With Cerby, you have a secure and efficient way to import items from your current password manager.
The Password Manager Importer feature helps you transfer to Cerby your corporate passwords, folders, secure notes, attachments, and user access permissions at the same time. After the import, you can start managing and protecting your accounts and secrets through Cerby.
Currently, Cerby only supports imports from LastPass.
This article describes how to use the Password Manager Importer feature.
Capabilities and import rules
The Password Manager Importer works by syncing your LastPass folders, subfolders, and items. Then, you can select which folders and subfolders to import, and all of the items inside such folders are transferred as follows:
Folders and subfolders become individual collections and subcollections with the same items and shared user permissions.
Passwords become individual accounts or accounts inside a collection or subcollection.
Secure notes and their attachments become individual secrets or secrets inside a collection or subcollection.
The following items become the corresponding secret items in Cerby:
WiFi
Database
SSH keys
Server
Software license
Custom item
Groups become teams with only one member: the user who performs the import. For instructions on how to add the missing team members, read the Add the missing team members section.
Due to LastPass constraints, the following import rules have been established:
Only users with a LastPass account and Administrator permissions on shared folders can transfer items via the Password Manager Importer. You cannot import shared folders if you have the Read Only or Hide Passwords permissions.
All the imported collections, accounts, and secrets are automatically onboarded to Cerby. In the import report, you can see if these items have any details missing and enter such details.
Items are imported to the default vault. For Cerby Protect users, Workspace Admins must ensure to have created and set up a default local vault.
Private and shared folders have different import rules:
To prevent duplicate shared items, you can only import shared folders one time. In subsequent import attempts, you cannot select them.
Private folders can be imported multiple times to Cerby, and existing items get duplicated.
Empty folders and subfolders are not imported to Cerby.
The following rules are applied to duplicate items:
Accounts are identified as duplicates in the import report when an existing account in Cerby has the same username and login URL or domain as an imported account.
All secrets are imported to Cerby, and they are not identified as duplicates.
All selected folders and groups are imported; duplicates are identified with a number at the end of their name.
User access permissions for folders, sub-folders, passwords, and secure notes propagate to the corresponding Cerby collections, subcollections, accounts, and secrets as follows:
Permissions on folders propagate to collections and the nested subcollections in Cerby. Therefore, access to accounts and secrets inside a collection and nested subcollections is granted at the parent collection level.
Users with access to a LastPass folder but no role assigned are granted with the Collaborator role on the Cerby collection. Additionally, if a user is invited to a folder, password, or secure note in LastPass but hasn't accepted the invite, they are not granted permissions in Cerby.
Individual permissions on passwords and secure notes propagate to Cerby accounts and secrets.
The unavailability access rules that you set in LastPass for specific recipients are applied to the imported items. In addition to the collection that Cerby creates for you as the collection Owner, new collections and sub-collections are created for specific users who have different availability rules for items and subfolders.
Permissions on LastPass items shared with external collaborators are not imported to Cerby if such collaborators have not accepted the item share.
Users are identified as unmatched because they use an email address that couldn’t be identified or they are not in the corporate directory, and they need a manual invite to join Cerby. For instructions on how to invite users, read the Invite unmatched users to Cerby section.
IMPORTANT: LastPass access permissions are granted automatically to users with a matching Cerby account that’s active, whether provisioned by an identity provider or via a guest user invite. After the import, Cerby gives you the option to invite users who do not have a matching Cerby account.
Table 1 shows how user access permissions for LastPass Business folders transition to Cerby roles on collections.
LastPass access permissions | Cerby role |
Read Only | Collaborator |
Administrator | Owner |
Hide Passwords | Collaborator |
Table 1. Corresponding access permissions in LastPass and Cerby
Cerby cannot import the following permissions because LastPass doesn’t have the corresponding features implemented:
Account-level permissions for teams
Secret-level permissions for teams
Requirements
The following are the requirements to use the Password Manager Importer:
A workspace in Cerby
A Cerby account
An active LastPass business account with Administrator access permissions on the shared folders to import
IMPORTANT: Due to LastPass requirements, ensure that your master password is at least 12 characters long.One or multiple private and shared folders with accounts, secure notes, and attachments
Import items to Cerby
To import items to Cerby, you must complete the following main steps:
The following sections describe each main step.
