The policy "Length of site passwords" should permit admins the ability to set the password generator minimum password length for all sites if they choose, in addition to the current functionality of allowing admins to specify this on a per-site basis. ... View more

The policy "Restrict login attempts before lockout" should allow values between 2 - 30 (inclusive). Currently, it only allows values between 3 - 8 (inclusive).   Our corporate policy specifies a number of consecutive failed authentication attempts permitted before lockout to a value outside of the 3 - 8 range. The current range is unnecessarily narrow and does not allow for proper adherence to corporate policy. ... View more

For LastPass business accounts where users are permitted to link personal accounts, it should be possible to define a policy with a list of domains that are not permitted to be stored in the personal account and can only be stored in the business account.   Basically, suppose our company uses both example.com and contoso.com as valid email domain/user domain aliases. I would like to define a LastPass policy that does not permit organizational users with linked personal accounts to store an item with username user1@example.com or user2@contoso.com to their linked personal account.   I see that there is already a policy that does something similar to this but has other behavior I don't want to enforce. The policy "Set default account for new sites" does allow administrators to define a list of domains that should be stored in the enterprise account; however, it also forces all other domains to be stored in the personal account. I want to do the opposite, essentially: force all domains listed to be in the enterprise account, but permit other domains not listed to be stored in either account (but not interfering with the functionality from the "Save personal sites to personal vault" policy, if enabled). ... View more

In our organization we provision our users through Azure AD, and thus the Azure group the users are provisioned from is available in LastPass. This means that anyone enrolled in LastPass has the ability to share their passwords, shared folders etc, with everyone in our LastPass enterprise.   What i would like to see is an admin policy that allows us to prohibit sharing to specific groups and users, so that we can filter out the primary Azure groups used for provisioning, but still allow other groups to be shared with and used. ... View more

Now that you have enabled Voice and SMS, it would be prudent to have a policy to disable these options for MFA for customers that mandate the more secure authentication app option.In short you have introduced a security vulerability ... View more