On app restart: When the Bitwarden app is closed and reopened

  • Never: No maximum session duration is set.

• From the Session timeout action dropdown menu, choose what happens after a session ends. You can specify

  Lock or Log out
  or select User preference to let members choose in their account settings.



note

New timeout options were added in

version 2025.11.0

and are currently only enforced in the Android app: On system lock, On app restart, and Never. These timeout options will be supported on more clients in a future release.

When this policy is turned on and users edit their account's Vault timeout settings, the Timeout options will not exceed the maximum you picked for the organization and some, like On browser restart and Never, will not be available. This policy does not affect organization owners.



note

The 

Single organization

 policy must be turned on before activating this policy.

Turn on the Remove export policy to prohibit non-owner and non-admin members of your organization from

. This policy is not enforced for owners and admins.

In the web app and CLI, a message is displayed to users indicating that a policy is affecting their options. In other clients, the option will simply be disabled:

Turn on the Remove Free Bitwarden Families sponsorship policy to prevent members of your organization from having the option to

through your organization.

Users who have redeemed a sponsored Families organization prior to the policy being activated will continue to have their organization sponsored until the end of the current billing cycle. Their stored payment method will be charged for the organization when the next billing cycle begins.

Turn on the Activate auto-fill policy to automatically turn on the

on the browser extension for all existing and new members of the organization. If activated, members will not have the ability to disable autofill on page load.

Turn on the Automatically login with SSO policy to allow login forms to be filled and submitted automatically when accessing non-SSO apps from your identity provider. In order to enable this setting:

1. To enable the Automatic login with SSO policy, check the Turn on box, and enter your Identity provider host URL(s). The URL should include protocol://domain.

   

2. As an Administrator on your IdP, add an application, or app shortcut to your end-user dashboard containing the destination URL with the added parameter ?autofill=1

   

3. Once the application has been saved, users may select the application from the IdP dashboard and Bitwarden will autofill and login to the application.



note

Automatic login with SSO will autofill data based on the users current active account on the Bitwarden browser extension. Additionally, the data autofilled will be the most recent credential that user used associated with the target application's URL.