1. Sync items with your password manager
To sync the items with your password manager, you must complete the following steps:
Log in to your corresponding Cerby workspace.
Click the Add item button from the All accounts view. A drop-down list is displayed.
Select the Import from password manager option. The Import from your password manager dialog box is displayed.
Click the Get started button. A wizard is displayed with the Enter your login credentials page, as shown in Figure 1.
Figure 1. Enter your login credentials page
Enter the information in the corresponding fields:
Password manager
Select your password manager from the drop-down list.
IMPORTANT: Currently, Cerby only supports LastPass.
Email
Enter the email address you use to log in to LastPass.
Password
Enter the master password you use to log in to LastPass.
Configured LastPass multi-factor (MFA) option
Select from the drop-down list the multi-factor authentication (MFA) option you have configured in LastPass.
IMPORTANT: Go to Account Settings in LastPass to identify the MFA option. If multiple options are enabled, select the one with the highest precedence as follows:
Default MFA option
Yubikey
Authenticator app
Open the authenticator app to retrieve the verification code.
Enter the verification code.
NOTE: Leave the verification code field blank under the following three scenarios:
The MFA option is not configured
The push notification MFA is available with the LastPass Authenticator app on your mobile phone
The Yubikey is set up as tap-and-go
For the second and third scenarios, complete the verification challenge in your authenticator app or tap the Yubikey when prompted.
Click the Next button. The Verify Cerby’s location page is displayed.
IMPORTANT: Your password manager may send an email indicating that the login attempt was blocked, particularly the first time you import items through Cerby. If you didn’t receive an email, continue to step 8.
Verify Cerby’s location by performing the following actions:
Open the inbox of the email address registered in your password manager.
Open the email that your password manager sent you. The subject indicates that the login attempt was blocked, and the email body displays a location unrecognized by your password manager.
Click the verification link or button in the email to verify the login attempt.
IMPORTANT: The login attempts from Cerby only come from Ohio (OH) or Oregon (OR), in the United States. For more information on this security verification, read the Why verify the login attempt section.
Select the I have already verified Cerby's location or did not receive an email option. The Next button is enabled.
Click the Next button. The Syncing items page is displayed. When the sync is complete, the Select folders to import button is displayed.
NOTE: The Confirm import to Cerby dialog box may be displayed before the Syncing items page if the verification code entered in step 4 expires. Perform the following actions to continue:
Enter the new verification code in the 2FA verification code field.
Click the Confirm button. Now, the Syncing items page is displayed.
Click the Select folders to import button. The Select folders to import page is displayed, as shown in Figure 2.
Figure 2. Select folders to import page
The next step is 2. Import folders and items to Cerby, which you must complete from the Select folders to import page.
2. Import folders and items to Cerby
To import the synced folders and items to Cerby, you must complete the following steps from the Select folders to import page:
IMPORTANT: While the Select folders to import page displays all folders and their subfolders, Cerby currently doesn't automatically import nested folders. To ensure a complete import, please select both the main folders and the subfolders that you want to import.
Click the Add icon on the Discovered folders section that corresponds to the folder you want to import. The folder is added to a list in the Selected folders section.
Repeat step 1 as necessary.
TIP: Click the Add icon of the Select all folders option to select all of the synced folders. You can also use the search boxes in the Discovered folders and Selected folders sections to look for folders by name.
Click the Next button. The Confirm import to Cerby dialog box is displayed.
Enter a new verification code in the 2FA verification code field.
IMPORTANT: You must enter a valid and unused verification code. If push notification MFA is available for your account, enter 000000 as the verification code and continue to step 5; complete the verification challenge when prompted.
Click the Confirm button. The dialog box closes, and the Import Report view is displayed with the “We’re importing your items from your password manager to Cerby” message.
The process may take a few minutes depending on the number of folders and items to import. When the import is complete, a success message box is displayed, and an email is sent.
The next step is 3. Review the import report, which you must complete from the Import Report view.
3. Review the import report
The Password Manager Importer transfers to Cerby all the passwords and secure notes that are saved inside private and shared LastPass folders.
Each password becomes an individual account in Cerby and is automatically added to a collection or subcollection that corresponds to the native folder or subfolder, with the same name. Secure notes and their file attachments become secrets in Cerby, and they are also automatically added to a collection or subcollection.
