diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index e129ffb1e887..20bd4f3195e7 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -34,10 +34,15 @@ bitwarden_license/src/test/Scim.ScimTest @bitwarden/team-admin-console-dev
 
 # Billing Team
 **/*billing* @bitwarden/team-billing-dev
-**/*subscription* @bitwarden/team-billing-dev
-**/*stripe* @bitwarden/team-billing-dev
-**/*paypal* @bitwarden/team-billing-dev
-**/*braintree* @bitwarden/team-billing-dev
 **/*bitpay* @bitwarden/team-billing-dev
+**/*braintree* @bitwarden/team-billing-dev
 **/*freshdesk* @bitwarden/team-billing-dev
-**/*freshsales* @bitwarden/team-billing-dev
\ No newline at end of file
+**/*freshsales* @bitwarden/team-billing-dev
+**/*paypal* @bitwarden/team-billing-dev
+**/*stripe* @bitwarden/team-billing-dev
+**/*subscription* @bitwarden/team-billing-dev
+**/Billing @bitwarden/team-billing-dev
+
+# Multiple Owners
+**/packages.lock.json
+Directory.Build.props
diff --git a/Directory.Build.props b/Directory.Build.props
index 6820a03e3758..c915ffaaeac8 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -2,7 +2,7 @@
 
   <PropertyGroup>
     <TargetFramework>net6.0</TargetFramework>
-    <Version>2023.9.1</Version>
+    <Version>2023.10.1</Version>
     <RootNamespace>Bit.$(MSBuildProjectName)</RootNamespace>
     <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
     <ImplicitUsings>enable</ImplicitUsings>
diff --git a/bitwarden_license/src/Commercial.Core/Providers/CreateProviderCommand.cs b/bitwarden_license/src/Commercial.Core/AdminConsole/Providers/CreateProviderCommand.cs
similarity index 87%
rename from bitwarden_license/src/Commercial.Core/Providers/CreateProviderCommand.cs
rename to bitwarden_license/src/Commercial.Core/AdminConsole/Providers/CreateProviderCommand.cs
index 36b6fe85c86e..738723a81989 100644
--- a/bitwarden_license/src/Commercial.Core/Providers/CreateProviderCommand.cs
+++ b/bitwarden_license/src/Commercial.Core/AdminConsole/Providers/CreateProviderCommand.cs
@@ -1,11 +1,12 @@
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Providers.Interfaces;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Services;
 using Bit.Core.Exceptions;
-using Bit.Core.Providers.Interfaces;
 using Bit.Core.Repositories;
-using Bit.Core.Services;
 
-namespace Bit.Commercial.Core.Providers;
+namespace Bit.Commercial.Core.AdminConsole.Providers;
 
 public class CreateProviderCommand : ICreateProviderCommand
 {
diff --git a/bitwarden_license/src/Commercial.Core/Services/ProviderService.cs b/bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs
similarity index 98%
rename from bitwarden_license/src/Commercial.Core/Services/ProviderService.cs
rename to bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs
index d186eb6d4153..a03e92c3f012 100644
--- a/bitwarden_license/src/Commercial.Core/Services/ProviderService.cs
+++ b/bitwarden_license/src/Commercial.Core/AdminConsole/Services/ProviderService.cs
@@ -1,11 +1,13 @@
-using Bit.Core.Context;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Business.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Services;
+using Bit.Core.Context;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
-using Bit.Core.Models.Business.Provider;
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
@@ -13,7 +15,7 @@
 using Bit.Core.Utilities;
 using Microsoft.AspNetCore.DataProtection;
 
-namespace Bit.Commercial.Core.Services;
+namespace Bit.Commercial.Core.AdminConsole.Services;
 
 public class ProviderService : IProviderService
 {
diff --git a/bitwarden_license/src/Commercial.Core/Utilities/ServiceCollectionExtensions.cs b/bitwarden_license/src/Commercial.Core/Utilities/ServiceCollectionExtensions.cs
index b9d21915bf59..09788406de4d 100644
--- a/bitwarden_license/src/Commercial.Core/Utilities/ServiceCollectionExtensions.cs
+++ b/bitwarden_license/src/Commercial.Core/Utilities/ServiceCollectionExtensions.cs
@@ -1,7 +1,7 @@
-using Bit.Commercial.Core.Providers;
-using Bit.Commercial.Core.Services;
-using Bit.Core.Providers.Interfaces;
-using Bit.Core.Services;
+using Bit.Commercial.Core.AdminConsole.Providers;
+using Bit.Commercial.Core.AdminConsole.Services;
+using Bit.Core.AdminConsole.Providers.Interfaces;
+using Bit.Core.AdminConsole.Services;
 using Microsoft.Extensions.DependencyInjection;
 
 namespace Bit.Commercial.Core.Utilities;
diff --git a/bitwarden_license/src/Commercial.Infrastructure.EntityFramework/packages.lock.json b/bitwarden_license/src/Commercial.Infrastructure.EntityFramework/packages.lock.json
index ca7a2c863276..c230392f018e 100644
--- a/bitwarden_license/src/Commercial.Infrastructure.EntityFramework/packages.lock.json
+++ b/bitwarden_license/src/Commercial.Infrastructure.EntityFramework/packages.lock.json
@@ -2628,7 +2628,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
diff --git a/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs b/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs
index 22b8a22c8543..e760813054cd 100644
--- a/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs
+++ b/bitwarden_license/src/Scim/Controllers/v2/UsersController.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Enums;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Scim.Models;
diff --git a/bitwarden_license/src/Scim/packages.lock.json b/bitwarden_license/src/Scim/packages.lock.json
index 16a42f355d3f..722ede68b886 100644
--- a/bitwarden_license/src/Scim/packages.lock.json
+++ b/bitwarden_license/src/Scim/packages.lock.json
@@ -2631,7 +2631,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2639,7 +2639,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2651,9 +2651,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/bitwarden_license/src/Sso/packages.lock.json b/bitwarden_license/src/Sso/packages.lock.json
index ecccbaab16d0..59724fbae9be 100644
--- a/bitwarden_license/src/Sso/packages.lock.json
+++ b/bitwarden_license/src/Sso/packages.lock.json
@@ -2791,7 +2791,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2799,7 +2799,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2811,9 +2811,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/bitwarden_license/test/Commercial.Core.Test/AutoFixture/ProviderUserFixtures.cs b/bitwarden_license/test/Commercial.Core.Test/AdminConsole/AutoFixture/ProviderUserFixtures.cs
similarity index 83%
rename from bitwarden_license/test/Commercial.Core.Test/AutoFixture/ProviderUserFixtures.cs
rename to bitwarden_license/test/Commercial.Core.Test/AdminConsole/AutoFixture/ProviderUserFixtures.cs
index 48f70c335066..fc47e80c8742 100644
--- a/bitwarden_license/test/Commercial.Core.Test/AutoFixture/ProviderUserFixtures.cs
+++ b/bitwarden_license/test/Commercial.Core.Test/AdminConsole/AutoFixture/ProviderUserFixtures.cs
@@ -1,9 +1,9 @@
 using System.Reflection;
 using AutoFixture;
 using AutoFixture.Xunit2;
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 
-namespace Bit.Commercial.Core.Test.AutoFixture;
+namespace Bit.Commercial.Core.Test.AdminConsole.AutoFixture;
 
 internal class ProviderUser : ICustomization
 {
@@ -18,7 +18,7 @@ public ProviderUser(ProviderUserStatusType status, ProviderUserType type)
 
     public void Customize(IFixture fixture)
     {
-        fixture.Customize<Bit.Core.Entities.Provider.ProviderUser>(composer => composer
+        fixture.Customize<Bit.Core.AdminConsole.Entities.Provider.ProviderUser>(composer => composer
             .With(o => o.Type, Type)
             .With(o => o.Status, Status));
     }
diff --git a/bitwarden_license/test/Commercial.Core.Test/ProviderFeatures/CreateProviderCommandTests.cs b/bitwarden_license/test/Commercial.Core.Test/AdminConsole/ProviderFeatures/CreateProviderCommandTests.cs
similarity index 86%
rename from bitwarden_license/test/Commercial.Core.Test/ProviderFeatures/CreateProviderCommandTests.cs
rename to bitwarden_license/test/Commercial.Core.Test/AdminConsole/ProviderFeatures/CreateProviderCommandTests.cs
index 721ed24d9c2a..399ed6ea1e1b 100644
--- a/bitwarden_license/test/Commercial.Core.Test/ProviderFeatures/CreateProviderCommandTests.cs
+++ b/bitwarden_license/test/Commercial.Core.Test/AdminConsole/ProviderFeatures/CreateProviderCommandTests.cs
@@ -1,16 +1,17 @@
-using Bit.Commercial.Core.Providers;
+using Bit.Commercial.Core.AdminConsole.Providers;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Services;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Repositories;
-using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Commercial.Core.Test.ProviderFeatures;
+namespace Bit.Commercial.Core.Test.AdminConsole.ProviderFeatures;
 
 [SutProviderCustomize]
 public class CreateProviderCommandTests
diff --git a/bitwarden_license/test/Commercial.Core.Test/Services/ProviderServiceTests.cs b/bitwarden_license/test/Commercial.Core.Test/AdminConsole/Services/ProviderServiceTests.cs
similarity index 98%
rename from bitwarden_license/test/Commercial.Core.Test/Services/ProviderServiceTests.cs
rename to bitwarden_license/test/Commercial.Core.Test/AdminConsole/Services/ProviderServiceTests.cs
index 2a6e68bfb422..01538003c6ee 100644
--- a/bitwarden_license/test/Commercial.Core.Test/Services/ProviderServiceTests.cs
+++ b/bitwarden_license/test/Commercial.Core.Test/AdminConsole/Services/ProviderServiceTests.cs
@@ -1,13 +1,14 @@
-using Bit.Commercial.Core.Services;
-using Bit.Commercial.Core.Test.AutoFixture;
+using Bit.Commercial.Core.AdminConsole.Services;
+using Bit.Commercial.Core.Test.AdminConsole.AutoFixture;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Business.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
-using Bit.Core.Models.Business.Provider;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
@@ -17,10 +18,10 @@
 using NSubstitute;
 using NSubstitute.ReturnsExtensions;
 using Xunit;
-using Provider = Bit.Core.Entities.Provider.Provider;
-using ProviderUser = Bit.Core.Entities.Provider.ProviderUser;
+using Provider = Bit.Core.AdminConsole.Entities.Provider.Provider;
+using ProviderUser = Bit.Core.AdminConsole.Entities.Provider.ProviderUser;
 
-namespace Bit.Commercial.Core.Test.Services;
+namespace Bit.Commercial.Core.Test.AdminConsole.Services;
 
 [SutProviderCustomize]
 public class ProviderServiceTests
diff --git a/bitwarden_license/test/Commercial.Core.Test/SecretsManager/Queries/Projects/MaxProjectsQueryTests.cs b/bitwarden_license/test/Commercial.Core.Test/SecretsManager/Queries/Projects/MaxProjectsQueryTests.cs
index 79ffb421e1b3..58c944e8ebc0 100644
--- a/bitwarden_license/test/Commercial.Core.Test/SecretsManager/Queries/Projects/MaxProjectsQueryTests.cs
+++ b/bitwarden_license/test/Commercial.Core.Test/SecretsManager/Queries/Projects/MaxProjectsQueryTests.cs
@@ -30,29 +30,36 @@ await sutProvider.GetDependency<IProjectRepository>().DidNotReceiveWithAnyArgs()
 
     [Theory]
     [BitAutoData(PlanType.FamiliesAnnually2019)]
-    [BitAutoData(PlanType.TeamsMonthly2019)]
-    [BitAutoData(PlanType.TeamsAnnually2019)]
-    [BitAutoData(PlanType.EnterpriseMonthly2019)]
-    [BitAutoData(PlanType.EnterpriseAnnually2019)]
     [BitAutoData(PlanType.Custom)]
     [BitAutoData(PlanType.FamiliesAnnually)]
     public async Task GetByOrgIdAsync_SmPlanIsNull_ThrowsBadRequest(PlanType planType,
         SutProvider<MaxProjectsQuery> sutProvider, Organization organization)
     {
         organization.PlanType = planType;
-        sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organization.Id).Returns(organization);
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(organization.Id)
+            .Returns(organization);
 
         await Assert.ThrowsAsync<BadRequestException>(
             async () => await sutProvider.Sut.GetByOrgIdAsync(organization.Id, 1));
 
-        await sutProvider.GetDependency<IProjectRepository>().DidNotReceiveWithAnyArgs()
+        await sutProvider.GetDependency<IProjectRepository>()
+            .DidNotReceiveWithAnyArgs()
             .GetProjectCountByOrganizationIdAsync(organization.Id);
     }
 
     [Theory]
+    [BitAutoData(PlanType.TeamsMonthly2019)]
+    [BitAutoData(PlanType.TeamsMonthly2020)]
     [BitAutoData(PlanType.TeamsMonthly)]
+    [BitAutoData(PlanType.TeamsAnnually2019)]
+    [BitAutoData(PlanType.TeamsAnnually2020)]
     [BitAutoData(PlanType.TeamsAnnually)]
+    [BitAutoData(PlanType.EnterpriseMonthly2019)]
+    [BitAutoData(PlanType.EnterpriseMonthly2020)]
     [BitAutoData(PlanType.EnterpriseMonthly)]
+    [BitAutoData(PlanType.EnterpriseAnnually2019)]
+    [BitAutoData(PlanType.EnterpriseAnnually2020)]
     [BitAutoData(PlanType.EnterpriseAnnually)]
     public async Task GetByOrgIdAsync_SmNoneFreePlans_ReturnsNull(PlanType planType,
         SutProvider<MaxProjectsQuery> sutProvider, Organization organization)
diff --git a/bitwarden_license/test/Commercial.Core.Test/packages.lock.json b/bitwarden_license/test/Commercial.Core.Test/packages.lock.json
index 25d8df608173..205a8205c77a 100644
--- a/bitwarden_license/test/Commercial.Core.Test/packages.lock.json
+++ b/bitwarden_license/test/Commercial.Core.Test/packages.lock.json
@@ -2667,7 +2667,7 @@
       "commercial.core": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )"
+          "Core": "[2023.10.1, )"
         }
       },
       "common": {
@@ -2675,7 +2675,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -2729,8 +2729,8 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Common": "[2023.9.0, )",
-          "Core": "[2023.9.0, )",
+          "Common": "[2023.10.1, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
diff --git a/bitwarden_license/test/Scim.IntegrationTest/Controllers/v2/GroupsControllerTests.cs b/bitwarden_license/test/Scim.IntegrationTest/Controllers/v2/GroupsControllerTests.cs
index 898e12b42203..6742c6e0ad4a 100644
--- a/bitwarden_license/test/Scim.IntegrationTest/Controllers/v2/GroupsControllerTests.cs
+++ b/bitwarden_license/test/Scim.IntegrationTest/Controllers/v2/GroupsControllerTests.cs
@@ -17,7 +17,6 @@ public class GroupsControllerTests : IClassFixture<ScimApplicationFactory>, IAsy
     public GroupsControllerTests(ScimApplicationFactory factory)
     {
         _factory = factory;
-        _factory.DatabaseName = "test_database_groups";
     }
 
     public Task InitializeAsync()
diff --git a/bitwarden_license/test/Scim.IntegrationTest/Controllers/v2/UsersControllerTests.cs b/bitwarden_license/test/Scim.IntegrationTest/Controllers/v2/UsersControllerTests.cs
index 5a025a2c8c0b..c0e4f3eb7329 100644
--- a/bitwarden_license/test/Scim.IntegrationTest/Controllers/v2/UsersControllerTests.cs
+++ b/bitwarden_license/test/Scim.IntegrationTest/Controllers/v2/UsersControllerTests.cs
@@ -17,7 +17,6 @@ public class UsersControllerTests : IClassFixture<ScimApplicationFactory>, IAsyn
     public UsersControllerTests(ScimApplicationFactory factory)
     {
         _factory = factory;
-        _factory.DatabaseName = "test_database_users";
     }
 
