When I was at Microsoft (DevDiv) we used AD, Forefront Identity Manager and an internal webapp called RAMweb to request to join controlled groups. Them being M

When I was at Microsoft (DevDiv) we used AD, Forefront Identity Manager and an internal webapp called RAMweb to request to join controlled groups. Them being Microsoft everything was in-house, though I did work on a team that did use some external resources - we traded passwords on an ad-hoc basis - "trusted" SharePoint pages or shared OneNote documents mostly - but this was never anything sensitive - think: accounts for sites like HackerRank or Lynda. All of the startups I've been at use LastPass Enterprise, it works well.