This is the kind of obstacle I assume big tech companies have worked out extremely well, but small-midsized non-tech companies probably get horribly wrong.
Suffice it to say that the Enterprise solution of CyberArk Password Vault might be tolerable for a pure Windows shop, I believe that it is most unwelcome in a mixed platform shop. I deal with it as little as possible. I’m sure it ticks all the boxes that the security guys and bean counters want, but it is most unpleasant to deal with at the pointy end of the stick.
Amazon-style hardware tokens work really well, in my experience. But they can’t be used for shared or vaulted password solutions.