     public Task InitializeAsync()
diff --git a/bitwarden_license/test/Scim.IntegrationTest/packages.lock.json b/bitwarden_license/test/Scim.IntegrationTest/packages.lock.json
index e1d3b4b09e30..3c292e2a4a59 100644
--- a/bitwarden_license/test/Scim.IntegrationTest/packages.lock.json
+++ b/bitwarden_license/test/Scim.IntegrationTest/packages.lock.json
@@ -655,14 +655,6 @@
         "resolved": "7.0.5",
         "contentHash": "yMLM/aK1MikVqpjxd7PJ1Pjgztd3VAd26ZHxyjxG3RPeM9cHjvS5tCg9kAAayR6eHmBg0ffZsHdT28WfA5tTlA=="
       },
-      "Microsoft.EntityFrameworkCore.InMemory": {
-        "type": "Transitive",
-        "resolved": "7.0.5",
-        "contentHash": "y3S/A/0uJX7KOhppC3xqyta6Z0PRz0qPLngH5GFu4GZ7/+Sw2u/amf7MavvR5GfZjGabGcohMpsRSahMmpF9gA==",
-        "dependencies": {
-          "Microsoft.EntityFrameworkCore": "7.0.5"
-        }
-      },
       "Microsoft.EntityFrameworkCore.Relational": {
         "type": "Transitive",
         "resolved": "7.0.5",
@@ -2989,7 +2981,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -3041,15 +3033,15 @@
       "identity": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )",
           "Swashbuckle.AspNetCore.SwaggerGen": "[6.5.0, )"
         }
       },
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -3057,7 +3049,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -3069,26 +3061,25 @@
       "integrationtestcommon": {
         "type": "Project",
         "dependencies": {
-          "Common": "[2023.9.0, )",
-          "Identity": "[2023.9.0, )",
+          "Common": "[2023.10.1, )",
+          "Identity": "[2023.10.1, )",
           "Microsoft.AspNetCore.Mvc.Testing": "[6.0.5, )",
-          "Microsoft.EntityFrameworkCore.InMemory": "[7.0.5, )",
           "Microsoft.Extensions.Configuration": "[6.0.1, )"
         }
       },
       "scim": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )"
         }
       },
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/bitwarden_license/test/Scim.Test/packages.lock.json b/bitwarden_license/test/Scim.Test/packages.lock.json
index 36253d50a120..f57a9109f18d 100644
--- a/bitwarden_license/test/Scim.Test/packages.lock.json
+++ b/bitwarden_license/test/Scim.Test/packages.lock.json
@@ -2834,7 +2834,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -2886,7 +2886,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2894,7 +2894,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2906,16 +2906,16 @@
       "scim": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )"
         }
       },
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/Admin/Controllers/OrganizationsController.cs b/src/Admin/Controllers/OrganizationsController.cs
index b3a232c2c8ba..f671df558d80 100644
--- a/src/Admin/Controllers/OrganizationsController.cs
+++ b/src/Admin/Controllers/OrganizationsController.cs
@@ -215,7 +215,10 @@ public async Task<IActionResult> Edit(Guid id, OrganizationEditModel model)
 
         try
         {
-            await _stripeSyncService.UpdateCustomerEmailAddress(organization.GatewayCustomerId, organization.BillingEmail);
+            if (!string.IsNullOrWhiteSpace(organization.GatewayCustomerId) && !string.IsNullOrWhiteSpace(organization.BillingEmail))
+            {
+                await _stripeSyncService.UpdateCustomerEmailAddress(organization.GatewayCustomerId, organization.BillingEmail);
+            }
         }
         catch (StripeException stripeException)
         {
diff --git a/src/Admin/Controllers/ProvidersController.cs b/src/Admin/Controllers/ProvidersController.cs
index 3dbf1ca53bb3..8fa02e9b329f 100644
--- a/src/Admin/Controllers/ProvidersController.cs
+++ b/src/Admin/Controllers/ProvidersController.cs
@@ -1,9 +1,11 @@
 using Bit.Admin.Enums;
 using Bit.Admin.Models;
 using Bit.Admin.Utilities;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
-using Bit.Core.Providers.Interfaces;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Providers.Interfaces;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Services;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
diff --git a/src/Admin/Models/CreateProviderModel.cs b/src/Admin/Models/CreateProviderModel.cs
index 9dcd218fa625..8eddd014cd5c 100644
--- a/src/Admin/Models/CreateProviderModel.cs
+++ b/src/Admin/Models/CreateProviderModel.cs
@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.SharedWeb.Utilities;
 
 namespace Bit.Admin.Models;
diff --git a/src/Admin/Models/OrganizationEditModel.cs b/src/Admin/Models/OrganizationEditModel.cs
index f8bfa453da1e..234d8bb1574c 100644
--- a/src/Admin/Models/OrganizationEditModel.cs
+++ b/src/Admin/Models/OrganizationEditModel.cs
@@ -1,9 +1,9 @@
 using System.ComponentModel.DataAnnotations;
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Settings;
diff --git a/src/Admin/Models/OrganizationViewModel.cs b/src/Admin/Models/OrganizationViewModel.cs
index 541f7a2fc1fb..0bad3650fd73 100644
--- a/src/Admin/Models/OrganizationViewModel.cs
+++ b/src/Admin/Models/OrganizationViewModel.cs
@@ -1,6 +1,6 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Vault.Entities;
diff --git a/src/Admin/Models/ProviderEditModel.cs b/src/Admin/Models/ProviderEditModel.cs
index 38fdb742a85a..b5219d8ed989 100644
--- a/src/Admin/Models/ProviderEditModel.cs
+++ b/src/Admin/Models/ProviderEditModel.cs
@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 
 namespace Bit.Admin.Models;
 
diff --git a/src/Admin/Models/ProviderViewModel.cs b/src/Admin/Models/ProviderViewModel.cs
index 766101e884b9..38e7eac4a2c2 100644
--- a/src/Admin/Models/ProviderViewModel.cs
+++ b/src/Admin/Models/ProviderViewModel.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 
 namespace Bit.Admin.Models;
 
diff --git a/src/Admin/Models/ProvidersModel.cs b/src/Admin/Models/ProvidersModel.cs
index dccf4a4d7610..5fb8e8dfab16 100644
--- a/src/Admin/Models/ProvidersModel.cs
+++ b/src/Admin/Models/ProvidersModel.cs
@@ -1,4 +1,4 @@
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
 
 namespace Bit.Admin.Models;
 
diff --git a/src/Admin/Utilities/WebHostEnvironmentExtensions.cs b/src/Admin/Utilities/WebHostEnvironmentExtensions.cs
new file mode 100644
index 000000000000..9602d4c76dc0
--- /dev/null
+++ b/src/Admin/Utilities/WebHostEnvironmentExtensions.cs
@@ -0,0 +1,24 @@
+namespace Bit.Admin.Utilities;
+
+public static class WebHostEnvironmentExtensions
+{
+    public static string GetStripeUrl(this IWebHostEnvironment hostingEnvironment)
+    {
+        if (hostingEnvironment.IsDevelopment() || hostingEnvironment.IsEnvironment("QA"))
+        {
+            return "https://dashboard.stripe.com/test";
+        }
+
+        return "https://dashboard.stripe.com";
+    }
+
+    public static string GetBraintreeMerchantUrl(this IWebHostEnvironment hostingEnvironment)
+    {
+        if (hostingEnvironment.IsDevelopment() || hostingEnvironment.IsEnvironment("QA"))
+        {
+            return "https://www.sandbox.braintreegateway.com/merchants";
+        }
+
+        return "https://www.braintreegateway.com/merchants";
+    }
+}
diff --git a/src/Admin/Views/Organizations/_ProviderInformation.cshtml b/src/Admin/Views/Organizations/_ProviderInformation.cshtml
index 217f9951b0c3..4bd2118ea0a3 100644
--- a/src/Admin/Views/Organizations/_ProviderInformation.cshtml
+++ b/src/Admin/Views/Organizations/_ProviderInformation.cshtml
@@ -1,5 +1,5 @@
 @using Bit.SharedWeb.Utilities
-@model Bit.Core.Entities.Provider.Provider
+@model Bit.Core.AdminConsole.Entities.Provider.Provider
 <dl class="row">
     <dt class="col-sm-4 col-lg-3">Provider Name</dt>
     <dd class="col-sm-8 col-lg-9">@Model.Name</dd>
diff --git a/src/Admin/Views/Providers/Admins.cshtml b/src/Admin/Views/Providers/Admins.cshtml
index 533cb3034ea2..4d110aca5bcc 100644
--- a/src/Admin/Views/Providers/Admins.cshtml
+++ b/src/Admin/Views/Providers/Admins.cshtml
@@ -1,4 +1,5 @@
 @using Bit.Admin.Enums;
+@using Bit.Core.AdminConsole.Enums.Provider
 @inject Bit.Admin.Services.IAccessControlService AccessControlService
 @model ProviderViewModel
 
diff --git a/src/Admin/Views/Providers/Create.cshtml b/src/Admin/Views/Providers/Create.cshtml
index 107e93150b41..2e69da3ad7b3 100644
--- a/src/Admin/Views/Providers/Create.cshtml
+++ b/src/Admin/Views/Providers/Create.cshtml
@@ -1,4 +1,5 @@
 @using Bit.SharedWeb.Utilities
+@using Bit.Core.AdminConsole.Enums.Provider
 @model CreateProviderModel
 @{
     ViewData["Title"] = "Create Provider";
diff --git a/src/Admin/Views/Providers/Organizations.cshtml b/src/Admin/Views/Providers/Organizations.cshtml
index 06fc490bcc0d..b9c751480d44 100644
--- a/src/Admin/Views/Providers/Organizations.cshtml
+++ b/src/Admin/Views/Providers/Organizations.cshtml
@@ -1,3 +1,4 @@
+@using Bit.Core.AdminConsole.Enums.Provider
 @model ProviderViewModel
 
 @await Html.PartialAsync("_ProviderScripts")
diff --git a/src/Admin/Views/Providers/_ViewInformation.cshtml b/src/Admin/Views/Providers/_ViewInformation.cshtml
index ff4a2e8106ac..b01502e6d668 100644
--- a/src/Admin/Views/Providers/_ViewInformation.cshtml
+++ b/src/Admin/Views/Providers/_ViewInformation.cshtml
@@ -1,4 +1,5 @@
 @using Bit.SharedWeb.Utilities
+@using Bit.Core.AdminConsole.Enums.Provider
 @model ProviderViewModel
 <dl class="row">
     <dt class="col-sm-4 col-lg-3">Id</dt>
diff --git a/src/Admin/Views/Shared/_OrganizationForm.cshtml b/src/Admin/Views/Shared/_OrganizationForm.cshtml
index 697d3ef9435a..9e1b488b173c 100644
--- a/src/Admin/Views/Shared/_OrganizationForm.cshtml
+++ b/src/Admin/Views/Shared/_OrganizationForm.cshtml
@@ -1,5 +1,6 @@
 @using Bit.SharedWeb.Utilities
 @using Bit.Admin.Enums;
+@using Bit.Core.AdminConsole.Enums.Provider
 @inject Bit.Admin.Services.IAccessControlService AccessControlService;
 
 @model OrganizationEditModel
@@ -258,7 +259,7 @@
             <div class="col-sm">
                 <div class="form-group">
                     <label asp-for="ExpirationDate"></label>
-                    <input type="datetime-local" class="form-control" asp-for="ExpirationDate" readonly='@(!canEditLicensing)'>
+                    <input type="datetime-local" class="form-control" asp-for="ExpirationDate" readonly='@(!canEditLicensing)' step="1">
                 </div>
             </div>
         </div>
diff --git a/src/Admin/Views/Shared/_OrganizationFormScripts.cshtml b/src/Admin/Views/Shared/_OrganizationFormScripts.cshtml
index 88dc8a78c1f7..5871977fea7c 100644
--- a/src/Admin/Views/Shared/_OrganizationFormScripts.cshtml
+++ b/src/Admin/Views/Shared/_OrganizationFormScripts.cshtml
@@ -1,3 +1,5 @@
+@inject IWebHostEnvironment HostingEnvironment
+@using Bit.Admin.Utilities
 @model OrganizationEditModel
 
 <script>
@@ -15,10 +17,11 @@
                 return;
             }
             if (gateway.value === '@((byte)GatewayType.Stripe)') {
-                window.open('https://dashboard.stripe.com/customers/' + customerId.value, '_blank');
+                const url = `@(HostingEnvironment.GetStripeUrl())/customers/${customerId.value}/`;
+                window.open(url, '_blank');
             } else if (gateway.value === '@((byte)GatewayType.Braintree)') {
-                window.open('https://www.braintreegateway.com/merchants/@(Model.BraintreeMerchantId)/'
-                    + customerId.value, '_blank');
+                const url = `@(HostingEnvironment.GetBraintreeMerchantUrl())/@Model.BraintreeMerchantId/${customerId.value}`;
+                window.open(url, '_blank');
             }
         });
         document.getElementById('gateway-subscription-link')?.addEventListener('click', () => {
@@ -28,10 +31,11 @@
                 return;
             }
             if (gateway.value === '@((byte)GatewayType.Stripe)') {
-                window.open('https://dashboard.stripe.com/subscriptions/' + subId.value, '_blank');
+                const url = `@(HostingEnvironment.GetStripeUrl())/subscriptions/${subId.value}/`;
+                window.open(url, '_blank');
             } else if (gateway.value === '@((byte)GatewayType.Braintree)') {
-                window.open('https://www.braintreegateway.com/merchants/@(Model.BraintreeMerchantId)/' +
-                    'subscriptions/' + subId.value, '_blank');
+                const url = `@(HostingEnvironment.GetBraintreeMerchantUrl())/@Model.BraintreeMerchantId/subscriptions/${subId.value}`;
+                window.open(url, '_blank');
             }
         });
         document.getElementById('@(nameof(Model.UseSecretsManager))').addEventListener('change', (event) => {
@@ -64,6 +68,10 @@
 
     function togglePlanFeatures(planType) {
         switch(planType) {
+            case '@((byte)PlanType.TeamsMonthly2019)':
+            case '@((byte)PlanType.TeamsAnnually2019)':
+            case '@((byte)PlanType.TeamsMonthly2020)':
+            case '@((byte)PlanType.TeamsAnnually2020)':
             case '@((byte)PlanType.TeamsMonthly)':
             case '@((byte)PlanType.TeamsAnnually)':
                 document.getElementById('@(nameof(Model.UsePolicies))').checked = false;
@@ -81,6 +89,10 @@
                 document.getElementById('@(nameof(Model.UseScim))').checked = false;
             break;
 
+            case '@((byte)PlanType.EnterpriseMonthly2019)':
+            case '@((byte)PlanType.EnterpriseAnnually2019)':
+            case '@((byte)PlanType.EnterpriseMonthly2020)':
+            case '@((byte)PlanType.EnterpriseAnnually2020)':
             case '@((byte)PlanType.EnterpriseMonthly)':
             case '@((byte)PlanType.EnterpriseAnnually)':
                 document.getElementById('@(nameof(Model.UsePolicies))').checked = true;
diff --git a/src/Admin/Views/Users/Edit.cshtml b/src/Admin/Views/Users/Edit.cshtml
index 84fc6a749a33..a567c07dc3ff 100644
--- a/src/Admin/Views/Users/Edit.cshtml
+++ b/src/Admin/Views/Users/Edit.cshtml
@@ -1,5 +1,6 @@
 @using Bit.Admin.Enums;
 @inject Bit.Admin.Services.IAccessControlService AccessControlService
+@inject IWebHostEnvironment HostingEnvironment
 @model UserEditModel
 @{
     ViewData["Title"] = "User: " + Model.User.Email;
@@ -10,7 +11,7 @@
     var canViewPremium = AccessControlService.UserHasPermission(Permission.User_Premium_View);
     var canViewLicensing = AccessControlService.UserHasPermission(Permission.User_Licensing_View);
     var canViewBilling = AccessControlService.UserHasPermission(Permission.User_Billing_View);
-    
+
     var canEditPremium = AccessControlService.UserHasPermission(Permission.User_Premium_Edit);
     var canEditLicensing = AccessControlService.UserHasPermission(Permission.User_Licensing_Edit);
     var canEditBilling = AccessControlService.UserHasPermission(Permission.User_Billing_Edit);
@@ -45,10 +46,15 @@
                 }
 
                 if (gateway.value === '@((byte)Bit.Core.Enums.GatewayType.Stripe)') {
-                    window.open('https://dashboard.stripe.com/customers/' + customerId.value, '_blank');
+                    const url = '@(HostingEnvironment.IsDevelopment()
+                                     ? "https://dashboard.stripe.com/test"
+                                     : "https://dashboard.stripe.com")';
+                    window.open(`${url}/customers/${customerId.value}/`, '_blank');
                 } else if (gateway.value === '@((byte)Bit.Core.Enums.GatewayType.Braintree)') {
-                    window.open('https://www.braintreegateway.com/merchants/@(Model.BraintreeMerchantId)/' +
-                        'customers/' + customerId.value, '_blank');
+                    const url = '@(HostingEnvironment.IsDevelopment()
+                                     ? $"https://www.sandbox.braintreegateway.com/merchants/{Model.BraintreeMerchantId}"
+                                     : $"https://www.braintreegateway.com/merchants/{Model.BraintreeMerchantId}")';
+                    window.open(`${url}/${customerId.value}`, '_blank');
                 }
             });
 