After an import, all of the transferred items are displayed on the Import report view, as shown in Figure 3.
Figure 3. Import report view of the Cerby web app dashboard
The Import report view contains the following sections:
Collections: It displays the number of LastPass folders imported as collections to Cerby. Collections are onboarded when all of their accounts and secrets are also onboarded to Cerby.
Accounts and Secrets: It displays the number of items imported to Cerby. All accounts and secrets are onboarded to Cerby, even if they are duplicates or have details missing.
Users: It displays the number of users whose Cerby accounts were matched or unmatched to LastPass access permissions. You can download a CSV file with a table of unmatched users by clicking the Download unmatched users report button.
Imported items: It displays a table with the imported items in the following four tabs:
Pending review: It displays the items with import issues.
Onboarded items: It displays the items onboarded to Cerby.
Unmatched users: It displays the users who were not automatically matched and the items to which they still have access in LastPass.
Matched users: It displays the users matched to their Cerby account and the items to which they have access through Cerby.
You can download a full import report in a CSV file by clicking the Download latest report button located at the top right of the Import report view. This report contains a table with all the imported items (collections, sub-collections, accounts, and secrets) and permissions to help you verify that your items were successfully transferred from LastPass.
If you see items with a skipped or fail status, the report provides information about why Cerby did not import them, and you can take action to solve the issues.
For more information about this report, read the section How to interpret the downloadable import report.
The next step is 4. Take action on onboarded items, which you must complete from the Import report view.
4. Take action on onboarded items
The following are the actions you can take on onboarded items:
The following sections describe each action.
Add missing account details
Due to LastPass rules, passwords can be saved with information only in the Name field. Therefore, when imported to Cerby, these accounts are displayed with the “Missing detail” or “Missing app name” status in the Onboarded items tab of the Import report view.
Cerby recommends adding the missing account details because this is the information the Cerby browser extension uses to log you in automatically to your accounts.
To add the missing account details, you must complete the following steps:
Click the Take action button of the corresponding account. A drop-down list is displayed.
Select the Account settings option from the list. The account details page is displayed with the Settings tab activated.
Click the Edit icon of the corresponding field to make it editable.
Enter the information in the field.
Click the Done icon to save the changes.
Repeat steps 3 to 5 as necessary.
Request access to an account
When you import an account that already exists in Cerby but another user has the Account Owner role on it, you can send them an access request.
To request access to an existing account, you must complete the following steps from the Import report view:
Click the Take action button of the corresponding account. A drop-down list is displayed.
NOTE: If you only have one action to perform, the Take action button is not displayed; instead, the specific action is displayed in the button. Click the Request access button and continue in step 3.
Select the Request access option from the list. The Request access dialog box is displayed.
Enter a message to request access to the account in the Message field.
Click the Request access button. The dialog box closes, and a success message box is displayed.
You must wait until the Account Owner shares access with you.
Edit collection name
After importing a collection to Cerby, you can change its name from the Import report view. This name is displayed on the secret cards of the dashboard that helps you and other users easily identify it.
To edit the collection name, you must complete the following steps from the Import report view:
Click the Take action button of the corresponding account. A drop-down list is displayed.
Select the Edit collection name option. The Edit collection name dialog box is displayed.
Enter a new name in the Collection name field.
Click the Save button. The dialog box closes, and a success message box is displayed.
Edit account label
After importing an account to Cerby, you can change its label from the Import report view. The account label is the name displayed on the account cards of the dashboard that helps you and other users easily identify it.
To edit the account label, you must complete the following steps from the Import report view:
Click the Take action button of the corresponding account. A drop-down list is displayed.
Select the Edit account label option. The Edit account label dialog box is displayed.
Enter a new label in the Account name field.
Click the Save button. The dialog box closes, and a success message box is displayed.
Edit secret title
After importing a secret to Cerby, you can change its title from the Import report view. The title is the name displayed on the secret cards of the dashboard that helps you and other users easily identify it.
To edit the secret title, you must complete the following steps from the Import report view:
Click the Take action button of the corresponding account. A drop-down list is displayed.
Select the Edit secret title option. The Edit secret title dialog box is displayed.
Enter a new title in the Secret name field.
Click the Save button. The dialog box closes, and a success message box is displayed.
