Account Credentials Governance

Shirley Ho

Hi, is there a way for System Admin to have full control of the account credentials within our organizations? At the moment, each user has the ability to change their own password under the personal settings although we have assigned them credentials. Is there a way that we can remove this option on their account to provide the Admins more governance?

Yulichka

Per AI,

In Smartsheet, you cannot directly disable or hide the "Change Password" button inside an individual user's personal settings if they are logging in using a traditional email and password.

However, you can achieve the exact account governance and full administrative control you are looking for by changing your Authentication Settings in the Admin Center.

To remove the password vulnerability entirely and give your System Admins total governance, you need to transition your organization away from basic "Email + Password" logins.

The Solution: Implement Single Sign-On (SSO) or Domain Strictness

When you shift authentication control away from Smartsheet and over to your organization's Identity Provider (like Microsoft Entra ID/Azure, Okta, or Google Workspace), users will no longer have a Smartsheet password to change. Their access is governed entirely by your internal IT systems.

Option 1: Enforce Single Sign-On (SSO) & Turn Off Passwords

This is the cleanest approach for full enterprise governance. By activating an external identity provider, your IT team manages all credentials centrally.

1. Open the Admin Center (https://admin.smartsheet.com).
2. Click the Menu icon in the upper-left corner and navigate to Settings > Authentication.
3. Configure your provider (e.g., SAML, Microsoft Azure AD, or Google).
4. Under your Plan-level settings, uncheck Email + Password.
5. (Optional but Recommended) Check the box for Keep Email + Password for Sys Admins (fallback) so you can still log in to troubleshoot if your network identity provider ever goes down.

Option 2: Use Domain Strictness

If you have an Enterprise plan and manage specific email domains (e.g., @yourcompany.com), you can enforce Domain Strict login.

• This locks down the specified domains so that users must use the single organizational login method you dictated on the Authentication page.
• Once configured, even if a user attempts to change or reset a basic Smartsheet password, they won't be permitted to use it to bypass your company's secure login method.

A Note on Smartsheet's Security Direction

It is worth noting that Smartsheet is actively deprecating traditional password-based logins across the platform in favor of email-based Time-Based One-Time Passwords (TOTP) and strict corporate SSO identity management. Moving toward an SSO setup now aligns your organization with Smartsheet’s long-term security roadmap and stops users from managing isolated, native account passwords.

To learn more about setting up these user management protections and securing access roles inside the platform, you can check out this Smartsheet Data Security Tutorial, which highlights baseline principles for keeping project environments compliant and securely managed