@@ -60,10 +66,15 @@
                 }
 
                 if (gateway.value === '@((byte)Bit.Core.Enums.GatewayType.Stripe)') {
-                    window.open('https://dashboard.stripe.com/subscriptions/' + subId.value, '_blank');
+                    const url = '@(HostingEnvironment.IsDevelopment() || HostingEnvironment.IsEnvironment("QA")
+                                     ? "https://dashboard.stripe.com/test"
+                                     : "https://dashboard.stripe.com")'
+                    window.open(`${url}/subscriptions/${subId.value}`, '_blank');
                 } else if (gateway.value === '@((byte)Bit.Core.Enums.GatewayType.Braintree)') {
-                    window.open('https://www.braintreegateway.com/merchants/@(Model.BraintreeMerchantId)/' +
-                        'subscriptions/' + subId.value, '_blank');
+                    const url = '@(HostingEnvironment.IsDevelopment() || HostingEnvironment.IsEnvironment("QA")
+                                     ? $"https://www.sandbox.braintreegateway.com/merchants/{Model.BraintreeMerchantId}"
+                                     : $"https://www.braintreegateway.com/merchants/{Model.BraintreeMerchantId}")';
+                    window.open(`${url}/subscriptions/${subId.value}`, '_blank');
                 }
             });
         })();
@@ -80,7 +91,7 @@
 @if (canViewBillingInformation)
 {
     <h2>Billing Information</h2>
-    @await Html.PartialAsync("_BillingInformation", 
+    @await Html.PartialAsync("_BillingInformation",
         new BillingInformationModel { BillingInfo = Model.BillingInfo, UserId = Model.User.Id, Entity = "User" })
 }
 @if (canViewGeneral)
diff --git a/src/Admin/Views/_ViewImports.cshtml b/src/Admin/Views/_ViewImports.cshtml
index b3dac997e284..073a922f5e45 100644
--- a/src/Admin/Views/_ViewImports.cshtml
+++ b/src/Admin/Views/_ViewImports.cshtml
@@ -1,7 +1,6 @@
 @using Microsoft.AspNetCore.Identity
 @using Bit.Admin
 @using Bit.Admin.Models
-@using Bit.Core.Enums.Provider
 @using Bit.Core.Enums
 @addTagHelper *, Microsoft.AspNetCore.Mvc.TagHelpers
 @addTagHelper "*, Admin"
diff --git a/src/Admin/packages.lock.json b/src/Admin/packages.lock.json
index b830fdad389a..d714421eee45 100644
--- a/src/Admin/packages.lock.json
+++ b/src/Admin/packages.lock.json
@@ -2792,15 +2792,15 @@
       "commercial.core": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )"
+          "Core": "[2023.10.1, )"
         }
       },
       "commercial.infrastructure.entityframework": {
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       },
       "core": {
@@ -2848,7 +2848,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2856,7 +2856,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2868,7 +2868,7 @@
       "migrator": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.Extensions.Logging": "[6.0.0, )",
           "dbup-sqlserver": "[5.0.8, )"
         }
@@ -2876,30 +2876,30 @@
       "mysqlmigrations": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       },
       "postgresmigrations": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       },
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       },
       "sqlitemigrations": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/Api/Controllers/OrganizationAuthRequestsController.cs b/src/Api/AdminConsole/Controllers/OrganizationAuthRequestsController.cs
similarity index 96%
rename from src/Api/Controllers/OrganizationAuthRequestsController.cs
rename to src/Api/AdminConsole/Controllers/OrganizationAuthRequestsController.cs
index 5435b44d9681..36555a7d2afe 100644
--- a/src/Api/Controllers/OrganizationAuthRequestsController.cs
+++ b/src/Api/AdminConsole/Controllers/OrganizationAuthRequestsController.cs
@@ -1,5 +1,5 @@
-using Bit.Api.Auth.Models.Request;
-using Bit.Api.Auth.Models.Response;
+using Bit.Api.AdminConsole.Models.Request;
+using Bit.Api.AdminConsole.Models.Response;
 using Bit.Api.Models.Response;
 using Bit.Core;
 using Bit.Core.AdminConsole.OrganizationAuth.Interfaces;
@@ -12,7 +12,7 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
-namespace Bit.Api.Controllers;
+namespace Bit.Api.AdminConsole.Controllers;
 
 [Route("organizations/{orgId}/auth-requests")]
 [Authorize("Application")]
diff --git a/src/Api/Controllers/OrganizationConnectionsController.cs b/src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs
similarity index 97%
rename from src/Api/Controllers/OrganizationConnectionsController.cs
rename to src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs
index e9ea31c8ffca..8e54bfca9c76 100644
--- a/src/Api/Controllers/OrganizationConnectionsController.cs
+++ b/src/Api/AdminConsole/Controllers/OrganizationConnectionsController.cs
@@ -1,19 +1,19 @@
-using Bit.Api.Models.Request.Organizations;
-using Bit.Api.Models.Response.Organizations;
+using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Api.AdminConsole.Models.Response.Organizations;
 using Bit.Core.AdminConsole.Models.OrganizationConnectionConfigs;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.OrganizationConnectionConfigs;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
-namespace Bit.Api.Controllers;
+namespace Bit.Api.AdminConsole.Controllers;
 
 [Authorize("Application")]
 [Route("organizations/connections")]
diff --git a/src/Api/Controllers/OrganizationDomainController.cs b/src/Api/AdminConsole/Controllers/OrganizationDomainController.cs
similarity index 95%
rename from src/Api/Controllers/OrganizationDomainController.cs
rename to src/Api/AdminConsole/Controllers/OrganizationDomainController.cs
index 60abdad7d42c..92feb9a44cd4 100644
--- a/src/Api/Controllers/OrganizationDomainController.cs
+++ b/src/Api/AdminConsole/Controllers/OrganizationDomainController.cs
@@ -1,16 +1,16 @@
-using Bit.Api.Models.Request;
-using Bit.Api.Models.Request.Organizations;
+using Bit.Api.AdminConsole.Models.Request;
+using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Api.AdminConsole.Models.Response.Organizations;
 using Bit.Api.Models.Response;
-using Bit.Api.Models.Response.Organizations;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.Repositories;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
-namespace Bit.Api.Controllers;
+namespace Bit.Api.AdminConsole.Controllers;
 
 [Route("organizations")]
 [Authorize("Application")]
diff --git a/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs b/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs
index 85436b41ba87..73140cea4eda 100644
--- a/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs
+++ b/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs
@@ -2,6 +2,7 @@
 using Bit.Api.AdminConsole.Models.Response.Organizations;
 using Bit.Api.Models.Request.Organizations;
 using Bit.Api.Models.Response;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Enums;
@@ -33,6 +34,7 @@ public class OrganizationUsersController : Controller
     private readonly ICountNewSmSeatsRequiredQuery _countNewSmSeatsRequiredQuery;
     private readonly IUpdateSecretsManagerSubscriptionCommand _updateSecretsManagerSubscriptionCommand;
     private readonly IUpdateOrganizationUserGroupsCommand _updateOrganizationUserGroupsCommand;
+    private readonly IAcceptOrgUserCommand _acceptOrgUserCommand;
 
     public OrganizationUsersController(
         IOrganizationRepository organizationRepository,
@@ -45,7 +47,8 @@ public OrganizationUsersController(
         ICurrentContext currentContext,
         ICountNewSmSeatsRequiredQuery countNewSmSeatsRequiredQuery,
         IUpdateSecretsManagerSubscriptionCommand updateSecretsManagerSubscriptionCommand,
-        IUpdateOrganizationUserGroupsCommand updateOrganizationUserGroupsCommand)
+        IUpdateOrganizationUserGroupsCommand updateOrganizationUserGroupsCommand,
+        IAcceptOrgUserCommand acceptOrgUserCommand)
     {
         _organizationRepository = organizationRepository;
         _organizationUserRepository = organizationUserRepository;
@@ -58,6 +61,7 @@ public OrganizationUsersController(
         _countNewSmSeatsRequiredQuery = countNewSmSeatsRequiredQuery;
         _updateSecretsManagerSubscriptionCommand = updateSecretsManagerSubscriptionCommand;
         _updateOrganizationUserGroupsCommand = updateOrganizationUserGroupsCommand;
+        _acceptOrgUserCommand = acceptOrgUserCommand;
     }
 
     [HttpGet("{id}")]
@@ -199,7 +203,7 @@ public async Task AcceptInit(Guid orgId, Guid organizationUserId, [FromBody] Org
         }
 
         await _organizationService.InitPendingOrganization(user.Id, orgId, model.Keys.PublicKey, model.Keys.EncryptedPrivateKey, model.CollectionName);
-        await _organizationService.AcceptUserAsync(organizationUserId, user, model.Token, _userService);
+        await _acceptOrgUserCommand.AcceptOrgUserByEmailTokenAsync(organizationUserId, user, model.Token, _userService);
         await _organizationService.ConfirmUserAsync(orgId, organizationUserId, model.Key, user.Id, _userService);
     }
 
@@ -221,7 +225,7 @@ public async Task Accept(Guid orgId, Guid organizationUserId, [FromBody] Organiz
             throw new BadRequestException(string.Empty, "Master Password reset is required, but not provided.");
         }
 
-        await _organizationService.AcceptUserAsync(organizationUserId, user, model.Token, _userService);
+        await _acceptOrgUserCommand.AcceptOrgUserByEmailTokenAsync(organizationUserId, user, model.Token, _userService);
 
         if (useMasterPasswordPolicy)
         {
@@ -332,7 +336,7 @@ await _organizationService.UpdateUserResetPasswordEnrollmentAsync(
         var orgUser = await _organizationUserRepository.GetByOrganizationAsync(orgId, user.Id);
         if (orgUser.Status == OrganizationUserStatusType.Invited)
         {
-            await _organizationService.AcceptUserAsync(orgId, user, _userService);
+            await _acceptOrgUserCommand.AcceptOrgUserByOrgIdAsync(orgId, user, _userService);
         }
     }
 
diff --git a/src/Api/AdminConsole/Controllers/OrganizationsController.cs b/src/Api/AdminConsole/Controllers/OrganizationsController.cs
index 5afe09584ecb..aa5efd12cb48 100644
--- a/src/Api/AdminConsole/Controllers/OrganizationsController.cs
+++ b/src/Api/AdminConsole/Controllers/OrganizationsController.cs
@@ -11,6 +11,8 @@
 using Bit.Api.Models.Request.Organizations;
 using Bit.Api.Models.Response;
 using Bit.Core;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Repositories;
 using Bit.Core.Auth.Services;
@@ -19,7 +21,6 @@
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.Data.Organizations.Policies;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
 using Bit.Core.OrganizationFeatures.OrganizationLicenses.Interfaces;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
 using Bit.Core.Repositories;
@@ -319,8 +320,16 @@ public async Task<PaymentResponseModel> PostUpgrade(string id, [FromBody] Organi
             throw new NotFoundException();
         }
 
-        var result = await _upgradeOrganizationPlanCommand.UpgradePlanAsync(orgIdGuid, model.ToOrganizationUpgrade());
-        return new PaymentResponseModel { Success = result.Item1, PaymentIntentClientSecret = result.Item2 };
+        var (success, paymentIntentClientSecret) = await _upgradeOrganizationPlanCommand.UpgradePlanAsync(orgIdGuid, model.ToOrganizationUpgrade());
+
+        if (model.UseSecretsManager && success)
+        {
+            var userId = _userService.GetProperUserId(User).Value;
+
+            await TryGrantOwnerAccessToSecretsManagerAsync(orgIdGuid, userId);
+        }
+
+        return new PaymentResponseModel { Success = success, PaymentIntentClientSecret = paymentIntentClientSecret };
     }
 
     [HttpPost("{id}/subscription")]
@@ -373,6 +382,9 @@ await _addSecretsManagerSubscriptionCommand.SignUpAsync(organization, model.Addi
             model.AdditionalServiceAccounts);
 
         var userId = _userService.GetProperUserId(User).Value;
+
+        await TryGrantOwnerAccessToSecretsManagerAsync(organization.Id, userId);
+
         var organizationDetails = await _organizationUserRepository.GetDetailsByUserAsync(userId, organization.Id,
             OrganizationUserStatusType.Confirmed);
 
@@ -785,4 +797,15 @@ public async Task<OrganizationResponseModel> PutCollectionManagement(Guid id, [F
         await _organizationService.UpdateAsync(model.ToOrganization(organization), eventType: EventType.Organization_CollectionManagement_Updated);
         return new OrganizationResponseModel(organization);
     }
+
+    private async Task TryGrantOwnerAccessToSecretsManagerAsync(Guid organizationId, Guid userId)
+    {
+        var organizationUser = await _organizationUserRepository.GetByOrganizationAsync(organizationId, userId);
+
+        if (organizationUser != null)
+        {
+            organizationUser.AccessSecretsManager = true;
+            await _organizationUserRepository.ReplaceAsync(organizationUser);
+        }
+    }
 }
diff --git a/src/Api/AdminConsole/Controllers/PoliciesController.cs b/src/Api/AdminConsole/Controllers/PoliciesController.cs
index 6f93c22def17..60257814e93f 100644
--- a/src/Api/AdminConsole/Controllers/PoliciesController.cs
+++ b/src/Api/AdminConsole/Controllers/PoliciesController.cs
@@ -1,5 +1,6 @@
 using Bit.Api.AdminConsole.Models.Request;
 using Bit.Api.Models.Response;
+using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Context;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -7,6 +8,7 @@
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
+using Bit.Core.Tokens;
 using Bit.Core.Utilities;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.DataProtection;
@@ -26,6 +28,7 @@ public class PoliciesController : Controller
     private readonly ICurrentContext _currentContext;
     private readonly GlobalSettings _globalSettings;
     private readonly IDataProtector _organizationServiceDataProtector;
+    private readonly IDataProtectorTokenFactory<OrgUserInviteTokenable> _orgUserInviteTokenDataFactory;
 
     public PoliciesController(
         IPolicyRepository policyRepository,
@@ -35,7 +38,8 @@ public PoliciesController(
         IUserService userService,
         ICurrentContext currentContext,
         GlobalSettings globalSettings,
-        IDataProtectionProvider dataProtectionProvider)
+        IDataProtectionProvider dataProtectionProvider,
+        IDataProtectorTokenFactory<OrgUserInviteTokenable> orgUserInviteTokenDataFactory)
     {
         _policyRepository = policyRepository;
         _policyService = policyService;
@@ -46,6 +50,8 @@ public PoliciesController(
         _globalSettings = globalSettings;
         _organizationServiceDataProtector = dataProtectionProvider.CreateProtector(
             "OrganizationServiceDataProtector");
+
+        _orgUserInviteTokenDataFactory = orgUserInviteTokenDataFactory;
     }
 
     [HttpGet("{type}")]
@@ -81,41 +87,46 @@ public async Task<ListResponseModel<PolicyResponseModel>> Get(string orgId)
 
     [AllowAnonymous]
     [HttpGet("token")]
-    public async Task<ListResponseModel<PolicyResponseModel>> GetByToken(string orgId, [FromQuery] string email,
-        [FromQuery] string token, [FromQuery] string organizationUserId)
+    public async Task<ListResponseModel<PolicyResponseModel>> GetByToken(Guid orgId, [FromQuery] string email,
+        [FromQuery] string token, [FromQuery] Guid organizationUserId)
     {
-        var orgUserId = new Guid(organizationUserId);
-        var tokenValid = CoreHelpers.UserInviteTokenIsValid(_organizationServiceDataProtector, token,
-            email, orgUserId, _globalSettings);
+        // TODO: PM-4142 - remove old token validation logic once 3 releases of backwards compatibility are complete
+        var newTokenValid = OrgUserInviteTokenable.ValidateOrgUserInviteStringToken(
+            _orgUserInviteTokenDataFactory, token, organizationUserId, email);
+
+        var tokenValid = newTokenValid || CoreHelpers.UserInviteTokenIsValid(
+            _organizationServiceDataProtector, token, email, organizationUserId, _globalSettings
+        );
+
         if (!tokenValid)
         {
             throw new NotFoundException();
         }
 
-        var orgIdGuid = new Guid(orgId);
-        var orgUser = await _organizationUserRepository.GetByIdAsync(orgUserId);
-        if (orgUser == null || orgUser.OrganizationId != orgIdGuid)
+        var orgUser = await _organizationUserRepository.GetByIdAsync(organizationUserId);
+        if (orgUser == null || orgUser.OrganizationId != orgId)
         {
             throw new NotFoundException();
         }
 
-        var policies = await _policyRepository.GetManyByOrganizationIdAsync(orgIdGuid);
+        var policies = await _policyRepository.GetManyByOrganizationIdAsync(orgId);
         var responses = policies.Where(p => p.Enabled).Select(p => new PolicyResponseModel(p));
         return new ListResponseModel<PolicyResponseModel>(responses);
     }
 
