Approve the Bitwarden app instance, not just the computer name

The browser extension and desktop application on one computer are separate trusted devices.

Source facts

Bitwarden SSO with trusted devices separates SSO authentication from vault decryption using a device-stored key. A trusted device means an approved Bitwarden application instance, such as a browser extension or mobile app. Each app requires its own approval even when several apps run on one computer or phone. An untrusted app must obtain approval through an available method before it can decrypt the vault. The documentation describes approval from another device, administrator approval, or an existing master password where the account has one.

Source: Bitwarden — Trusted devices.

Applicability

This applies to organizations using Bitwarden SSO with trusted devices. It is different from a computer’s inventory status, browser profile management, or an identity provider’s own trusted-device flag.

DSE recommendation

DSE recommends recording which app and browser profile a user is trying to approve. A request from a newly installed extension should not be dismissed simply because the same computer’s desktop app already works. Confirm the requester and the intended app instance using the approved identity process before accepting a request. Document available recovery methods for users without an established trusted app. Include browser-profile replacement, app reinstallations, and device retirement in user guidance so approval requests have an understandable operational context.

Verification

Use a controlled account to sign in through two separate Bitwarden apps on one test device. Confirm that approval of the first does not silently establish trust for the second. Review the approval method and verify that an unapproved app cannot decrypt the vault merely because SSO authentication succeeded.

Official reference

Bitwarden — Trusted devices. Reviewed October 15, 2026.