Keeper® brings credential requests, approvals and privileged elevation into Microsoft Teams, allowing users and administrators to complete secure workflows without leaving Teams. Every action stays end-to-end encrypted and runs on infrastructure you control.
Keeper’s Teams workflow is deployed within your own environment, allowing organisations to extend secure access into Microsoft Teams while adhering to Keeper’s zero-knowledge architecture. The Teams agent and Keeper Commander® run in Docker containers hosted in your infrastructure and communicate with the Microsoft Teams cloud over an outbound connection you control.
Encryption keys remain under your control, ensuring secrets stay encrypted throughout the workflow and no one — not even Keeper — can access any data. The Teams workflow helps organisations implement Zero Standing Privilege (ZSP) by allowing users to request temporary access, receive approvals and automatically enforce time-limited permissions without exposing credentials. Since the Teams app is published only to your organisation’s private app catalog, the app is not listed in the public Microsoft Teams store.
Set up the Teams app in your Microsoft Azure tenant, then launch the Keeper Commander service and Teams agent. Keeper Secrets Manager securely stores the service configuration, while a dedicated Commander service account provides the permissions needed to process access requests and approvals.
Users start a private chat with the Keeper bot to request access to records, shared folders or temporary share links directly from Microsoft Teams. Every access request includes a mandatory business justification and an optional time limit, allowing administrators to review requests without users leaving Teams.
Requests appear in a private approvals channel, where designated administrators can review each request, configure permissions, apply time limits and approve or deny access in just a few clicks. Once approved, Keeper immediately enforces the assigned permissions and synchronises the changes.
Access requests appear instantly in a dedicated Teams approvals channel, helping administrators respond quickly without relying on easily missed email notifications.
Administrators can configure custom permissions, attach a time limit and grant only the necessary access within Microsoft Teams. Keeper automatically enforces every permission according to organisational policy behind the scenes.
Create One-Time Share links directly from Microsoft Teams when temporary access is needed. Approvers can allow bidirectional sharing or restrict recipients to view-only access based on business requirements.
To securely store a new login, generate one in Microsoft Teams, save it to a shared folder and let Keeper auto-generate a strong password that is stored in the Keeper Vault.
Perform approvals for SSO Cloud device registrations and Just-In-Time (JIT) privilege elevation requests from Keeper Endpoint Privilege Manager without opening another application.
Centralising requests and approvals within Microsoft Teams helps decisions happen much more quickly while reducing delays that can leave privileged access waiting unnecessarily.
Users and administrators can request, review and approve access without leaving Microsoft Teams, minimising workflow interruptions and improving operational efficiency.
Every approval is time-limited, policy-enforced and auditable. The once-common habit of pasting a credential into a message has no reason to exist anymore.
By integrating secure access workflows into Microsoft Teams, organisations encourage employees to follow approved access processes instead of relying on manual or insecure alternatives.
The Teams workflow requires either a Keeper Secrets Manager or KeeperPAM® license. The streamlined deployment uses Keeper Secrets Manager to securely store and retrieve the service configuration. If Keeper Secrets Manager is not enabled for your organisation, your Keeper account manager can help activate it. KeeperPAM includes Keeper Secrets Manager, so organisations already on KeeperPAM do not need a separate license.
Requests are sent in a one-on-one conversation with the Keeper bot. Commands sent in Microsoft Teams channels or group chats are not processed, keeping each request private and intentional.
Approvals appear in a private Microsoft Teams approvals channel that you designate during deployment. Only the administrators and approvers assigned to that channel can review and respond to requests.
Users can request access to Keeper records, shared folders, One-Time Shares and brand-new login records directly from Microsoft Teams. Administrators can also approve SSO Cloud device registrations and Endpoint Privilege Manager elevation requests.
You must accept cookies to use Live Chat.