+    // TODO: PM-4097 - remove GetByInvitedUser once all clients are updated to use the GetMasterPasswordPolicy endpoint below
+    [Obsolete("Deprecated API", false)]
     [AllowAnonymous]
     [HttpGet("invited-user")]
-    public async Task<ListResponseModel<PolicyResponseModel>> GetByInvitedUser(string orgId, [FromQuery] string userId)
+    public async Task<ListResponseModel<PolicyResponseModel>> GetByInvitedUser(Guid orgId, [FromQuery] Guid userId)
     {
-        var user = await _userService.GetUserByIdAsync(new Guid(userId));
+        var user = await _userService.GetUserByIdAsync(userId);
         if (user == null)
         {
             throw new UnauthorizedAccessException();
         }
-        var orgIdGuid = new Guid(orgId);
         var orgUsersByUserId = await _organizationUserRepository.GetManyByUserAsync(user.Id);
-        var orgUser = orgUsersByUserId.SingleOrDefault(u => u.OrganizationId == orgIdGuid);
+        var orgUser = orgUsersByUserId.SingleOrDefault(u => u.OrganizationId == orgId);
         if (orgUser == null)
         {
             throw new NotFoundException();
@@ -125,11 +136,33 @@ public async Task<ListResponseModel<PolicyResponseModel>> GetByInvitedUser(strin
             throw new UnauthorizedAccessException();
         }
 
-        var policies = await _policyRepository.GetManyByOrganizationIdAsync(orgIdGuid);
+        var policies = await _policyRepository.GetManyByOrganizationIdAsync(orgId);
         var responses = policies.Where(p => p.Enabled).Select(p => new PolicyResponseModel(p));
         return new ListResponseModel<PolicyResponseModel>(responses);
     }
 
+    [HttpGet("master-password")]
+    public async Task<PolicyResponseModel> GetMasterPasswordPolicy(Guid orgId)
+    {
+        var userId = _userService.GetProperUserId(User).Value;
+
+        var orgUser = await _organizationUserRepository.GetByOrganizationAsync(orgId, userId);
+
+        if (orgUser == null)
+        {
+            throw new NotFoundException();
+        }
+
+        var policy = await _policyRepository.GetByOrganizationIdTypeAsync(orgId, PolicyType.MasterPassword);
+
+        if (policy == null || !policy.Enabled)
+        {
+            throw new NotFoundException();
+        }
+
+        return new PolicyResponseModel(policy);
+    }
+
     [HttpPut("{type}")]
     public async Task<PolicyResponseModel> Put(string orgId, int type, [FromBody] PolicyRequestModel model)
     {
diff --git a/src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs b/src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs
index 1420311d4ba4..4d734e7cad3c 100644
--- a/src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs
+++ b/src/Api/AdminConsole/Controllers/ProviderOrganizationsController.cs
@@ -1,9 +1,10 @@
 using Bit.Api.AdminConsole.Models.Request.Providers;
 using Bit.Api.AdminConsole.Models.Response.Providers;
 using Bit.Api.Models.Response;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Services;
 using Bit.Core.Context;
 using Bit.Core.Exceptions;
-using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Microsoft.AspNetCore.Authorization;
diff --git a/src/Api/AdminConsole/Controllers/ProviderUsersController.cs b/src/Api/AdminConsole/Controllers/ProviderUsersController.cs
index c955e062fa67..73639bb1a429 100644
--- a/src/Api/AdminConsole/Controllers/ProviderUsersController.cs
+++ b/src/Api/AdminConsole/Controllers/ProviderUsersController.cs
@@ -1,10 +1,11 @@
 using Bit.Api.AdminConsole.Models.Request.Providers;
 using Bit.Api.AdminConsole.Models.Response.Providers;
 using Bit.Api.Models.Response;
+using Bit.Core.AdminConsole.Models.Business.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Services;
 using Bit.Core.Context;
 using Bit.Core.Exceptions;
-using Bit.Core.Models.Business.Provider;
-using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
diff --git a/src/Api/AdminConsole/Controllers/ProvidersController.cs b/src/Api/AdminConsole/Controllers/ProvidersController.cs
index b61a6d419861..cd39a90a840e 100644
--- a/src/Api/AdminConsole/Controllers/ProvidersController.cs
+++ b/src/Api/AdminConsole/Controllers/ProvidersController.cs
@@ -1,8 +1,9 @@
 using Bit.Api.AdminConsole.Models.Request.Providers;
 using Bit.Api.AdminConsole.Models.Response.Providers;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.AdminConsole.Services;
 using Bit.Core.Context;
 using Bit.Core.Exceptions;
-using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
 using Microsoft.AspNetCore.Authorization;
diff --git a/src/Api/Auth/Models/Request/AdminAuthRequestUpdateRequestModel.cs b/src/Api/AdminConsole/Models/Request/AdminAuthRequestUpdateRequestModel.cs
similarity index 84%
rename from src/Api/Auth/Models/Request/AdminAuthRequestUpdateRequestModel.cs
rename to src/Api/AdminConsole/Models/Request/AdminAuthRequestUpdateRequestModel.cs
index ebf9144c19d8..abcc6fdb7429 100644
--- a/src/Api/Auth/Models/Request/AdminAuthRequestUpdateRequestModel.cs
+++ b/src/Api/AdminConsole/Models/Request/AdminAuthRequestUpdateRequestModel.cs
@@ -1,7 +1,7 @@
 using System.ComponentModel.DataAnnotations;
 using Bit.Core.Utilities;
 
-namespace Bit.Api.Auth.Models.Request;
+namespace Bit.Api.AdminConsole.Models.Request;
 
 public class AdminAuthRequestUpdateRequestModel
 {
diff --git a/src/Api/Auth/Models/Request/BulkDenyAdminAuthRequestRequestModel.cs b/src/Api/AdminConsole/Models/Request/BulkDenyAdminAuthRequestRequestModel.cs
similarity index 67%
rename from src/Api/Auth/Models/Request/BulkDenyAdminAuthRequestRequestModel.cs
rename to src/Api/AdminConsole/Models/Request/BulkDenyAdminAuthRequestRequestModel.cs
index ff5e38948a20..24386341a3da 100644
--- a/src/Api/Auth/Models/Request/BulkDenyAdminAuthRequestRequestModel.cs
+++ b/src/Api/AdminConsole/Models/Request/BulkDenyAdminAuthRequestRequestModel.cs
@@ -1,4 +1,4 @@
-namespace Bit.Api.Auth.Models.Request;
+namespace Bit.Api.AdminConsole.Models.Request;
 
 public class BulkDenyAdminAuthRequestRequestModel
 {
diff --git a/src/Api/Models/Request/OrganizationDomainRequestModel.cs b/src/Api/AdminConsole/Models/Request/OrganizationDomainRequestModel.cs
similarity index 81%
rename from src/Api/Models/Request/OrganizationDomainRequestModel.cs
rename to src/Api/AdminConsole/Models/Request/OrganizationDomainRequestModel.cs
index 28786bf58691..c34c01783472 100644
--- a/src/Api/Models/Request/OrganizationDomainRequestModel.cs
+++ b/src/Api/AdminConsole/Models/Request/OrganizationDomainRequestModel.cs
@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 
-namespace Bit.Api.Models.Request;
+namespace Bit.Api.AdminConsole.Models.Request;
 
 public class OrganizationDomainRequestModel
 {
diff --git a/src/Api/Models/Request/Organizations/OrganizationConnectionRequestModel.cs b/src/Api/AdminConsole/Models/Request/Organizations/OrganizationConnectionRequestModel.cs
similarity index 95%
rename from src/Api/Models/Request/Organizations/OrganizationConnectionRequestModel.cs
rename to src/Api/AdminConsole/Models/Request/Organizations/OrganizationConnectionRequestModel.cs
index 96a444c27a50..1883d34afbbc 100644
--- a/src/Api/Models/Request/Organizations/OrganizationConnectionRequestModel.cs
+++ b/src/Api/AdminConsole/Models/Request/Organizations/OrganizationConnectionRequestModel.cs
@@ -5,7 +5,7 @@
 using Bit.Core.Models.OrganizationConnectionConfigs;
 using Bit.Core.Utilities;
 
-namespace Bit.Api.Models.Request.Organizations;
+namespace Bit.Api.AdminConsole.Models.Request.Organizations;
 
 public class OrganizationConnectionRequestModel
 {
diff --git a/src/Api/Models/Request/Organizations/OrganizationDomainSsoDetailsRequestModel.cs b/src/Api/AdminConsole/Models/Request/Organizations/OrganizationDomainSsoDetailsRequestModel.cs
similarity index 74%
rename from src/Api/Models/Request/Organizations/OrganizationDomainSsoDetailsRequestModel.cs
rename to src/Api/AdminConsole/Models/Request/Organizations/OrganizationDomainSsoDetailsRequestModel.cs
index 9f9db5b34a2f..c5129c6ec79a 100644
--- a/src/Api/Models/Request/Organizations/OrganizationDomainSsoDetailsRequestModel.cs
+++ b/src/Api/AdminConsole/Models/Request/Organizations/OrganizationDomainSsoDetailsRequestModel.cs
@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 
-namespace Bit.Api.Models.Request.Organizations;
+namespace Bit.Api.AdminConsole.Models.Request.Organizations;
 
 public class OrganizationDomainSsoDetailsRequestModel
 {
diff --git a/src/Api/AdminConsole/Models/Request/Providers/ProviderSetupRequestModel.cs b/src/Api/AdminConsole/Models/Request/Providers/ProviderSetupRequestModel.cs
index 2c5e4c65bb39..e091a55632e5 100644
--- a/src/Api/AdminConsole/Models/Request/Providers/ProviderSetupRequestModel.cs
+++ b/src/Api/AdminConsole/Models/Request/Providers/ProviderSetupRequestModel.cs
@@ -1,5 +1,5 @@
 using System.ComponentModel.DataAnnotations;
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
 
 namespace Bit.Api.AdminConsole.Models.Request.Providers;
 
diff --git a/src/Api/AdminConsole/Models/Request/Providers/ProviderUpdateRequestModel.cs b/src/Api/AdminConsole/Models/Request/Providers/ProviderUpdateRequestModel.cs
index 58b4fc0f5149..90bdb1e048a9 100644
--- a/src/Api/AdminConsole/Models/Request/Providers/ProviderUpdateRequestModel.cs
+++ b/src/Api/AdminConsole/Models/Request/Providers/ProviderUpdateRequestModel.cs
@@ -1,5 +1,5 @@
 using System.ComponentModel.DataAnnotations;
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.Settings;
 
 namespace Bit.Api.AdminConsole.Models.Request.Providers;
diff --git a/src/Api/AdminConsole/Models/Request/Providers/ProviderUserRequestModels.cs b/src/Api/AdminConsole/Models/Request/Providers/ProviderUserRequestModels.cs
index ec112edc4ad7..dd225309164f 100644
--- a/src/Api/AdminConsole/Models/Request/Providers/ProviderUserRequestModels.cs
+++ b/src/Api/AdminConsole/Models/Request/Providers/ProviderUserRequestModels.cs
@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.Utilities;
 
 namespace Bit.Api.AdminConsole.Models.Request.Providers;
diff --git a/src/Api/Models/Response/Organizations/OrganizationConnectionResponseModel.cs b/src/Api/AdminConsole/Models/Response/Organizations/OrganizationConnectionResponseModel.cs
similarity index 92%
rename from src/Api/Models/Response/Organizations/OrganizationConnectionResponseModel.cs
rename to src/Api/AdminConsole/Models/Response/Organizations/OrganizationConnectionResponseModel.cs
index f199ce56c233..fa6bdc1f3d75 100644
--- a/src/Api/Models/Response/Organizations/OrganizationConnectionResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/Organizations/OrganizationConnectionResponseModel.cs
@@ -2,7 +2,7 @@
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 
-namespace Bit.Api.Models.Response.Organizations;
+namespace Bit.Api.AdminConsole.Models.Response.Organizations;
 
 public class OrganizationConnectionResponseModel
 {
diff --git a/src/Api/Models/Response/Organizations/OrganizationDomainResponseModel.cs b/src/Api/AdminConsole/Models/Response/Organizations/OrganizationDomainResponseModel.cs
similarity index 95%
rename from src/Api/Models/Response/Organizations/OrganizationDomainResponseModel.cs
rename to src/Api/AdminConsole/Models/Response/Organizations/OrganizationDomainResponseModel.cs
index 636f6d32de3d..efba3a4573a5 100644
--- a/src/Api/Models/Response/Organizations/OrganizationDomainResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/Organizations/OrganizationDomainResponseModel.cs
@@ -1,7 +1,7 @@
 using Bit.Core.Entities;
 using Bit.Core.Models.Api;
 
-namespace Bit.Api.Models.Response.Organizations;
+namespace Bit.Api.AdminConsole.Models.Response.Organizations;
 
 public class OrganizationDomainResponseModel : ResponseModel
 {
diff --git a/src/Api/Models/Response/Organizations/OrganizationDomainSsoDetailsResponseModel.cs b/src/Api/AdminConsole/Models/Response/Organizations/OrganizationDomainSsoDetailsResponseModel.cs
similarity index 93%
rename from src/Api/Models/Response/Organizations/OrganizationDomainSsoDetailsResponseModel.cs
rename to src/Api/AdminConsole/Models/Response/Organizations/OrganizationDomainSsoDetailsResponseModel.cs
index d995cc5f8dc9..0b232010a1e2 100644
--- a/src/Api/Models/Response/Organizations/OrganizationDomainSsoDetailsResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/Organizations/OrganizationDomainSsoDetailsResponseModel.cs
@@ -1,7 +1,7 @@
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Data.Organizations;
 
-namespace Bit.Api.Models.Response.Organizations;
+namespace Bit.Api.AdminConsole.Models.Response.Organizations;
 
 public class OrganizationDomainSsoDetailsResponseModel : ResponseModel
 {
diff --git a/src/Api/Auth/Models/Response/PendingOrganizationAuthRequestResponseModel.cs b/src/Api/AdminConsole/Models/Response/PendingOrganizationAuthRequestResponseModel.cs
similarity index 96%
rename from src/Api/Auth/Models/Response/PendingOrganizationAuthRequestResponseModel.cs
rename to src/Api/AdminConsole/Models/Response/PendingOrganizationAuthRequestResponseModel.cs
index 5257b49df5bb..1805bdb07eda 100644
--- a/src/Api/Auth/Models/Response/PendingOrganizationAuthRequestResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/PendingOrganizationAuthRequestResponseModel.cs
@@ -3,7 +3,7 @@
 using Bit.Core.Auth.Models.Data;
 using Bit.Core.Models.Api;
 
-namespace Bit.Api.Auth.Models.Response;
+namespace Bit.Api.AdminConsole.Models.Response;
 
 public class PendingOrganizationAuthRequestResponseModel : ResponseModel
 {
diff --git a/src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs b/src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs
index ce6ac21c022c..e0d1433c15be 100644
--- a/src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/ProfileOrganizationResponseModel.cs
@@ -1,7 +1,7 @@
-using Bit.Core.Auth.Enums;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models.Data;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
@@ -32,8 +32,7 @@ public ProfileOrganizationResponseModel(OrganizationUserOrganizationDetails orga
         UsePasswordManager = organization.UsePasswordManager;
         UsersGetPremium = organization.UsersGetPremium;
         UseCustomPermissions = organization.UseCustomPermissions;
-        UseActivateAutofillPolicy = organization.PlanType == PlanType.EnterpriseAnnually ||
-            organization.PlanType == PlanType.EnterpriseMonthly;
+        UseActivateAutofillPolicy = StaticStore.GetPlan(organization.PlanType).Product == ProductType.Enterprise;
         SelfHost = organization.SelfHost;
         Seats = organization.Seats;
         MaxCollections = organization.MaxCollections;
diff --git a/src/Api/AdminConsole/Models/Response/ProfileProviderOrganizationResponseModel.cs b/src/Api/AdminConsole/Models/Response/ProfileProviderOrganizationResponseModel.cs
index b79a32560104..d6b7656e4b8d 100644
--- a/src/Api/AdminConsole/Models/Response/ProfileProviderOrganizationResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/ProfileProviderOrganizationResponseModel.cs
@@ -1,4 +1,5 @@
-using Bit.Core.Enums;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Utilities;
 
