By David,
If you run an MSP, IT Glue probably needs no introduction. It's been the default answer to "where do we keep the documentation?" for the better part of a decade - mature, deeply integrated with the PSA and RMM tools MSPs already run, and owned by Kaseya. Plenty of very good MSPs live in it every day.
So this isn't a hit piece. It's a specific, feature-by-feature look at how IT Glue and Atlas Vault - the credentials and IT documentation store built into Atlas AVD - approach the same job, and what changes when your documentation lives inside the platform that already runs your clients' environments.
The short version: IT Glue is a standalone documentation platform: hosted in Kaseya's cloud, billed per user, and one more login alongside the tools your team already runs. Atlas Vault is documentation that lives inside the platform you already use to run your clients' Azure environments - deployed in your own Azure tenant, included on every paid Atlas AVD plan from Starter up with unlimited technician seats, and linked directly to the host pools, VMs, scripts and Azure resources it describes. If your practice runs on Azure and AVD and you're tired of paying for another tool and another login, Atlas Vault is built for you.
At a glance
| Atlas Vault | IT Glue | |
|---|---|---|
| Per-technician fee | None - unlimited technician seats | Billed per user, per month |
| Adding a technician | Costs nothing extra | Adds another user licence |
| Minimum users | None | Minimum user count applies |
| How you pay for it | Included on every paid Atlas AVD plan, from Starter up | A separate documentation subscription |
| Where your data lives | Your own Azure tenant | Kaseya's cloud |
| Who holds the encryption keys | You, in your own Azure Key Vault | IT Glue |
| Password reveals audited | Every one, recorded before the password is shown | Yes |
| Links docs to host pools, VMs and scripts | Yes | No - documentation only |
No per-seat fee for technicians. Whether you hire your fifth engineer or your fiftieth, your Atlas Vault cost doesn't change. With IT Glue, every technician who needs access is another monthly licence.
The full feature-by-feature comparison is further down, in "The side-by-side".
Where your documentation lives
This is the difference everything else follows from.
IT Glue is SaaS in Kaseya's cloud. Per IT Glue's own documentation, the service runs in AWS data centres in North America, Europe (Frankfurt with an Ireland failover) and Sydney. It's SOC 2 Type II compliant and encrypts passwords with AES-256. That's a well-run multi-tenant service - but it is a third party's multi-tenant service, holding the keys to every client you manage.
Atlas Vault lives in your own Azure tenant. Atlas AVD deploys as a single-tenant instance into your Azure subscription, and every managed tenant gets its own PostgreSQL database with its own scoped database role. Vault data sits in that per-tenant database, not in a shared pool alongside other MSPs' data. Secrets are encrypted with AES-256-GCM before they're stored, using a key derived from a deployment key kept in your own Azure Key Vault. You can also have each secret's data key wrapped by an RSA key in Azure Key Vault (RSA-OAEP-256) - and if that Key Vault is unreachable, Atlas fails closed rather than quietly downgrading.
For an MSP, that changes the conversation with security-minded clients. "Our documentation platform is a SaaS vendor we trust" is a fine answer. "Our documentation lives in our own Azure tenant, encrypted with our own keys" is a shorter one.
If you're still deciding where client credentials should live at all, Where should an MSP store client credentials? compares password managers, documentation platforms, PAM tools and a vault in your own tenant.
Documentation: the same building blocks
If you've built out an IT Glue instance, Atlas Vault will feel familiar. (If you're still deciding what to record for each client, start with MSP documentation best practices.) Both are organised around client companies, and both cover the same core registers:
- Companies, contacts and locations - one record per client, with the people and sites that belong to it.
- Configurations and custom assets - IT Glue calls them Flexible Assets; Atlas Vault calls them asset layouts. Either way you design your own asset types with typed fields, including encrypted password fields and file attachments.
- Documents - Atlas Vault documents are written in Markdown, with full version history and one-click restore, plus reusable document templates.
- Processes - step-by-step checklists (runbooks and SOPs) with tracked runs, so you can see who ran an onboarding checklist, for which client, and where they got to.
- Networks and IP addresses, network shares, websites and domains, SSL certificates, licenses and rack diagrams.
Two things in Atlas Vault are worth calling out because they come from sitting inside an Azure platform. Azure virtual networks import straight into Networks, so you don't retype address spaces the platform already knows. And Microsoft 365 licenses can be added to Vault's license register straight from Atlas's licensing view.
Relationships that point at real infrastructure
IT Glue's relationship mapping is one of its strengths: link a configuration to a password to a document and you can see a client's environment as a graph.
Atlas Vault goes a step further in one specific direction. Its relationships are typed - "documents", "authenticates", "depends on", "hosts", "owns" - rather than a generic "related item" - and they can point at things Atlas actually manages: host pools, virtual machines, scripts and Azure resources, alongside credentials, documents, assets, contacts and websites. You add links from a document's Related items panel, so the runbook for a client's AVD environment can be linked to the host pool it documents, the VMs it covers and the service account it uses. Links to Atlas-managed resources even survive a redeploy: if a VM disappears and comes back under the same name, the documentation link is kept rather than silently dropped. Your documentation and your infrastructure stop being two separate systems that drift apart.
Credentials: where the detail matters
Both products store passwords, share them securely, and handle TOTP. The differences are in the details.
