Before you begin
- The Starter plan or higher. On the Community plan the Vault is read-only (see Plans below)
- An administrator role to add, change, import, rotate and share items
- The vault permissions listed under Permissions below for anyone who only needs to read
Find your way around the Overview
The Atlas Vault Overview shows how many items you hold, which are sensitive and which need attention, such as credentials due for rotation or certificates about to expire. Search Vault at the top searches across everything. Below it, every part of the Vault has a card, grouped like this:
- Clients: Companies (the Companies / Clients page), Locations and Contacts.
- Documentation: Files (the Vault Documents page), Doc Templates and Processes.
- Infrastructure: Assets, Racks, Networks (Networks / IPAM), Network Shares and Websites.
- Security: Credentials, Certificates and Licensing (Software & Licenses).
- Tracking: Secure Shares.
The gear on the Overview opens Vault Settings. Vault documents also appear in the app's global search.
Store and reveal credentials
Credentials holds the shared, company-wide passwords, keys and secrets. Secrets are masked until you choose to reveal or copy them.
- Revealing or copying a secret asks you to sign in again if you have not done so recently.
- Every reveal and copy is written to the audit log before the secret is shown. If the audit entry cannot be saved, the secret is not shown.
- Reveal and copy on shared credentials need an administrator role. Users who can only read credentials see them listed, but not their secrets.
- Exports of credentials (CSV, XLSX or PDF) never include the secrets.
Rotate a credential
Choose Rotate on a credential to open the rotation sheet. It has three modes:
- Record only: you changed the secret somewhere else. Record Rotation logs that the secret was rotated.
- Generate secret: Atlas creates a new random secret and stores it when you choose Rotate Now. Available for one credential at a time.
- Rotate in Entra: rolls a real client secret on a Microsoft Entra app registration. Atlas creates a new client secret on the linked app through Microsoft Graph and stores it as the credential's secret. Turn on Remove the previous secret to delete the old secret from Entra once the new one is safely stored.
Rotate in Entra appears only for a credential linked to an Entra app (live rotation), and linking needs Microsoft Graph to be configured for the tenant. It needs an administrator, a recent sign-in, and the Entra app-registration secret rotation permission. The new secret is shown only once, so copy it if anything outside Atlas needs it.
Use one-time codes and Secret History
- One-time codes: save a credential's TOTP secret (TOTP Seed) and choose Show one-time code to see the current code, with a countdown until it refreshes. Copy one-time code copies it. Showing a code needs a recent sign-in, and each view is audited.
- Secret History: choose View History on a credential. A version is recorded each time the secret is changed or rotated. Restore puts an older value back, saving the current one into history first.
- Changing a credential's secret also expires any live secure share links to it.
Keep personal items in My Vault
My Vault is private to you. Only you, and people you share an item with, can see it. Administrators cannot open your personal vault.
- Share with user… lets a colleague reveal and copy an item. They cannot edit it.
- An administrator can move a personal item to the company vault. This is one way, and the item's Secret History does not move with it.
Import credentials
Administrators can bring credentials in from another password manager on the Import Credentials page, opened from Import on the Credentials page.
- Export your credentials from the old tool. Atlas Vault accepts a CSV export from LastPass, KeePass, 1Password or Bitwarden, an Azure Key Vault JSON export, or a generic JSON array. Download CSV template gives you a ready-made CSV if you are building one by hand.
- Choose or drop the file. It can be up to 8 MB. Only a name and a password are required for each row.
- Check the Detected format, the Column mapping and the File check. Rows with errors are listed and skipped.
- Under On name conflict, choose Skip (keep the existing credential, the default) or Rename (import with a numbered suffix).
- Choose Import. The summary shows how many credentials were Created, Skipped and Failed.
Secrets are encrypted as they are imported. Imported credentials go into the shared company vault. Delete the export file from your computer once the import is done.
Document clients, assets and racks
- Companies, Locations and Contacts hold each client's organization, sites and people, and link to everything documented for them.
- Assets are built from templates. Choose New Template, then Start from a preset or Build from scratch, and lay out the fields: text, numbers, dates, dropdowns, lists, links to other assets, files, section headings and more. A Password field is encrypted and shown only when you choose Reveal.
- Racks draw your mounted hardware as visual rack elevations, front and rear, linked to the assets in them.
- Software & Licenses tracks vendors, license types, seat counts and renewal dates.