@@ -24,8 +25,7 @@ public ProfileProviderOrganizationResponseModel(ProviderUserOrganizationDetails
         UseResetPassword = organization.UseResetPassword;
         UsersGetPremium = organization.UsersGetPremium;
         UseCustomPermissions = organization.UseCustomPermissions;
-        UseActivateAutofillPolicy = organization.PlanType == PlanType.EnterpriseAnnually ||
-            organization.PlanType == PlanType.EnterpriseMonthly;
+        UseActivateAutofillPolicy = StaticStore.GetPlan(organization.PlanType).Product == ProductType.Enterprise;
         SelfHost = organization.SelfHost;
         Seats = organization.Seats;
         MaxCollections = organization.MaxCollections;
diff --git a/src/Api/AdminConsole/Models/Response/Providers/ProfileProviderResponseModel.cs b/src/Api/AdminConsole/Models/Response/Providers/ProfileProviderResponseModel.cs
index ac725618b5e7..66e0acae0cdd 100644
--- a/src/Api/AdminConsole/Models/Response/Providers/ProfileProviderResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/Providers/ProfileProviderResponseModel.cs
@@ -1,4 +1,5 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Data;
 using Bit.Core.Utilities;
diff --git a/src/Api/AdminConsole/Models/Response/Providers/ProviderOrganizationResponseModel.cs b/src/Api/AdminConsole/Models/Response/Providers/ProviderOrganizationResponseModel.cs
index a2e9d9f4a233..da56d49ce864 100644
--- a/src/Api/AdminConsole/Models/Response/Providers/ProviderOrganizationResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/Providers/ProviderOrganizationResponseModel.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 using Bit.Core.Models.Api;
-using Bit.Core.Models.Data;
 
 namespace Bit.Api.AdminConsole.Models.Response.Providers;
 
diff --git a/src/Api/AdminConsole/Models/Response/Providers/ProviderResponseModel.cs b/src/Api/AdminConsole/Models/Response/Providers/ProviderResponseModel.cs
index 5e26d1d4be0b..bc55093a03bd 100644
--- a/src/Api/AdminConsole/Models/Response/Providers/ProviderResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/Providers/ProviderResponseModel.cs
@@ -1,4 +1,4 @@
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.Models.Api;
 
 namespace Bit.Api.AdminConsole.Models.Response.Providers;
diff --git a/src/Api/AdminConsole/Models/Response/Providers/ProviderUserResponseModel.cs b/src/Api/AdminConsole/Models/Response/Providers/ProviderUserResponseModel.cs
index 10080228856e..1eaeb8e0bd9e 100644
--- a/src/Api/AdminConsole/Models/Response/Providers/ProviderUserResponseModel.cs
+++ b/src/Api/AdminConsole/Models/Response/Providers/ProviderUserResponseModel.cs
@@ -1,5 +1,6 @@
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Data;
 using Bit.Core.Utilities;
diff --git a/src/Api/AdminConsole/Public/Controllers/MembersController.cs b/src/Api/AdminConsole/Public/Controllers/MembersController.cs
index 52cf952f7beb..9c862f52026d 100644
--- a/src/Api/AdminConsole/Public/Controllers/MembersController.cs
+++ b/src/Api/AdminConsole/Public/Controllers/MembersController.cs
@@ -2,10 +2,10 @@
 using Bit.Api.AdminConsole.Public.Models.Request;
 using Bit.Api.AdminConsole.Public.Models.Response;
 using Bit.Api.Models.Public.Response;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Models.Business;
-using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Microsoft.AspNetCore.Authorization;
diff --git a/src/Api/Auth/Controllers/WebAuthnController.cs b/src/Api/Auth/Controllers/WebAuthnController.cs
new file mode 100644
index 000000000000..908915662dc4
--- /dev/null
+++ b/src/Api/Auth/Controllers/WebAuthnController.cs
@@ -0,0 +1,129 @@
+using Bit.Api.Auth.Models.Request.Accounts;
+using Bit.Api.Auth.Models.Request.Webauthn;
+using Bit.Api.Auth.Models.Response.WebAuthn;
+using Bit.Api.Models.Response;
+using Bit.Core;
+using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Auth.Repositories;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.Services;
+using Bit.Core.Tokens;
+using Bit.Core.Utilities;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+
+namespace Bit.Api.Auth.Controllers;
+
+[Route("webauthn")]
+[Authorize("Web")]
+[RequireFeature(FeatureFlagKeys.PasswordlessLogin)]
+public class WebAuthnController : Controller
+{
+    private readonly IUserService _userService;
+    private readonly IWebAuthnCredentialRepository _credentialRepository;
+    private readonly IDataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable> _createOptionsDataProtector;
+    private readonly IPolicyService _policyService;
+
+    public WebAuthnController(
+        IUserService userService,
+        IWebAuthnCredentialRepository credentialRepository,
+        IDataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable> createOptionsDataProtector,
+        IPolicyService policyService)
+    {
+        _userService = userService;
+        _credentialRepository = credentialRepository;
+        _createOptionsDataProtector = createOptionsDataProtector;
+        _policyService = policyService;
+    }
+
+    [HttpGet("")]
+    public async Task<ListResponseModel<WebAuthnCredentialResponseModel>> Get()
+    {
+        var user = await GetUserAsync();
+        var credentials = await _credentialRepository.GetManyByUserIdAsync(user.Id);
+
+        return new ListResponseModel<WebAuthnCredentialResponseModel>(credentials.Select(c => new WebAuthnCredentialResponseModel(c)));
+    }
+
+    [HttpPost("options")]
+    public async Task<WebAuthnCredentialCreateOptionsResponseModel> PostOptions([FromBody] SecretVerificationRequestModel model)
+    {
+        var user = await VerifyUserAsync(model);
+        await ValidateRequireSsoPolicyDisabledOrNotApplicable(user.Id);
+        var options = await _userService.StartWebAuthnLoginRegistrationAsync(user);
+
+        var tokenable = new WebAuthnCredentialCreateOptionsTokenable(user, options);
+        var token = _createOptionsDataProtector.Protect(tokenable);
+
+        return new WebAuthnCredentialCreateOptionsResponseModel
+        {
+            Options = options,
+            Token = token
+        };
+    }
+
+    [HttpPost("")]
+    public async Task Post([FromBody] WebAuthnCredentialRequestModel model)
+    {
+        var user = await GetUserAsync();
+        await ValidateRequireSsoPolicyDisabledOrNotApplicable(user.Id);
+        var tokenable = _createOptionsDataProtector.Unprotect(model.Token);
+
+        if (!tokenable.TokenIsValid(user))
+        {
+            throw new BadRequestException("The token associated with your request is expired. A valid token is required to continue.");
+        }
+
+        var success = await _userService.CompleteWebAuthLoginRegistrationAsync(user, model.Name, tokenable.Options, model.DeviceResponse);
+        if (!success)
+        {
+            throw new BadRequestException("Unable to complete WebAuthn registration.");
+        }
+    }
+
+    private async Task ValidateRequireSsoPolicyDisabledOrNotApplicable(Guid userId)
+    {
+        var requireSsoLogin = await _policyService.AnyPoliciesApplicableToUserAsync(userId, PolicyType.RequireSso);
+
+        if (requireSsoLogin)
+        {
+            throw new BadRequestException("Passkeys cannot be created for your account. SSO login is required.");
+        }
+    }
+
+    [HttpPost("{id}/delete")]
+    public async Task Delete(Guid id, [FromBody] SecretVerificationRequestModel model)
+    {
+        var user = await VerifyUserAsync(model);
+        var credential = await _credentialRepository.GetByIdAsync(id, user.Id);
+        if (credential == null)
+        {
+            throw new NotFoundException("Credential not found.");
+        }
+
+        await _credentialRepository.DeleteAsync(credential);
+    }
+
+    private async Task<Core.Entities.User> GetUserAsync()
+    {
+        var user = await _userService.GetUserByPrincipalAsync(User);
+        if (user == null)
+        {
+            throw new UnauthorizedAccessException();
+        }
+        return user;
+    }
+
+    private async Task<Core.Entities.User> VerifyUserAsync(SecretVerificationRequestModel model)
+    {
+        var user = await GetUserAsync();
+        if (!await _userService.VerifySecretAsync(user, model.Secret))
+        {
+            await Task.Delay(Constants.FailedSecretVerificationDelay);
+            throw new BadRequestException(string.Empty, "User verification failed.");
+        }
+
+        return user;
+    }
+}
diff --git a/src/Api/Auth/Models/Request/Accounts/SetPasswordRequestModel.cs b/src/Api/Auth/Models/Request/Accounts/SetPasswordRequestModel.cs
index 9c078d7b289d..6339725cd929 100644
--- a/src/Api/Auth/Models/Request/Accounts/SetPasswordRequestModel.cs
+++ b/src/Api/Auth/Models/Request/Accounts/SetPasswordRequestModel.cs
@@ -1,4 +1,6 @@
-using System.ComponentModel.DataAnnotations;
+#nullable enable
+
+using System.ComponentModel.DataAnnotations;
 using Bit.Core.Auth.Models.Api.Request.Accounts;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
@@ -15,8 +17,7 @@ public class SetPasswordRequestModel : IValidatableObject
     public string Key { get; set; }
     [StringLength(50)]
     public string MasterPasswordHint { get; set; }
-    [Required]
-    public KeysRequestModel Keys { get; set; }
+    public KeysRequestModel? Keys { get; set; }
     [Required]
     public KdfType Kdf { get; set; }
     [Required]
@@ -33,7 +34,7 @@ public User ToUser(User existingUser)
         existingUser.KdfMemory = KdfMemory;
         existingUser.KdfParallelism = KdfParallelism;
         existingUser.Key = Key;
-        Keys.ToUser(existingUser);
+        Keys?.ToUser(existingUser);
         return existingUser;
     }
 
diff --git a/src/Api/Auth/Models/Request/WebAuthn/WebAuthnCredentialRequestModel.cs b/src/Api/Auth/Models/Request/WebAuthn/WebAuthnCredentialRequestModel.cs
new file mode 100644
index 000000000000..8f16fe7f5065
--- /dev/null
+++ b/src/Api/Auth/Models/Request/WebAuthn/WebAuthnCredentialRequestModel.cs
@@ -0,0 +1,17 @@
+using System.ComponentModel.DataAnnotations;
+using Fido2NetLib;
+
+namespace Bit.Api.Auth.Models.Request.Webauthn;
+
+public class WebAuthnCredentialRequestModel
+{
+    [Required]
+    public AuthenticatorAttestationRawResponse DeviceResponse { get; set; }
+
+    [Required]
+    public string Name { get; set; }
+
+    [Required]
+    public string Token { get; set; }
+}
+
diff --git a/src/Api/Auth/Models/Response/WebAuthn/WebAuthnCredentialCreateOptionsResponseModel.cs b/src/Api/Auth/Models/Response/WebAuthn/WebAuthnCredentialCreateOptionsResponseModel.cs
new file mode 100644
index 000000000000..d521bdac960b
--- /dev/null
+++ b/src/Api/Auth/Models/Response/WebAuthn/WebAuthnCredentialCreateOptionsResponseModel.cs
@@ -0,0 +1,16 @@
+using Bit.Core.Models.Api;
+using Fido2NetLib;
+
+namespace Bit.Api.Auth.Models.Response.WebAuthn;
+
+public class WebAuthnCredentialCreateOptionsResponseModel : ResponseModel
+{
+    private const string ResponseObj = "webauthnCredentialCreateOptions";
+
+    public WebAuthnCredentialCreateOptionsResponseModel() : base(ResponseObj)
+    {
+    }
+
+    public CredentialCreateOptions Options { get; set; }
+    public string Token { get; set; }
+}
diff --git a/src/Api/Auth/Models/Response/WebAuthn/WebAuthnCredentialResponseModel.cs b/src/Api/Auth/Models/Response/WebAuthn/WebAuthnCredentialResponseModel.cs
new file mode 100644
index 000000000000..0e358c751d32
--- /dev/null
+++ b/src/Api/Auth/Models/Response/WebAuthn/WebAuthnCredentialResponseModel.cs
@@ -0,0 +1,20 @@
+using Bit.Core.Auth.Entities;
+using Bit.Core.Models.Api;
+
+namespace Bit.Api.Auth.Models.Response.WebAuthn;
+
+public class WebAuthnCredentialResponseModel : ResponseModel
+{
+    private const string ResponseObj = "webauthnCredential";
+
+    public WebAuthnCredentialResponseModel(WebAuthnCredential credential) : base(ResponseObj)
+    {
+        Id = credential.Id.ToString();
+        Name = credential.Name;
+        PrfSupport = false;
+    }
+
+    public string Id { get; set; }
+    public string Name { get; set; }
+    public bool PrfSupport { get; set; }
+}
diff --git a/src/Api/Controllers/AccountsController.cs b/src/Api/Controllers/AccountsController.cs
index 7c36838461f3..8be36522abc6 100644
--- a/src/Api/Controllers/AccountsController.cs
+++ b/src/Api/Controllers/AccountsController.cs
@@ -5,12 +5,14 @@
 using Bit.Api.Models.Response;
 using Bit.Api.Utilities;
 using Bit.Core;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Auth.Models.Api.Request.Accounts;
 using Bit.Core.Auth.Models.Api.Response.Accounts;
 using Bit.Core.Auth.Services;
+using Bit.Core.Auth.UserFeatures.UserMasterPassword.Interfaces;
 using Bit.Core.Auth.Utilities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Api.Response;
 using Bit.Core.Models.Business;
@@ -46,6 +48,8 @@ public class AccountsController : Controller
     private readonly ISendService _sendService;
     private readonly ICaptchaValidationService _captchaValidationService;
     private readonly IPolicyService _policyService;
+    private readonly ISetInitialMasterPasswordCommand _setInitialMasterPasswordCommand;
+
 
     public AccountsController(
         GlobalSettings globalSettings,
@@ -60,7 +64,9 @@ public AccountsController(
         ISendRepository sendRepository,
         ISendService sendService,
         ICaptchaValidationService captchaValidationService,
-        IPolicyService policyService)
+        IPolicyService policyService,
+        ISetInitialMasterPasswordCommand setInitialMasterPasswordCommand
+        )
     {
         _cipherRepository = cipherRepository;
         _folderRepository = folderRepository;
@@ -75,6 +81,7 @@ public AccountsController(
         _sendService = sendService;
         _captchaValidationService = captchaValidationService;
         _policyService = policyService;
+        _setInitialMasterPasswordCommand = setInitialMasterPasswordCommand;
     }
 
     #region DEPRECATED (Moved to Identity Service)
@@ -252,8 +259,12 @@ public async Task PostSetPasswordAsync([FromBody] SetPasswordRequestModel model)
             throw new UnauthorizedAccessException();
         }
 
-        var result = await _userService.SetPasswordAsync(model.ToUser(user), model.MasterPasswordHash, model.Key,
+        var result = await _setInitialMasterPasswordCommand.SetInitialMasterPasswordAsync(
+            model.ToUser(user),
+            model.MasterPasswordHash,
+            model.Key,
             model.OrgIdentifier);
+
         if (result.Succeeded)
         {
             return;
@@ -455,8 +466,13 @@ public async Task<ProfileResponseModel> GetProfile()
         var providerUserOrganizationDetails =
             await _providerUserRepository.GetManyOrganizationDetailsByUserAsync(user.Id,
                 ProviderUserStatusType.Confirmed);
+
+        var twoFactorEnabled = await _userService.TwoFactorIsEnabledAsync(user);
+        var hasPremiumFromOrg = await _userService.HasPremiumFromOrganization(user);
+
         var response = new ProfileResponseModel(user, organizationUserDetails, providerUserDetails,
-            providerUserOrganizationDetails, await _userService.TwoFactorIsEnabledAsync(user), await _userService.HasPremiumFromOrganization(user));
+            providerUserOrganizationDetails, twoFactorEnabled,
+            hasPremiumFromOrg);
         return response;
     }
 
diff --git a/src/Api/Controllers/EventsController.cs b/src/Api/Controllers/EventsController.cs
index 4cf3b83dc5ac..921ee844004a 100644
--- a/src/Api/Controllers/EventsController.cs
+++ b/src/Api/Controllers/EventsController.cs
@@ -1,5 +1,6 @@
 using Bit.Api.Models.Response;
 using Bit.Api.Utilities;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Data;
diff --git a/src/Api/Controllers/LicensesController.cs b/src/Api/Controllers/LicensesController.cs
index f5391fddc2e1..1c0058920109 100644
--- a/src/Api/Controllers/LicensesController.cs
+++ b/src/Api/Controllers/LicensesController.cs
@@ -1,8 +1,8 @@
-using Bit.Core.Context;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
+using Bit.Core.Context;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Api.OrganizationLicenses;
 using Bit.Core.Models.Business;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.OrganizationFeatures.OrganizationLicenses.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
diff --git a/src/Api/Controllers/OrganizationSponsorshipsController.cs b/src/Api/Controllers/OrganizationSponsorshipsController.cs
index d9715d07c382..c24c981014a7 100644
--- a/src/Api/Controllers/OrganizationSponsorshipsController.cs
+++ b/src/Api/Controllers/OrganizationSponsorshipsController.cs
@@ -1,11 +1,11 @@
 using Bit.Api.Models.Request.Organizations;
 using Bit.Api.Models.Response.Organizations;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Api.Request.OrganizationSponsorships;
 using Bit.Core.Models.Api.Response.OrganizationSponsorships;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
diff --git a/src/Api/Controllers/PlansController.cs b/src/Api/Controllers/PlansController.cs
index d738e60cfb20..14992bd97b7b 100644
--- a/src/Api/Controllers/PlansController.cs
+++ b/src/Api/Controllers/PlansController.cs
@@ -1,5 +1,9 @@
 using Bit.Api.Models.Response;
+using Bit.Core;
+using Bit.Core.Context;
+using Bit.Core.Enums;
 using Bit.Core.Repositories;
+using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -11,17 +15,39 @@ namespace Bit.Api.Controllers;
 public class PlansController : Controller
 {
     private readonly ITaxRateRepository _taxRateRepository;
-    public PlansController(ITaxRateRepository taxRateRepository)
+    private readonly IFeatureService _featureService;
+    private readonly ICurrentContext _currentContext;
+
+    public PlansController(
+        ITaxRateRepository taxRateRepository,
+        IFeatureService featureService,
+        ICurrentContext currentContext)
     {
         _taxRateRepository = taxRateRepository;
+        _featureService = featureService;
+        _currentContext = currentContext;
     }
 