Share access to a collection
After importing a collection to Cerby, you can share access right away from the Import report view. To do so, you must complete the following steps:
Click the Take action button of the corresponding account. A drop-down list is displayed.
Select the Share access option. The Share secret dialog box is displayed.
Enter the name of the user or team in the search bar. The users or teams that match the name are displayed on a list below the search bar.
Select the corresponding user or team from the list. The user or team is displayed in the Members and Teams section.
Repeat steps 3 and 4 as necessary to select multiple users or teams.
Select the corresponding Cerby role from the Role drop-down list:
Owner: They can share access, edit, and manage the collection, account, and secret settings.
Collaborator: They can only view the collection, account, and secret details, and log in to accounts.
Click the Share button. The dialog box closes, a success message box is displayed, and an email is sent to the user.
Share access to a secret
After importing a secret to Cerby, you can share access right away from the Import report view. To do so, you must complete the following steps:
Click the Take action button of the corresponding account. A drop-down list is displayed.
Select the Share access option. The Share secret dialog box is displayed.
Enter the name of the user or team in the search bar. The users or teams that match the name are displayed on a list below the search bar.
Select the corresponding user or team from the list. The user or team is displayed on the Members and Teams section.
Repeat steps 3 and 4 as necessary to select multiple users or teams.
Select the corresponding Cerby role from the Role drop-down list:
Owner: They can share access, edit, add attachments, and manage the secret settings.
Collaborator: They can only view the secret and download the attachments.
Click the Share button. The dialog box closes, a success message box is displayed, and an email is sent to the user.
View item settings
After importing a collection, account, or secret to Cerby, you can view their settings from the Import report view. To do so, you must complete the following steps:
Click the Take action button of the corresponding collection, account, or secret. A drop-down list is displayed.
Select the Collection settings, Account settings, or Secret settings option. The corresponding item details page is displayed with the Settings tab activated.
Invite unmatched users to Cerby
After an import from your password manager, unmatched users in the Import report view need a direct share or an invite to access the imported collections, accounts, or secrets. The invite process is different depending on the type of user:
Users with a Cerby account
Users who are part of your organization and have a Cerby account but are unmatched need a direct share of the imported collections, accounts, and secrets. Follow the corresponding instructions to share the items:
Collection
Watch the How to create and share a collection video.
Account
Watch the How to share access to accounts with teammates video.
Secret
Watch the How to add and share a secret video.
Guest users
External collaborators who are not part of your organization and don’t have a Cerby account are identified as unmatched. To grant them the imported access permissions, you can send them an invite to join your workspace as guest users.
Guest users have identities and authentication managed by Cerby. After receiving the invite and joining Cerby, they are visible through the All Members view and searchable through the item sharing dialog boxes. For more information about this feature, read the How to invite a guest user to your workspace article.
To invite a guest user as part of the import process, you must complete the following steps from the Import report view:
Activate the Unmatched users tab, as shown in Figure 4.
Figure 4. Unmatched users tab in the Import report view
Click the Invite as guest button of the corresponding user. The Invite guest user dialog box is displayed.
Click the Send invite button. The dialog box closes, a success message box is displayed, and the invite is sent to the guest user’s email.
The guest user must open the invite and set up their account to join your Cerby workspace. For instructions, read the Join Cerby from a guest user invite section of the How to invite a guest user to your workspace article.
When they join Cerby, the corresponding shared items are displayed in the All Accounts, Secrets, and Collections views.
Add the missing team members
Cerby offers the following two options to add the missing team members after using the Password Manager Importer:
Add team members manually (recommended for technical and non-technical users)
Import team members in bulk (recommended only for technical users)
The following sections describe each option.
Add team members manually
For instructions on how to add one or multiple team members manually, read the Add or remove members from teams manually section from the How to use Teams article.
Import team members in bulk
To import the missing team members in bulk from LastPass to their corresponding teams, you must complete the following main steps:
NOTE: Cerby recommends that IT admins or users with a technical profile perform these steps.
The following sections describe each main step.
1. Generate a CSV file
You can generate a CSV file on your own or use a script that we built to gather all of the information of your LastPass groups.
IMPORTANT: If you choose to generate the CSV file on your own, you must include the following columns in the table for a successful import:
user_idusernamegrouprole
To generate the CSV file with the script we provide, you must complete the following steps:
Ask the Cerby Customer Support team for the script.
