100% adoption. Guaranteed. Because there's nothing to adopt.
My1Login is the enterprise password manager IT deploys silently. Employees never register, log in or open it, so every credential is secured from day one.
- How the guarantee works
- Works alongside the directory and identity tools you already have
Animation: My1Login fills in an app's sign-in form by itself (the username, the password and, where needed, a one-time code), then signs the user in. The user never sees or types the password.
10 million+ logins secured every year · 20,000+ apps ready to connect · Since 2007
Most password managers only work if every employee decides to use them.
They ask people to install an extension, invent a master password and change how they log in. Many never do, and theirs are the accounts that get phished.
My1Login takes that decision away from the user. IT switches it on through your directory and it runs in the background, so everyone is protected.
How it works
Because nobody has to opt in, the people who would never have signed up are protected along with everyone else.
Which apps are covered is up to you: IT can choose them for everyone, let people add their own, or do both.
A usual password manager rollout
- Week 1
Announce it by email - Week 2
Everyone registers - Week 2–3
Run training sessions - Week 4–8
Chase anyone not signed up - Ongoing
Reset forgotten passwords
With My1Login
Day 1
IT switches it on in the directory.
Everyone is covered.
Nothing for your workforce to register or learn.
The password manager your workforce won't even know they're using.
Nobody has to install anything, sign up or remember to use it, so every account in your directory is covered from the day IT switches it on.
How the guarantee works
That's why we can guarantee adoption: there's no rollout to fail, and the people who would never have signed up are covered too.
It's built to roll out across an entire organisation at once, from one office to thousands of users worldwide. Mainspring rolled it out to more than 10,000 users. Read their story
The guarantee applies where the zero-login configuration has been deployed and provisioned users have signed in to your corporate directory, such as Microsoft Entra ID or Active Directory, during the contract term.
See what changes for your workforce in under a minute.
Follow Sarah through a normal morning. She signs in to Windows, then opens Xero, Government Gateway and an old Sage desktop app without typing a single password. Meanwhile, IT sees every policy applied and every login recorded.
Read the transcript
The average employee juggles dozens of corporate passwords. Attackers only need one.
My1Login links every application to the one directory login your workforce already use. There's no My1Login sign-in, and nothing new to learn.
Web apps, one-time passwords, even legacy systems: My1Login handles them all. Your users see no new screens. Your IT team sees everything.
No passwords to phish. No resets to chase. No apps hiding in the shadows.
My1Login. Enterprise Security with Workforce Convenience. Book your 5-minute demo today.
- SAML & OIDC Modern cloud apps
- Web apps Username + password
- One-time codes Generated and filled in
- Windows desktop Including legacy
- Virtualised Hosted apps
- Bespoke apps No APIs needed
It covers the apps your SSO can't reach.
Single sign-on usually stops at apps that support SAML. The finance package from 2009, the supplier portal that asks for a one-time code and the shared login in a spreadsheet all fall outside it. My1Login signs people in to SAML and OpenID Connect apps too, and brings the rest under the same policy as everything else.
- A log of every access. See who opened which system and when, across the whole organisation.
- Passwords your workforce never sees. Hide credentials and fill them automatically, so there's nothing to hand over to a phishing email and no password for an attacker to hijack an account with.
- Shared accounts without shared passwords. Give a team or partner a login they can use but not see, and every use is logged.
- Policies on apps you don't control. Strong passwords are generated and rotated on third-party systems too.
- The apps nobody told IT about. My1Login spots sign-ins to unknown apps, so shadow IT comes under the same policy as everything else.
Entra ID
Active Directory
Google Workspace
CitrixWhat customers found when they switched it on.
"My1Login has helped us identify around 600 business applications in-use and 100% of these are now integrated with My1Login's IAM solution…"
Callum McLean, Head of Innovation & Data, Natural PowerRead the Natural Power story
"One of the easiest technology implementations we've ever had to do."
Neil Clark, Chief Operating Officer, Mainspring, LondonRead the Mainspring story
"It's improving patient outcomes because we're getting more clinical capacity to patients that need to be seen."
Liam Mahon, Director of Digital & Innovation, London Central & West (NHS 111)Watch Liam on video
Where it fits next to the tools you know.