     [HttpGet("")]
     [AllowAnonymous]
     public ListResponseModel<PlanResponseModel> Get()
     {
+        var plansUpgradeIsEnabled = _featureService.IsEnabled(FeatureFlagKeys.BillingPlansUpgrade, _currentContext);
         var data = StaticStore.Plans;
-        var responses = data.Select(plan => new PlanResponseModel(plan));
+        var responses = data
+            .Where(plan => plansUpgradeIsEnabled || plan.Type <= PlanType.EnterpriseAnnually2020)
+            .Select(plan =>
+            {
+                if (!plansUpgradeIsEnabled && plan.Type is <= PlanType.EnterpriseAnnually2020 and >= PlanType.TeamsMonthly2020)
+                {
+                    plan.LegacyYear = null;
+                }
+                else if (plansUpgradeIsEnabled && plan.Type is <= PlanType.EnterpriseAnnually2020 and >= PlanType.TeamsMonthly2020)
+                {
+                    plan.LegacyYear = 2023;
+                }
+                return new PlanResponseModel(plan);
+            });
         return new ListResponseModel<PlanResponseModel>(responses);
     }
 
diff --git a/src/Api/Models/Response/ProfileResponseModel.cs b/src/Api/Models/Response/ProfileResponseModel.cs
index 312e7ed7e557..b5a32fa3267f 100644
--- a/src/Api/Models/Response/ProfileResponseModel.cs
+++ b/src/Api/Models/Response/ProfileResponseModel.cs
@@ -1,8 +1,8 @@
 using Bit.Api.AdminConsole.Models.Response;
 using Bit.Api.AdminConsole.Models.Response.Providers;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 using Bit.Core.Entities;
 using Bit.Core.Models.Api;
-using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 
 namespace Bit.Api.Models.Response;
diff --git a/src/Api/Tools/Controllers/ImportCiphersController.cs b/src/Api/Tools/Controllers/ImportCiphersController.cs
index d3ed7444f3b7..b480e9c5cbaa 100644
--- a/src/Api/Tools/Controllers/ImportCiphersController.cs
+++ b/src/Api/Tools/Controllers/ImportCiphersController.cs
@@ -5,7 +5,6 @@
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
-using Bit.Core.Utilities;
 using Bit.Core.Vault.Services;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
@@ -26,7 +25,6 @@ public ImportCiphersController(
         ICollectionCipherRepository collectionCipherRepository,
         ICipherService cipherService,
         IUserService userService,
-        IProviderService providerService,
         ICurrentContext currentContext,
         ILogger<ImportCiphersController> logger,
         GlobalSettings globalSettings)
diff --git a/src/Api/Vault/Controllers/CiphersController.cs b/src/Api/Vault/Controllers/CiphersController.cs
index 6a7de61f9d8f..ad0db8f6b3b5 100644
--- a/src/Api/Vault/Controllers/CiphersController.cs
+++ b/src/Api/Vault/Controllers/CiphersController.cs
@@ -6,6 +6,7 @@
 using Bit.Api.Vault.Models.Request;
 using Bit.Api.Vault.Models.Response;
 using Bit.Core;
+using Bit.Core.AdminConsole.Services;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
diff --git a/src/Api/Vault/Controllers/SyncController.cs b/src/Api/Vault/Controllers/SyncController.cs
index ec9ab4f96dd8..ac7ef9acdcdd 100644
--- a/src/Api/Vault/Controllers/SyncController.cs
+++ b/src/Api/Vault/Controllers/SyncController.cs
@@ -1,7 +1,8 @@
 using Bit.Api.Vault.Models.Response;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
@@ -70,6 +71,7 @@ public async Task<SyncResponseModel> Get([FromQuery] bool excludeDomains = false
             await _providerUserRepository.GetManyOrganizationDetailsByUserAsync(user.Id,
                 ProviderUserStatusType.Confirmed);
         var hasEnabledOrgs = organizationUserDetails.Any(o => o.Enabled);
+
         var folders = await _folderRepository.GetManyByUserIdAsync(user.Id);
         var ciphers = await _cipherRepository.GetManyByUserIdAsync(user.Id, hasEnabledOrgs);
         var sends = await _sendRepository.GetManyByUserIdAsync(user.Id);
diff --git a/src/Api/Vault/Models/Response/SyncResponseModel.cs b/src/Api/Vault/Models/Response/SyncResponseModel.cs
index 386b7445be74..817f233e1174 100644
--- a/src/Api/Vault/Models/Response/SyncResponseModel.cs
+++ b/src/Api/Vault/Models/Response/SyncResponseModel.cs
@@ -1,5 +1,6 @@
 using Bit.Api.Models.Response;
 using Bit.Api.Tools.Models.Response;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 using Bit.Core.Entities;
 using Bit.Core.Models.Api;
 using Bit.Core.Models.Api.Response;
diff --git a/src/Api/packages.lock.json b/src/Api/packages.lock.json
index 409ac010c21c..8d05794c4783 100644
--- a/src/Api/packages.lock.json
+++ b/src/Api/packages.lock.json
@@ -2772,15 +2772,15 @@
       "commercial.core": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )"
+          "Core": "[2023.10.1, )"
         }
       },
       "commercial.infrastructure.entityframework": {
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       },
       "core": {
@@ -2828,7 +2828,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2836,7 +2836,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2848,9 +2848,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/Billing/Controllers/FreshsalesController.cs b/src/Billing/Controllers/FreshsalesController.cs
index 95b9e2506511..a66edd6ca6bd 100644
--- a/src/Billing/Controllers/FreshsalesController.cs
+++ b/src/Billing/Controllers/FreshsalesController.cs
@@ -159,14 +159,18 @@ private static bool TryGetPlanName(PlanType planType, out string planName)
                 planName = "Families";
                 return true;
             case PlanType.TeamsAnnually:
+            case PlanType.TeamsAnnually2020:
             case PlanType.TeamsAnnually2019:
             case PlanType.TeamsMonthly:
+            case PlanType.TeamsMonthly2020:
             case PlanType.TeamsMonthly2019:
                 planName = "Teams";
                 return true;
             case PlanType.EnterpriseAnnually:
+            case PlanType.EnterpriseAnnually2020:
             case PlanType.EnterpriseAnnually2019:
             case PlanType.EnterpriseMonthly:
+            case PlanType.EnterpriseMonthly2020:
             case PlanType.EnterpriseMonthly2019:
                 planName = "Enterprise";
                 return true;
diff --git a/src/Billing/Controllers/StripeController.cs b/src/Billing/Controllers/StripeController.cs
index e71e025dffc5..64053b31f2c9 100644
--- a/src/Billing/Controllers/StripeController.cs
+++ b/src/Billing/Controllers/StripeController.cs
@@ -668,18 +668,7 @@ private async Task AttemptToPayOpenSubscriptionAsync(Subscription unpaidSubscrip
         return new Tuple<Guid?, Guid?>(orgId, userId);
     }
 
-    private bool OrgPlanForInvoiceNotifications(Organization org)
-    {
-        switch (org.PlanType)
-        {
-            case PlanType.FamiliesAnnually:
-            case PlanType.TeamsAnnually:
-            case PlanType.EnterpriseAnnually:
-                return true;
-            default:
-                return false;
-        }
-    }
+    private static bool OrgPlanForInvoiceNotifications(Organization org) => StaticStore.GetPlan(org.PlanType).IsAnnual;
 
     private async Task<bool> AttemptToPayInvoiceAsync(Invoice invoice, bool attemptToPayWithStripe = false)
     {
diff --git a/src/Billing/Utilities/PayPalIpnClient.cs b/src/Billing/Utilities/PayPalIpnClient.cs
index 1762f92a11fc..0534faf76c1b 100644
--- a/src/Billing/Utilities/PayPalIpnClient.cs
+++ b/src/Billing/Utilities/PayPalIpnClient.cs
@@ -15,9 +15,9 @@ public class PayPalIpnClient
     public PayPalIpnClient(IOptions<BillingSettings> billingSettings, ILogger<PayPalIpnClient> logger)
     {
         var bSettings = billingSettings?.Value;
-        _ipnUri = new Uri(bSettings.PayPal.Production ? "https://ipnpb.paypal.com/cgi-bin/webscr" :
-            "https://ipnpb.sandbox.paypal.com/cgi-bin/webscr");
         _logger = logger;
+        _ipnUri = new Uri(bSettings.PayPal.Production ? "https://www.paypal.com/cgi-bin/webscr" :
+            "https://www.sandbox.paypal.com/cgi-bin/webscr");
     }
 
     public async Task<bool> VerifyIpnAsync(string ipnBody)
@@ -29,19 +29,16 @@ public async Task<bool> VerifyIpnAsync(string ipnBody)
             throw new ArgumentException("No IPN body.");
         }
 
-        var request = new HttpRequestMessage
-        {
-            Method = HttpMethod.Post,
-            RequestUri = _ipnUri
-        };
-        _httpClient.DefaultRequestHeaders.Add("User-Agent", "CSharp-IPN-VerificationScript");
+        var request = new HttpRequestMessage { Method = HttpMethod.Post, RequestUri = _ipnUri };
         var cmdIpnBody = string.Concat("cmd=_notify-validate&", ipnBody);
         request.Content = new StringContent(cmdIpnBody, Encoding.UTF8, "application/x-www-form-urlencoded");
         var response = await _httpClient.SendAsync(request);
         if (!response.IsSuccessStatusCode)
         {
+            _logger.LogError("Failed to receive a successful response from PayPal IPN verification service. Response: {Response}", response);
             throw new Exception("Failed to verify IPN, status: " + response.StatusCode);
         }
+
         var responseContent = await response.Content.ReadAsStringAsync();
         if (responseContent.Equals("VERIFIED"))
         {
@@ -53,6 +50,7 @@ public async Task<bool> VerifyIpnAsync(string ipnBody)
             _logger.LogWarning("Received an INVALID response from PayPal: {ResponseContent}", responseContent);
             return false;
         }
+
         _logger.LogError("Failed to verify IPN: {ResponseContent}", responseContent);
         throw new Exception("Failed to verify IPN.");
     }
diff --git a/src/Billing/packages.lock.json b/src/Billing/packages.lock.json
index 16a42f355d3f..722ede68b886 100644
--- a/src/Billing/packages.lock.json
+++ b/src/Billing/packages.lock.json
@@ -2631,7 +2631,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2639,7 +2639,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2651,9 +2651,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/Core/Context/CurrentContextProvider.cs b/src/Core/AdminConsole/Context/CurrentContextProvider.cs
similarity index 79%
rename from src/Core/Context/CurrentContextProvider.cs
rename to src/Core/AdminConsole/Context/CurrentContextProvider.cs
index 57792840cc4f..78a5565e80ca 100644
--- a/src/Core/Context/CurrentContextProvider.cs
+++ b/src/Core/AdminConsole/Context/CurrentContextProvider.cs
@@ -1,9 +1,9 @@
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.Models.Data;
 using Bit.Core.Utilities;
 
-namespace Bit.Core.Context;
+namespace Bit.Core.AdminConsole.Context;
 
 public class CurrentContextProvider
 {
diff --git a/src/Core/Entities/Provider/Provider.cs b/src/Core/AdminConsole/Entities/Provider/Provider.cs
similarity index 88%
rename from src/Core/Entities/Provider/Provider.cs
rename to src/Core/AdminConsole/Entities/Provider/Provider.cs
index 82b1f727e437..7aeb422cf3e3 100644
--- a/src/Core/Entities/Provider/Provider.cs
+++ b/src/Core/AdminConsole/Entities/Provider/Provider.cs
@@ -1,7 +1,8 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.Entities;
 using Bit.Core.Utilities;
 
-namespace Bit.Core.Entities.Provider;
+namespace Bit.Core.AdminConsole.Entities.Provider;
 
 public class Provider : ITableObject<Guid>
 {
diff --git a/src/Core/Entities/Provider/ProviderOrganization.cs b/src/Core/AdminConsole/Entities/Provider/ProviderOrganization.cs
similarity index 83%
rename from src/Core/Entities/Provider/ProviderOrganization.cs
rename to src/Core/AdminConsole/Entities/Provider/ProviderOrganization.cs
index 6cafef67b7b1..8396846ad45d 100644
--- a/src/Core/Entities/Provider/ProviderOrganization.cs
+++ b/src/Core/AdminConsole/Entities/Provider/ProviderOrganization.cs
@@ -1,6 +1,7 @@
-using Bit.Core.Utilities;
+using Bit.Core.Entities;
+using Bit.Core.Utilities;
 
-namespace Bit.Core.Entities.Provider;
+namespace Bit.Core.AdminConsole.Entities.Provider;
 
 public class ProviderOrganization : ITableObject<Guid>
 {
diff --git a/src/Core/Entities/Provider/ProviderUser.cs b/src/Core/AdminConsole/Entities/Provider/ProviderUser.cs
similarity index 84%
rename from src/Core/Entities/Provider/ProviderUser.cs
rename to src/Core/AdminConsole/Entities/Provider/ProviderUser.cs
index 9b86d591c98d..6e5b12934b59 100644
--- a/src/Core/Entities/Provider/ProviderUser.cs
+++ b/src/Core/AdminConsole/Entities/Provider/ProviderUser.cs
@@ -1,7 +1,8 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.Entities;
 using Bit.Core.Utilities;
 
-namespace Bit.Core.Entities.Provider;
+namespace Bit.Core.AdminConsole.Entities.Provider;
 
 public class ProviderUser : ITableObject<Guid>
 {
diff --git a/src/Core/Enums/Provider/ProviderStatusType.cs b/src/Core/AdminConsole/Enums/Provider/ProviderStatusType.cs
similarity index 60%
rename from src/Core/Enums/Provider/ProviderStatusType.cs
rename to src/Core/AdminConsole/Enums/Provider/ProviderStatusType.cs
index bcb1f8cd2d50..794bd36bf54a 100644
--- a/src/Core/Enums/Provider/ProviderStatusType.cs
+++ b/src/Core/AdminConsole/Enums/Provider/ProviderStatusType.cs
@@ -1,4 +1,4 @@
-namespace Bit.Core.Enums.Provider;
+namespace Bit.Core.AdminConsole.Enums.Provider;
 
 public enum ProviderStatusType : byte
 {
diff --git a/src/Core/Enums/Provider/ProviderType.cs b/src/Core/AdminConsole/Enums/Provider/ProviderType.cs
similarity index 87%
rename from src/Core/Enums/Provider/ProviderType.cs
rename to src/Core/AdminConsole/Enums/Provider/ProviderType.cs
index 020f39eba1e3..a159fe2b6b74 100644
--- a/src/Core/Enums/Provider/ProviderType.cs
+++ b/src/Core/AdminConsole/Enums/Provider/ProviderType.cs
@@ -1,6 +1,6 @@
 using System.ComponentModel.DataAnnotations;
 