- Files (Vault Documents), Doc Templates and Processes hold runbooks and other written documentation. Export .zip downloads every document at once.
Map networks and IP addresses
Networks / IPAM tracks subnets, CIDR ranges and IP address allocations. Each network can record its CIDR range, gateway, DNS servers, VLAN ID and type, such as LAN, WAN, VPN, DMZ, VNet or Subnet. The IP grid shows each address as Allocated, Reserved, Gateway, DNS or Excluded, and Allocate and Release change it.
You do not need to type in your Azure networks. When an administrator opens Networks, Atlas adds the tenant's Azure virtual networks automatically and marks them with an Azure badge.
Track websites and certificates
- Websites: add a site and choose Detect to look up its domain expiry (through WHOIS/RDAP), its SSL certificate issuer and expiry, and whether it is up. Refresh domain, SSL, and reachability looks them up again. The dates do not update on their own, so refresh a site to check it.
- Turn on Track SSL certificate on a website to add its certificate to the Certificates list.
- Certificates: upload a .cer, .crt or .pem file (up to 64 KB). Files that contain a private key are refused.
- Turn on Monitor Expiration and set Alert Before Expiry in days, weeks or months (30 days by default, up to a year). A final alert follows 7 days before expiry.
Expiry alerts are emailed once a day to your tenant's notification recipients: for certificates on the schedule you set, and for website domains and SSL certificates at 30 days, 7 days and once after expiry.
Share an item securely
Secure Shares send one credential or one document to someone outside your team, with a link that always expires. The recipient does not need an Atlas account.
- Open the credential or document and choose Share securely.
- Pick when the link expires: 1 hour, 1 day, 3 days, 7 days or 30 days.
- Optionally turn on One-time view, so the link stops working after it is viewed once.
- Optionally turn on Require a passphrase and enter one (at least 4 characters).
- Optionally enter an address under Email link to, then choose Create link. Copy the link now: it is shown only once.
The passphrase is never included in the email. Send it to the recipient separately, by phone or another channel. Too many wrong passphrases retire the link.
Manage share links
The Secure Shares page lists every link with its status: Active, Viewed, Expired or Force-expired. Choose Force expire to cut off an active link straight away. The recipient sees the secret only after choosing Reveal on the link's page, and every view, and every refused attempt, is audited.
Set Vault Protection
Vault Settings → Vault Protection controls how revealed secrets behave on screen:
- Require confirmation before revealing (on by default).
- Allow clipboard copy (on by default).
- Auto-hide after (seconds): revealed secrets are masked again after this many seconds. The default is 30, and you can pick 5 to 300.
These settings are saved per browser, not for the whole tenant. The page says "Saved on this device for the current tenant". They apply only in the browser where you set them, so each administrator, and each browser they use, needs its own setting. They are a convenience on screen, not an access control: who can reveal a secret is decided by roles and permissions.
Plans
Atlas Vault is included from the Starter plan up. On the Community plan, for example after downgrading, the Vault becomes read-only: Atlas Operations → Vault shows a lock and the notice "Atlas Vault is read-only on your plan". Nothing is deleted.
- Still available: viewing everything, revealing and copying secrets, and exporting your data, including Export .zip for documents.
- Blocked until you upgrade: adding, editing, importing, rotating and sharing items.
To upgrade, use Choose a plan in the app. An expired, suspended or revoked licence blocks reading the Vault as well.
Permissions
Administrators have every vault permission. The permissions are:
- vault.credentials.read: list credentials and view their activity. Revealing shared secrets also needs an administrator role.
- vault.credentials.write: create, edit, rotate, archive and delete shared credentials, and manage share links. Administrators only.
- vault.contacts.read: read contacts, companies, locations, assets, racks, networks, network shares, websites, certificates and licenses.
- vault.contacts.manage: change those records. Administrators only.
- vault.documents.read and vault.documents.export: read vault documents, and export them all as a ZIP archive.
- vault.settings.manage: open Vault Settings.
You can give the read permissions to a custom role for staff who need to look things up but not change them. See Role-Based Access Control.
How secrets are protected
- Secrets are never stored in plain text. Each one is encrypted with AES-256-GCM using its own key, and when your deployment uses Azure Key Vault, that key is itself protected by a key held in Key Vault.
- Every view, reveal, copy, change and share is recorded in the audit log. Filter the Audit Log to vault activity to review it.