Use a vault or encrypted channel when sharing initial credentials. Enforce change-on-first-login.

Prefer SSO and hardware keys to reduce password sprawl organization-wide.