-namespace Bit.Core.Enums.Provider;
+namespace Bit.Core.AdminConsole.Enums.Provider;
 
 public enum ProviderType : byte
 {
diff --git a/src/Core/Enums/Provider/ProviderUserStatusType.cs b/src/Core/AdminConsole/Enums/Provider/ProviderUserStatusType.cs
similarity index 66%
rename from src/Core/Enums/Provider/ProviderUserStatusType.cs
rename to src/Core/AdminConsole/Enums/Provider/ProviderUserStatusType.cs
index 60571386d734..bb7b1022f768 100644
--- a/src/Core/Enums/Provider/ProviderUserStatusType.cs
+++ b/src/Core/AdminConsole/Enums/Provider/ProviderUserStatusType.cs
@@ -1,4 +1,4 @@
-namespace Bit.Core.Enums.Provider;
+namespace Bit.Core.AdminConsole.Enums.Provider;
 
 public enum ProviderUserStatusType : byte
 {
diff --git a/src/Core/Enums/Provider/ProviderUserType.cs b/src/Core/AdminConsole/Enums/Provider/ProviderUserType.cs
similarity index 62%
rename from src/Core/Enums/Provider/ProviderUserType.cs
rename to src/Core/AdminConsole/Enums/Provider/ProviderUserType.cs
index d13591290dce..a903d28a2173 100644
--- a/src/Core/Enums/Provider/ProviderUserType.cs
+++ b/src/Core/AdminConsole/Enums/Provider/ProviderUserType.cs
@@ -1,4 +1,4 @@
-namespace Bit.Core.Enums.Provider;
+namespace Bit.Core.AdminConsole.Enums.Provider;
 
 public enum ProviderUserType : byte
 {
diff --git a/src/Core/Models/Business/Provider/ProviderUserInvite.cs b/src/Core/AdminConsole/Models/Business/Provider/ProviderUserInvite.cs
similarity index 90%
rename from src/Core/Models/Business/Provider/ProviderUserInvite.cs
rename to src/Core/AdminConsole/Models/Business/Provider/ProviderUserInvite.cs
index 0fbe3d87c2ab..53cdefb3f96a 100644
--- a/src/Core/Models/Business/Provider/ProviderUserInvite.cs
+++ b/src/Core/AdminConsole/Models/Business/Provider/ProviderUserInvite.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 
-namespace Bit.Core.Models.Business.Provider;
+namespace Bit.Core.AdminConsole.Models.Business.Provider;
 
 public class ProviderUserInvite<T>
 {
diff --git a/src/Core/Models/Data/Provider/ProviderAbility.cs b/src/Core/AdminConsole/Models/Data/Provider/ProviderAbility.cs
similarity index 70%
rename from src/Core/Models/Data/Provider/ProviderAbility.cs
rename to src/Core/AdminConsole/Models/Data/Provider/ProviderAbility.cs
index b7e45eaed476..459981681b9d 100644
--- a/src/Core/Models/Data/Provider/ProviderAbility.cs
+++ b/src/Core/AdminConsole/Models/Data/Provider/ProviderAbility.cs
@@ -1,12 +1,10 @@
-using Bit.Core.Entities.Provider;
-
-namespace Bit.Core.Models.Data;
+namespace Bit.Core.AdminConsole.Models.Data.Provider;
 
 public class ProviderAbility
 {
     public ProviderAbility() { }
 
-    public ProviderAbility(Provider provider)
+    public ProviderAbility(Entities.Provider.Provider provider)
     {
         Id = provider.Id;
         UseEvents = provider.UseEvents;
diff --git a/src/Core/Models/Data/Provider/ProviderOrganizationOrganizationDetails.cs b/src/Core/AdminConsole/Models/Data/Provider/ProviderOrganizationOrganizationDetails.cs
similarity index 91%
rename from src/Core/Models/Data/Provider/ProviderOrganizationOrganizationDetails.cs
rename to src/Core/AdminConsole/Models/Data/Provider/ProviderOrganizationOrganizationDetails.cs
index cf4f11b00131..dc6d80b8801e 100644
--- a/src/Core/Models/Data/Provider/ProviderOrganizationOrganizationDetails.cs
+++ b/src/Core/AdminConsole/Models/Data/Provider/ProviderOrganizationOrganizationDetails.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Enums;
 
-namespace Bit.Core.Models.Data;
+namespace Bit.Core.AdminConsole.Models.Data.Provider;
 
 public class ProviderOrganizationOrganizationDetails
 {
diff --git a/src/Core/Models/Data/Provider/ProviderOrganizationProviderDetails.cs b/src/Core/AdminConsole/Models/Data/Provider/ProviderOrganizationProviderDetails.cs
similarity index 72%
rename from src/Core/Models/Data/Provider/ProviderOrganizationProviderDetails.cs
rename to src/Core/AdminConsole/Models/Data/Provider/ProviderOrganizationProviderDetails.cs
index 8ae9559c8637..e0a6faabbf12 100644
--- a/src/Core/Models/Data/Provider/ProviderOrganizationProviderDetails.cs
+++ b/src/Core/AdminConsole/Models/Data/Provider/ProviderOrganizationProviderDetails.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 
-namespace Bit.Core.Models.Data;
+namespace Bit.Core.AdminConsole.Models.Data.Provider;
 
 public class ProviderOrganizationProviderDetails
 {
diff --git a/src/Core/Models/Data/Provider/ProviderUserOrganizationDetails.cs b/src/Core/AdminConsole/Models/Data/Provider/ProviderUserOrganizationDetails.cs
similarity index 89%
rename from src/Core/Models/Data/Provider/ProviderUserOrganizationDetails.cs
rename to src/Core/AdminConsole/Models/Data/Provider/ProviderUserOrganizationDetails.cs
index 2d06fc429691..92f420a5b554 100644
--- a/src/Core/Models/Data/Provider/ProviderUserOrganizationDetails.cs
+++ b/src/Core/AdminConsole/Models/Data/Provider/ProviderUserOrganizationDetails.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 
-namespace Bit.Core.Models.Data;
+namespace Bit.Core.AdminConsole.Models.Data.Provider;
 
 public class ProviderUserOrganizationDetails
 {
@@ -34,5 +34,5 @@ public class ProviderUserOrganizationDetails
     public Guid? ProviderId { get; set; }
     public Guid? ProviderUserId { get; set; }
     public string ProviderName { get; set; }
-    public Enums.PlanType PlanType { get; set; }
+    public Core.Enums.PlanType PlanType { get; set; }
 }
diff --git a/src/Core/Models/Data/Provider/ProviderUserProviderDetails.cs b/src/Core/AdminConsole/Models/Data/Provider/ProviderUserProviderDetails.cs
similarity index 82%
rename from src/Core/Models/Data/Provider/ProviderUserProviderDetails.cs
rename to src/Core/AdminConsole/Models/Data/Provider/ProviderUserProviderDetails.cs
index 16f2e1dda574..2b7d240a5c35 100644
--- a/src/Core/Models/Data/Provider/ProviderUserProviderDetails.cs
+++ b/src/Core/AdminConsole/Models/Data/Provider/ProviderUserProviderDetails.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 
-namespace Bit.Core.Models.Data;
+namespace Bit.Core.AdminConsole.Models.Data.Provider;
 
 public class ProviderUserProviderDetails
 {
diff --git a/src/Core/Models/Data/Provider/ProviderUserPublicKey.cs b/src/Core/AdminConsole/Models/Data/Provider/ProviderUserPublicKey.cs
similarity index 72%
rename from src/Core/Models/Data/Provider/ProviderUserPublicKey.cs
rename to src/Core/AdminConsole/Models/Data/Provider/ProviderUserPublicKey.cs
index 0b161fd860de..a9b37b20502a 100644
--- a/src/Core/Models/Data/Provider/ProviderUserPublicKey.cs
+++ b/src/Core/AdminConsole/Models/Data/Provider/ProviderUserPublicKey.cs
@@ -1,4 +1,4 @@
-namespace Bit.Core.Models.Data;
+namespace Bit.Core.AdminConsole.Models.Data.Provider;
 
 public class ProviderUserPublicKey
 {
diff --git a/src/Core/Models/Data/Provider/ProviderUserUserDetails.cs b/src/Core/AdminConsole/Models/Data/Provider/ProviderUserUserDetails.cs
similarity index 78%
rename from src/Core/Models/Data/Provider/ProviderUserUserDetails.cs
rename to src/Core/AdminConsole/Models/Data/Provider/ProviderUserUserDetails.cs
index 51df1d44ef56..94aa3fa0f33b 100644
--- a/src/Core/Models/Data/Provider/ProviderUserUserDetails.cs
+++ b/src/Core/AdminConsole/Models/Data/Provider/ProviderUserUserDetails.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 
-namespace Bit.Core.Models.Data;
+namespace Bit.Core.AdminConsole.Models.Data.Provider;
 
 public class ProviderUserUserDetails
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommand.cs
similarity index 83%
rename from src/Core/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommand.cs
index d76725c70d31..fedcecd4c526 100644
--- a/src/Core/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommand.cs
@@ -1,10 +1,10 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Utilities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationApiKeys;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
 
 public class CreateOrganizationApiKeyCommand : ICreateOrganizationApiKeyCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQuery.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQuery.cs
similarity index 84%
rename from src/Core/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQuery.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQuery.cs
index 6e4a9f5d5d05..b91e57a67c88 100644
--- a/src/Core/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQuery.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQuery.cs
@@ -1,9 +1,9 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
 using Bit.Core.Repositories;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationApiKeys;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
 
 public class GetOrganizationApiKeyQuery : IGetOrganizationApiKeyQuery
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/ICreateOrganizationApiKeyCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/ICreateOrganizationApiKeyCommand.cs
similarity index 71%
rename from src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/ICreateOrganizationApiKeyCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/ICreateOrganizationApiKeyCommand.cs
index a2ce7326de5c..d9646fdcf3f2 100644
--- a/src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/ICreateOrganizationApiKeyCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/ICreateOrganizationApiKeyCommand.cs
@@ -1,7 +1,7 @@
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
 
 public interface ICreateOrganizationApiKeyCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/IGetOrganizationApiKeyQuery.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/IGetOrganizationApiKeyQuery.cs
similarity index 72%
rename from src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/IGetOrganizationApiKeyQuery.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/IGetOrganizationApiKeyQuery.cs
index 699b13adb95f..2504df7621cd 100644
--- a/src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/IGetOrganizationApiKeyQuery.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/IGetOrganizationApiKeyQuery.cs
@@ -1,7 +1,7 @@
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
 
 public interface IGetOrganizationApiKeyQuery
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/IRotateOrganizationApiKeyCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/IRotateOrganizationApiKeyCommand.cs
similarity index 66%
rename from src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/IRotateOrganizationApiKeyCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/IRotateOrganizationApiKeyCommand.cs
index a5cf51c3fe5e..8114714c50bf 100644
--- a/src/Core/OrganizationFeatures/OrganizationApiKeys/Interfaces/IRotateOrganizationApiKeyCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/Interfaces/IRotateOrganizationApiKeyCommand.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
 
 public interface IRotateOrganizationApiKeyCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommand.cs
similarity index 80%
rename from src/Core/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommand.cs
index f43aaa5f341c..0d55231e2ab1 100644
--- a/src/Core/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommand.cs
@@ -1,9 +1,9 @@
-using Bit.Core.Entities;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Repositories;
 using Bit.Core.Utilities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationApiKeys;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
 
 public class RotateOrganizationApiKeyCommand : IRotateOrganizationApiKeyCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommand.cs
similarity index 80%
rename from src/Core/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommand.cs
index 6c019001c00b..1ea73bf0859a 100644
--- a/src/Core/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommand.cs
@@ -1,10 +1,10 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Models.Data.Organizations.OrganizationConnections;
 using Bit.Core.Models.OrganizationConnectionConfigs;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Repositories;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationConnections;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
 
 public class CreateOrganizationConnectionCommand : ICreateOrganizationConnectionCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommand.cs
similarity index 75%
rename from src/Core/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommand.cs
index 7166059db567..3b094be05122 100644
--- a/src/Core/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommand.cs
@@ -1,8 +1,8 @@
-using Bit.Core.Entities;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Repositories;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationConnections;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
 
 public class DeleteOrganizationConnectionCommand : IDeleteOrganizationConnectionCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/ICreateOrganizationConnectionCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/ICreateOrganizationConnectionCommand.cs
similarity index 78%
rename from src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/ICreateOrganizationConnectionCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/ICreateOrganizationConnectionCommand.cs
index a97be09c3bff..d3a7d65d8f6e 100644
--- a/src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/ICreateOrganizationConnectionCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/ICreateOrganizationConnectionCommand.cs
@@ -2,7 +2,7 @@
 using Bit.Core.Models.Data.Organizations.OrganizationConnections;
 using Bit.Core.Models.OrganizationConnectionConfigs;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
 
 public interface ICreateOrganizationConnectionCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IDeleteOrganizationConnectionCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IDeleteOrganizationConnectionCommand.cs
similarity index 61%
rename from src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IDeleteOrganizationConnectionCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IDeleteOrganizationConnectionCommand.cs
index 818609aef2d4..8a6e866cc97c 100644
--- a/src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IDeleteOrganizationConnectionCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IDeleteOrganizationConnectionCommand.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
 
 public interface IDeleteOrganizationConnectionCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IUpdateOrganizationConnectionCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IUpdateOrganizationConnectionCommand.cs
similarity index 78%
rename from src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IUpdateOrganizationConnectionCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IUpdateOrganizationConnectionCommand.cs
index b245b896930e..979460a3b368 100644
--- a/src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IUpdateOrganizationConnectionCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IUpdateOrganizationConnectionCommand.cs
@@ -2,7 +2,7 @@
 using Bit.Core.Models.Data.Organizations.OrganizationConnections;
 using Bit.Core.Models.OrganizationConnectionConfigs;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
 
 public interface IUpdateOrganizationConnectionCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IValidateBillingSyncKeyCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IValidateBillingSyncKeyCommand.cs
similarity index 66%
rename from src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IValidateBillingSyncKeyCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IValidateBillingSyncKeyCommand.cs
index 9fb979548a62..78a28d3ec366 100644
--- a/src/Core/OrganizationFeatures/OrganizationConnections/Interfaces/IValidateBillingSyncKeyCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/Interfaces/IValidateBillingSyncKeyCommand.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
 
 public interface IValidateBillingSyncKeyCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommand.cs
similarity index 86%
rename from src/Core/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommand.cs
index 3e64fd47abf2..428cc25ae6db 100644
--- a/src/Core/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommand.cs
@@ -1,11 +1,11 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Data.Organizations.OrganizationConnections;
 using Bit.Core.Models.OrganizationConnectionConfigs;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Repositories;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationConnections;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
 
 public class UpdateOrganizationConnectionCommand : IUpdateOrganizationConnectionCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommand.cs
similarity index 75%
rename from src/Core/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommand.cs
index a764bbcf2349..11360f2fa1ba 100644
--- a/src/Core/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommand.cs
@@ -1,9 +1,9 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Repositories;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationConnections;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
 
 public class ValidateBillingSyncKeyCommand : IValidateBillingSyncKeyCommand
 {
@@ -26,7 +26,7 @@ public async Task<bool> ValidateBillingSyncKeyAsync(Organization organization, s
             return false;
         }
 
-        var orgApiKey = (await _apiKeyRepository.GetManyByOrganizationIdTypeAsync(organization.Id, Enums.OrganizationApiKeyType.BillingSync)).FirstOrDefault();
+        var orgApiKey = (await _apiKeyRepository.GetManyByOrganizationIdTypeAsync(organization.Id, Core.Enums.OrganizationApiKeyType.BillingSync)).FirstOrDefault();
         if (string.Equals(orgApiKey.ApiKey, billingSyncKey))
         {
             return true;
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommand.cs
similarity index 94%
rename from src/Core/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommand.cs
index e5aa4a09ad05..ea02a65a386c 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommand.cs
@@ -1,13 +1,13 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
 using Microsoft.Extensions.Logging;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 public class CreateOrganizationDomainCommand : ICreateOrganizationDomainCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommand.cs
similarity index 82%
rename from src/Core/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommand.cs
index f0162f7a50eb..e966b0149d10 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommand.cs
@@ -1,10 +1,10 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 public class DeleteOrganizationDomainCommand : IDeleteOrganizationDomainCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQuery.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQuery.cs
similarity index 77%
rename from src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQuery.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQuery.cs
index 1ed22076850f..12616a142a85 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQuery.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQuery.cs
@@ -1,8 +1,8 @@
-using Bit.Core.Entities;
-using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Repositories;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 public class GetOrganizationDomainByIdOrganizationIdQuery : IGetOrganizationDomainByIdOrganizationIdQuery
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQuery.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQuery.cs
similarity index 76%
rename from src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQuery.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQuery.cs
index c1fef05088d2..2ad1525cdf44 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQuery.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQuery.cs
@@ -1,8 +1,8 @@
-using Bit.Core.Entities;
-using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Repositories;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 public class GetOrganizationDomainByOrganizationIdQuery : IGetOrganizationDomainByOrganizationIdQuery
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/ICreateOrganizationDomainCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/ICreateOrganizationDomainCommand.cs
similarity index 66%
rename from src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/ICreateOrganizationDomainCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/ICreateOrganizationDomainCommand.cs
index 79df45396c6d..8878e27f3042 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/ICreateOrganizationDomainCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/ICreateOrganizationDomainCommand.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
 
 public interface ICreateOrganizationDomainCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IDeleteOrganizationDomainCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IDeleteOrganizationDomainCommand.cs
similarity index 63%
rename from src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IDeleteOrganizationDomainCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IDeleteOrganizationDomainCommand.cs
index 8b11bc61ed00..17f508f8ad5f 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IDeleteOrganizationDomainCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IDeleteOrganizationDomainCommand.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
 
 public interface IDeleteOrganizationDomainCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdOrganizationIdQuery.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdOrganizationIdQuery.cs
similarity index 70%
rename from src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdOrganizationIdQuery.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdOrganizationIdQuery.cs
index 12fe643a6b7e..aa8122a76bcd 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdOrganizationIdQuery.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByIdOrganizationIdQuery.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
 