Many organisations run cloud SSO for modern apps and a separate password manager for everything else. My1Login does both jobs.
| Cloud SSO platforms | Opt-in password managers | My1Login | |
|---|---|---|---|
| Who is protected | Everyone, on SSO-enabled apps only | People who sign up | Everyone, from day one |
| Windows desktop and legacy apps | Usually not covered | Often not covered | Covered |
| One-time codes | Typed by the user | Some support | Generated and filled in |
| Audit coverage | SSO apps only | Enrolled users only | Every access |
| Who can read stored passwords | Usually doesn't store app passwords | Each user, with their master password | Nobody outside your network, including us |
Compares types of tool, not named vendors. See the full comparison
The detail your security team will ask for.
Zero-knowledge encryption keeps the keys inside your own network, so nobody outside it can read your stored passwords, including us. There's nothing to host. Our SLA commits to 99.9% availability, and in practice the service typically runs at 100%. We've been doing this since 2007, for organisations worldwide.
Recognition
- SC Awards Europe 2025, winnerBest Identity and Access Management Solution
- KuppingerCole Leadership CompassPrivileged Access Management
- FeaturedCustomers 4.8 / 5Top Performer for customer success
- Gartner Peer Insights 5 / 5Rated 5 out of 5 in a verified customer review
Certifications
- Cyber Essentials PlusCertified
- Penetration tested, rated A+By CREST-approved testers, and rated suitable for use in defence
- ISO 27001-certified hostingOur data centres hold ISO 27001
- G-CloudSupplier, G-Cloud 8 to 13
Where your data lives
- UK data centre optionOther regions: please contact us to discuss
- Zero-knowledge encryptionNobody outside your organisation can read stored passwords
- GDPREncryption, access controls and a full audit trail support your GDPR obligations
Buying
- Direct or through a partner
- Partner Network
- Priced in pounds, euros and US dollars
- Web portalOperational
- Browser extensionOperational
- Windows desktop agentOperational
- Directory syncOperational
Specialist support, around the clock.
Our Customer Success team connects your directory, rolls My1Login out at the pace that suits you and trains your administrators. After that, our support team is there 24x7x365.
Visit the support site for help articles, service status and to raise a ticket.
- Support hours
- 24x7x365
- Service levels
- 99.9% availability, with a response within 1 hour
- Getting started
- Connect your directory and deploy within 24 hours
Questions we get asked first
Do employees really not need to do anything?
Yes. IT deploys My1Login centrally and it uses your existing directory login. People carry on opening their apps as they always have.
Who decides which apps are covered?
You do. IT can choose the apps that are covered for everyone, let people add their own apps and logins, or combine the two. For example, IT can set up the core business apps while people add the other work apps they use.
What does the adoption guarantee cover?
Adoption is guaranteed wherever the zero-login configuration has been deployed. Every provisioned user who signs in to your corporate directory, such as Microsoft Entra ID or Active Directory, during the contract term counts as adopted. Signing in to the directory signs them in to My1Login automatically, so your workforce doesn't have to enrol in or open My1Login.
Does it replace our identity provider?
No. My1Login works alongside Microsoft Entra ID. Entra ID remains your directory: people sign in to it as normal and Zero Login signs them in to My1Login. My1Login then extends single sign-on to the apps Entra ID can't reach, such as password-only web apps, apps that ask for one-time codes and Windows desktop apps. It can also handle your SAML and OpenID Connect apps itself, so every app can sit under one set of policies and one audit trail.
Can My1Login see our passwords?
No. With zero-knowledge encryption the keys stay inside your organisation's network, so only your organisation can read your stored passwords.
Does it work with older desktop software?
Yes. Windows desktop apps, including legacy and virtualised ones, are covered alongside web and cloud apps with single sign-on for desktop, an add-on to single sign-on for web. See single sign-on for desktop
Where is our data hosted?
In ISO 27001-certified data centres, with a UK hosting option for organisations that need their data kept in the UK. Stored sign-in details are encrypted client-side, so nobody outside your organisation can read them, including My1Login. For other regions, please contact us to discuss. See the trust centre
How long does it take to deploy?
Initial users can be up and running in 30 minutes, with full enterprise roll-out within 24 hours, at whatever pace suits your plan.
Bring your most awkward app to a 5-minute demo.
We'll show you what IT controls, and what your workforce will notice, which is nothing.
- 5 minutes, on your own apps
- A specialist replies within one working day
- No obligation