Run the script locally on your computer with a Python interpreter. Two CSV files are generated: one with the list of groups and another with the table of team members.
2. Import team members with a CSV file
To import team members with a CSV file, you must complete the following steps from the Cerby dashboard:
Select the Teams option from the left navigation drawer. The Teams view is displayed.
Click the Add button located in the Your teams section. The Create team wizard is displayed with the Name your team page.
Click the Import team members from password manager button. A dialog box is displayed.
Click the Get started button. The Upload your file dialog box is displayed.
Drag and drop the CSV file with the table of team members that you generated previously. The file is added in the Upload your file section.
Click the Upload button. The Import in progress dialog box is displayed.
The process may take a few minutes depending on the number of team members to import.Click the Got it! Button. The dialog box closes.
When the import is complete, a success message box is displayed, an email is sent, and a report is generated.Review the report for accuracy and the status of the imported team members by performing the following actions:
Click the Export report button located at the top right of the Teams view. The report in CSV format is downloaded.
Open the report.
Why verify the login attempt
When Cerby syncs with your password manager to retrieve the information of your folders, passwords, secure notes, attachments, and user access permissions, your password manager may block or flag Cerby’s login attempt for security reasons.
This situation occurs particularly the first time you perform an import because the login attempt comes from a location unrecognized by your password manager. To verify this is a legitimate login attempt, your password manager sends an email with a verification link or button to the email address configured for the account.
You must verify Cerby’s location to continue with the import. For more information about the security of your password manager account, you can read the Why is my device not recognized when I log in to LastPass? official documentation from LastPass.
IMPORTANT: The login attempts from Cerby only come from Ohio (OH) or Oregon (OR), in the United States.
How to interpret the downloadable import report
When you download a full import report in CSV format after transferring your items to Cerby, you can verify if all of your individual items were successfully transferred from LastPass.
The table contains detailed information about the import status of every item and permission. If an item is identified with the skipped or failed status, the import report also describes why it was not imported so you can solve the issue and try again.
The following glossary describes the terms used in the table:
Item type: It is a column header indicating the type of imported item:account,secret,collection,subcollection, orpermission.Import status: It is a column header indicating the import status of an individual item:successful,skipped, orfailed.Status details: It is a column header indicating more information to interpret the import status.Item path: It is a column header indicating the item path within the folder structure in LastPass, such as the collection or subcollection name or hierarchical path. The identifier "+<username>" means the item had an unavailability access rule.Item name: It is a column header indicating the item name as it was saved in LastPass.Item username: It is a column header indicating the username associated with the imported account. For thepermissionitem type, it indicates the role assigned to an imported collection or subcollection.Item URL: It is a column header indicating the URL associated with the imported account.Username: It is a column header indicating the user’s associated username to whom a collection was assigned. It only applies to thepermissionitem type.Successful(import status): It is a status indicating the item was successfully imported from LastPass to Cerby.Skipped(import status): It is a status indicating the item was intentionally omitted from the import. For more details, see theStatus detailscolumn.Failed(import status): It is a status indicating Cerby attempted to import the item but encountered issues. For more details, see theStatus detailscolumn.Empty_collection(status details): It is a value indicating the collection was skipped during the import because the LastPass folder was empty.Successful(status details): It is a value indicating the item was imported without issues.Unknown_permission_error(status details): It is a value indicating the item import failed because of an unidentified error related to permissions, suggesting a potential issue with access rights.User_not_found(status details): It is a value indicating the item import failed because Cerby could not find its associated user account, possibly due to a nonexisting account or identification mismatch.
The import report displays two sets of statuses and values that help you determine a successful import for collections and subcollections.
When you see collection or subcollection as the item type in the corresponding column and the successful status and value, it means the LastPass folder or subfolder was imported to Cerby without any issues.
When you see permission as the item type in the corresponding column and the successful status and value, it means that the original user access permission was assigned to the corresponding imported collection or subcollection. You can obtain additional information from the following columns:
The
Item pathcolumn helps you identify the collection or subcollection name.The
Item namecolumn helps you identify the role (Owner or Collaborator) assigned to the imported collection or subcollection.The
Usernamecolumn helps you identify the user who received the access grant in Cerby to the collection or subcollection.