Every reveal is audited - and the audit can't be skipped. In Atlas Vault, revealing a password writes the audit record before the secret is decrypted. Copying a password or a TOTP code refuses to run at all if the audit write fails. And the audit log is append-only, protected by a tamper trigger at the database level. When a client asks "who has looked at our domain admin password this year?", the answer is complete.
Password history with rollback. Every change to a credential keeps the previous version, and you can roll back to one.
TOTP codes stored alongside the credential, with the seed encrypted like any other secret.
Rotation, including real Entra app-secret rotation. IT Glue offers automated password rotation through its Network Glue add-on. Atlas Vault rotates credentials manually on demand and, for credentials linked to Microsoft Entra app registrations, rotates the app secret through Microsoft Graph on a schedule - no add-on required.
Secure share links. Both products let you share a credential without pasting it into email or chat. IT Glue's is Password SafeShare. Atlas Vault's share links always carry an expiry (one hour to 30 days), can be one-time and protected by a passphrase, can be revoked at any time, and work for documents as well as credentials. The link token is stored only as a hash.
Expiry alerts. Atlas Vault scans every day and emails you at 30 days, at 7 days and on the day a credential, SSL certificate or domain registration lapses. When you add a website, Detect looks up its domain registration and TLS certificate, so the expiry dates start out right. The dates don't update on their own; refresh a site to look them up again.
Bring your passwords with you. Atlas Vault imports credentials from CSV exports of KeePass, 1Password, Bitwarden and LastPass, from Azure Key Vault JSON, or from generic CSV and JSON.
Keeping asset data current
Atlas Vault assets are documented by your technicians, using asset layouts you define, so each record holds the fields your team actually needs. Syncing assets into Vault from RMM tools isn't available in the app yet; IT Glue is ahead here today. Atlas AVD's RMM integrations do already show each tool's device inventory, from NinjaOne, Datto RMM, N-able N-central, Level and others, next to your AVD infrastructure.
The side-by-side
| Atlas Vault (Atlas AVD) | IT Glue | |
|---|---|---|
| Where your data lives | Your own Azure tenant; a separate database per managed tenant | Kaseya's cloud (AWS, in US, EU or Australia regions) |
| Encryption keys | AES-256-GCM, keyed from your Azure Key Vault (optional RSA-OAEP-256 key wrapping) | Managed by IT Glue (AES-256) |
| How it's priced | Included on every paid Atlas AVD plan, from Starter up | Per user, per month |
| Technician seats | Unlimited on every plan | Billed per user, with a minimum user count |
| Companies, contacts, locations | Yes | Yes |
| Custom asset types | Asset layouts with typed fields | Flexible Assets |
| Documents | Markdown, with version history and restore | Rich-text editor |
| Runbooks / checklists | Processes with tracked runs | Checklists and runbooks |
| Relationships | Typed, linked from a document to host pools, VMs, scripts, Azure resources and other Vault items | Relationship mapping across IT Glue items |
| Password history and rollback | Yes | Tracks password changes |
| TOTP | Yes | Yes |
| Reveal auditing | Written before decryption; copy refuses without an audit record | Full audit visibility |
| Automated rotation | Entra app secrets via Microsoft Graph, on a schedule | Via the Network Glue add-on |
| Secure sharing | Expiring, one-time, passphrase-protected links | Password SafeShare |
| SSL / domain expiry alerts | Daily scans with 30-day, 7-day and lapse emails; registration and certificate looked up on demand with Detect | Domain and SSL trackers |
| RMM and PSA integrations | RMM device inventory shown next to your AVD infrastructure; asset sync into Vault not yet available | Integrations with PSA and RMM tools |
| Also manages your AVD, endpoints and M365 | Yes - it's one platform | No - documentation only |
Why Azure-focused MSPs choose Atlas Vault
Atlas Vault is built for the MSP whose practice runs on Azure - and who is tired of switching tools.
When your technicians already live in Atlas AVD to manage host pools, cost, endpoints, Microsoft 365 and remote support with Atlas Reach, keeping documentation in the same console removes a login, a browser tab and a bill. The runbook for a host pool is linked to the host pool, and the credentials, contacts and documents for a client sit in the same place your team already works.
And the commercial model is simple. Atlas Vault is included on every paid Atlas AVD plan, from Starter through Enterprise and the MSP plans, all of which are flat-rate with unlimited technician seats. Hiring your next engineer doesn't add a documentation licence.
How to think about the decision
Ask three questions:
- How many tools and logins does your team juggle today? Every separate platform is another bill, another credential store to secure, and another place documentation drifts away from the infrastructure it describes. Atlas Vault removes one of them.
- Does it matter where your clients' credentials physically live, and who holds the keys? If your clients (or your own security posture) want documentation in your own tenant, encrypted with your own keys, that's Atlas Vault's architecture.
- How much of your practice runs on Azure and AVD? The more it does, the more valuable it is to have documentation, credentials and infrastructure in one platform - and to stop paying per technician for the privilege.
The verdict: if you're an MSP who wants documentation that lives in your own tenant, encrypted with your own keys, linked to the infrastructure it describes, and included with the platform you already run - with no per-technician fee - that's exactly what Atlas Vault is.
Feature and pricing details for IT Glue are drawn from IT Glue's and Kaseya's public materials as of September 2026 and summarised in good faith; IT Glue publishes its per-user pricing on its website. Confirm current features and pricing with IT Glue directly.