 public interface IGetOrganizationDomainByIdOrganizationIdQuery
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByOrganizationIdQuery.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByOrganizationIdQuery.cs
similarity index 68%
rename from src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByOrganizationIdQuery.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByOrganizationIdQuery.cs
index d1fb642a5392..062971b41e15 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByOrganizationIdQuery.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IGetOrganizationDomainByOrganizationIdQuery.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
 
 public interface IGetOrganizationDomainByOrganizationIdQuery
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IVerifyOrganizationDomainCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IVerifyOrganizationDomainCommand.cs
similarity index 68%
rename from src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IVerifyOrganizationDomainCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IVerifyOrganizationDomainCommand.cs
index fe4c38aa8712..b62a9f932797 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/Interfaces/IVerifyOrganizationDomainCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/Interfaces/IVerifyOrganizationDomainCommand.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
 
 public interface IVerifyOrganizationDomainCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs
similarity index 92%
rename from src/Core/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs
index 508a085f61e3..5f9476db8f13 100644
--- a/src/Core/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommand.cs
@@ -1,12 +1,12 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Microsoft.Extensions.Logging;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 public class VerifyOrganizationDomainCommand : IVerifyOrganizationDomainCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQuery.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQuery.cs
similarity index 89%
rename from src/Core/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQuery.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQuery.cs
index 24bef3dc7ef1..1beb25e17c57 100644
--- a/src/Core/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQuery.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQuery.cs
@@ -1,8 +1,8 @@
-using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.Exceptions;
 using Bit.Core.Repositories;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationUsers;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
 
 public class CountNewSmSeatsRequiredQuery : ICountNewSmSeatsRequiredQuery
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommand.cs
similarity index 89%
rename from src/Core/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommand.cs
index 69310b954a69..b0b5cc00c649 100644
--- a/src/Core/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommand.cs
@@ -1,10 +1,10 @@
-using Bit.Core.Enums;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationUsers;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
 
 public class DeleteOrganizationUserCommand : IDeleteOrganizationUserCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/ICountNewSmSeatsRequiredQuery.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/ICountNewSmSeatsRequiredQuery.cs
similarity index 61%
rename from src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/ICountNewSmSeatsRequiredQuery.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/ICountNewSmSeatsRequiredQuery.cs
index 851aef73a2ab..2b38f9721d3c 100644
--- a/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/ICountNewSmSeatsRequiredQuery.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/ICountNewSmSeatsRequiredQuery.cs
@@ -1,4 +1,4 @@
-namespace Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 
 public interface ICountNewSmSeatsRequiredQuery
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IDeleteOrganizationUserCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/IDeleteOrganizationUserCommand.cs
similarity index 77%
rename from src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IDeleteOrganizationUserCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/IDeleteOrganizationUserCommand.cs
index b7ca904a112d..32c19077a091 100644
--- a/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IDeleteOrganizationUserCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/IDeleteOrganizationUserCommand.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Enums;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 
 public interface IDeleteOrganizationUserCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IUpdateOrganizationUserGroupsCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/IUpdateOrganizationUserGroupsCommand.cs
similarity index 71%
rename from src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IUpdateOrganizationUserGroupsCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/IUpdateOrganizationUserGroupsCommand.cs
index 9dae9323349c..530b3839e63b 100644
--- a/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IUpdateOrganizationUserGroupsCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/Interfaces/IUpdateOrganizationUserGroupsCommand.cs
@@ -1,6 +1,6 @@
 using Bit.Core.Entities;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 
 public interface IUpdateOrganizationUserGroupsCommand
 {
diff --git a/src/Core/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommand.cs b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommand.cs
similarity index 88%
rename from src/Core/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommand.cs
rename to src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommand.cs
index 7bb5814d6e1f..0331f2ed59a4 100644
--- a/src/Core/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommand.cs
+++ b/src/Core/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommand.cs
@@ -1,10 +1,10 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 
-namespace Bit.Core.OrganizationFeatures.OrganizationUsers;
+namespace Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
 
 public class UpdateOrganizationUserGroupsCommand : IUpdateOrganizationUserGroupsCommand
 {
diff --git a/src/Core/Providers/Interfaces/ICreateProviderCommand.cs b/src/Core/AdminConsole/Providers/Interfaces/ICreateProviderCommand.cs
similarity index 60%
rename from src/Core/Providers/Interfaces/ICreateProviderCommand.cs
rename to src/Core/AdminConsole/Providers/Interfaces/ICreateProviderCommand.cs
index 4121b1533564..93b3e387a3af 100644
--- a/src/Core/Providers/Interfaces/ICreateProviderCommand.cs
+++ b/src/Core/AdminConsole/Providers/Interfaces/ICreateProviderCommand.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
 
-namespace Bit.Core.Providers.Interfaces;
+namespace Bit.Core.AdminConsole.Providers.Interfaces;
 
 public interface ICreateProviderCommand
 {
diff --git a/src/Core/Repositories/IProviderOrganizationRepository.cs b/src/Core/AdminConsole/Repositories/IProviderOrganizationRepository.cs
similarity index 76%
rename from src/Core/Repositories/IProviderOrganizationRepository.cs
rename to src/Core/AdminConsole/Repositories/IProviderOrganizationRepository.cs
index 8550a3d7bc04..6f267295efad 100644
--- a/src/Core/Repositories/IProviderOrganizationRepository.cs
+++ b/src/Core/AdminConsole/Repositories/IProviderOrganizationRepository.cs
@@ -1,7 +1,8 @@
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.Repositories;
 
-namespace Bit.Core.Repositories;
+namespace Bit.Core.AdminConsole.Repositories;
 
 public interface IProviderOrganizationRepository : IRepository<ProviderOrganization, Guid>
 {
diff --git a/src/Core/Repositories/IProviderRepository.cs b/src/Core/AdminConsole/Repositories/IProviderRepository.cs
similarity index 63%
rename from src/Core/Repositories/IProviderRepository.cs
rename to src/Core/AdminConsole/Repositories/IProviderRepository.cs
index 8939bba966db..c9da0b2faad4 100644
--- a/src/Core/Repositories/IProviderRepository.cs
+++ b/src/Core/AdminConsole/Repositories/IProviderRepository.cs
@@ -1,7 +1,8 @@
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.Repositories;
 
-namespace Bit.Core.Repositories;
+namespace Bit.Core.AdminConsole.Repositories;
 
 public interface IProviderRepository : IRepository<Provider, Guid>
 {
diff --git a/src/Core/Repositories/IProviderUserRepository.cs b/src/Core/AdminConsole/Repositories/IProviderUserRepository.cs
similarity index 85%
rename from src/Core/Repositories/IProviderUserRepository.cs
rename to src/Core/AdminConsole/Repositories/IProviderUserRepository.cs
index 9f0374fee3d2..34443f7d5f4d 100644
--- a/src/Core/Repositories/IProviderUserRepository.cs
+++ b/src/Core/AdminConsole/Repositories/IProviderUserRepository.cs
@@ -1,8 +1,9 @@
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.Repositories;
 
-namespace Bit.Core.Repositories;
+namespace Bit.Core.AdminConsole.Repositories;
 
 public interface IProviderUserRepository : IRepository<ProviderUser, Guid>
 {
diff --git a/src/Core/Services/IProviderService.cs b/src/Core/AdminConsole/Services/IProviderService.cs
similarity index 89%
rename from src/Core/Services/IProviderService.cs
rename to src/Core/AdminConsole/Services/IProviderService.cs
index c1ac8b5a33aa..f71403e80c46 100644
--- a/src/Core/Services/IProviderService.cs
+++ b/src/Core/AdminConsole/Services/IProviderService.cs
@@ -1,9 +1,9 @@
-using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Business.Provider;
+using Bit.Core.Entities;
 using Bit.Core.Models.Business;
-using Bit.Core.Models.Business.Provider;
 
-namespace Bit.Core.Services;
+namespace Bit.Core.AdminConsole.Services;
 
 public interface IProviderService
 {
diff --git a/src/Core/Services/NoopImplementations/NoopProviderService.cs b/src/Core/AdminConsole/Services/NoopImplementations/NoopProviderService.cs
similarity index 92%
rename from src/Core/Services/NoopImplementations/NoopProviderService.cs
rename to src/Core/AdminConsole/Services/NoopImplementations/NoopProviderService.cs
index 596ec9171838..b573764b3fd0 100644
--- a/src/Core/Services/NoopImplementations/NoopProviderService.cs
+++ b/src/Core/AdminConsole/Services/NoopImplementations/NoopProviderService.cs
@@ -1,9 +1,9 @@
-using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Business.Provider;
+using Bit.Core.Entities;
 using Bit.Core.Models.Business;
-using Bit.Core.Models.Business.Provider;
 
-namespace Bit.Core.Services;
+namespace Bit.Core.AdminConsole.Services.NoopImplementations;
 
 public class NoopProviderService : IProviderService
 {
diff --git a/src/Core/Auth/Entities/WebAuthnCredential.cs b/src/Core/Auth/Entities/WebAuthnCredential.cs
new file mode 100644
index 000000000000..b4b80ff65481
--- /dev/null
+++ b/src/Core/Auth/Entities/WebAuthnCredential.cs
@@ -0,0 +1,32 @@
+using System.ComponentModel.DataAnnotations;
+using Bit.Core.Entities;
+using Bit.Core.Utilities;
+
+namespace Bit.Core.Auth.Entities;
+
+public class WebAuthnCredential : ITableObject<Guid>
+{
+    public Guid Id { get; set; }
+    public Guid UserId { get; set; }
+    [MaxLength(50)]
+    public string Name { get; set; }
+    [MaxLength(256)]
+    public string PublicKey { get; set; }
+    [MaxLength(256)]
+    public string CredentialId { get; set; }
+    public int Counter { get; set; }
+    [MaxLength(20)]
+    public string Type { get; set; }
+    public Guid AaGuid { get; set; }
+    public string EncryptedUserKey { get; set; }
+    public string EncryptedPrivateKey { get; set; }
+    public string EncryptedPublicKey { get; set; }
+    public bool SupportsPrf { get; set; }
+    public DateTime CreationDate { get; internal set; } = DateTime.UtcNow;
+    public DateTime RevisionDate { get; internal set; } = DateTime.UtcNow;
+
+    public void SetNewId()
+    {
+        Id = CoreHelpers.GenerateComb();
+    }
+}
diff --git a/src/Core/Auth/Models/Business/Tokenables/IOrgUserInviteTokenableFactory.cs b/src/Core/Auth/Models/Business/Tokenables/IOrgUserInviteTokenableFactory.cs
new file mode 100644
index 000000000000..04d3b008b1c5
--- /dev/null
+++ b/src/Core/Auth/Models/Business/Tokenables/IOrgUserInviteTokenableFactory.cs
@@ -0,0 +1,8 @@
+using Bit.Core.Entities;
+
+namespace Bit.Core.Auth.Models.Business.Tokenables;
+
+public interface IOrgUserInviteTokenableFactory
+{
+    OrgUserInviteTokenable CreateToken(OrganizationUser orgUser);
+}
diff --git a/src/Core/Auth/Models/Business/Tokenables/OrgUserInviteTokenable.cs b/src/Core/Auth/Models/Business/Tokenables/OrgUserInviteTokenable.cs
new file mode 100644
index 000000000000..95c84ad3b53d
--- /dev/null
+++ b/src/Core/Auth/Models/Business/Tokenables/OrgUserInviteTokenable.cs
@@ -0,0 +1,84 @@
+using System.Text.Json.Serialization;
+using Bit.Core.Entities;
+using Bit.Core.Tokens;
+
+namespace Bit.Core.Auth.Models.Business.Tokenables;
+
+public class OrgUserInviteTokenable : ExpiringTokenable
+{
+    // TODO: PM-4317 - Ideally this would be internal and only visible to the test project.
+    // but configuring that is out of scope for these changes.
+    public static TimeSpan GetTokenLifetime() => TimeSpan.FromDays(5);
+
+    public const string ClearTextPrefix = "BwOrgUserInviteToken_";
+
+    // Backwards compatibility Note:
+    // Previously, tokens were manually created in the OrganizationService using a data protector
+    // initialized with purpose: "OrganizationServiceDataProtector"
+    // So, we must continue to use the existing purpose to be able to decrypt tokens
+    // in emailed invites that have not yet been accepted.
+    public const string DataProtectorPurpose = "OrganizationServiceDataProtector";
+
+    public const string TokenIdentifier = "OrgUserInviteToken";
+
+    public string Identifier { get; set; } = TokenIdentifier;
+    public Guid OrgUserId { get; set; }
+    public string OrgUserEmail { get; set; }
+
+    [JsonConstructor]
+    public OrgUserInviteTokenable()
+    {
+        ExpirationDate = DateTime.UtcNow.Add(GetTokenLifetime());
+    }
+
+    public OrgUserInviteTokenable(OrganizationUser orgUser) : this()
+    {
+        OrgUserId = orgUser?.Id ?? default;
+        OrgUserEmail = orgUser?.Email;
+    }
+
+    public bool TokenIsValid(OrganizationUser orgUser)
+    {
+        if (OrgUserId == default || OrgUserEmail == default || orgUser == null)
+        {
+            return false;
+        }
+
+        return OrgUserId == orgUser.Id &&
+               OrgUserEmail.Equals(orgUser.Email, StringComparison.InvariantCultureIgnoreCase);
+    }
+
+    public bool TokenIsValid(Guid orgUserId, string orgUserEmail)
+    {
+        if (OrgUserId == default || OrgUserEmail == default || orgUserId == default || orgUserEmail == default)
+        {
+            return false;
+        }
+
+        return OrgUserId == orgUserId &&
+               OrgUserEmail.Equals(orgUserEmail, StringComparison.InvariantCultureIgnoreCase);
+    }
+
+    // Validates deserialized
+    protected override bool TokenIsValid() =>
+        Identifier == TokenIdentifier && OrgUserId != default && !string.IsNullOrWhiteSpace(OrgUserEmail);
+
+
+    public static bool ValidateOrgUserInviteStringToken(
+        IDataProtectorTokenFactory<OrgUserInviteTokenable> orgUserInviteTokenDataFactory,
+        string orgUserInviteToken, OrganizationUser orgUser)
+    {
+        return orgUserInviteTokenDataFactory.TryUnprotect(orgUserInviteToken, out var decryptedToken)
+               && decryptedToken.Valid
+               && decryptedToken.TokenIsValid(orgUser);
+    }
+
+    public static bool ValidateOrgUserInviteStringToken(
+        IDataProtectorTokenFactory<OrgUserInviteTokenable> orgUserInviteTokenDataFactory,
+        string orgUserInviteToken, Guid orgUserId, string orgUserEmail)
+    {
+        return orgUserInviteTokenDataFactory.TryUnprotect(orgUserInviteToken, out var decryptedToken)
+               && decryptedToken.Valid
+               && decryptedToken.TokenIsValid(orgUserId, orgUserEmail);
+    }
+}
diff --git a/src/Core/Auth/Models/Business/Tokenables/OrgUserInviteTokenableFactory.cs b/src/Core/Auth/Models/Business/Tokenables/OrgUserInviteTokenableFactory.cs
new file mode 100644
index 000000000000..9e5a797dbb1e
--- /dev/null
+++ b/src/Core/Auth/Models/Business/Tokenables/OrgUserInviteTokenableFactory.cs
@@ -0,0 +1,23 @@
+using Bit.Core.Entities;
+using Bit.Core.Settings;
+
+namespace Bit.Core.Auth.Models.Business.Tokenables;
+
+public class OrgUserInviteTokenableFactory : IOrgUserInviteTokenableFactory
+{
+    private readonly IGlobalSettings _globalSettings;
+
+    public OrgUserInviteTokenableFactory(IGlobalSettings globalSettings)
+    {
+        _globalSettings = globalSettings;
+    }
+
+    public OrgUserInviteTokenable CreateToken(OrganizationUser orgUser)
+    {
+        var token = new OrgUserInviteTokenable(orgUser)
+        {
+            ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromHours(_globalSettings.OrganizationInviteExpirationHours))
+        };
+        return token;
+    }
+}
diff --git a/src/Core/Auth/Models/Business/Tokenables/SsoEmail2faSessionTokenable.cs b/src/Core/Auth/Models/Business/Tokenables/SsoEmail2faSessionTokenable.cs
index ea8347653bd9..24a74bde076b 100644
--- a/src/Core/Auth/Models/Business/Tokenables/SsoEmail2faSessionTokenable.cs
+++ b/src/Core/Auth/Models/Business/Tokenables/SsoEmail2faSessionTokenable.cs
@@ -16,12 +16,9 @@ public class SsoEmail2faSessionTokenable : ExpiringTokenable
     public const string DataProtectorPurpose = "SsoEmail2faSessionTokenDataProtector";
 
     public const string TokenIdentifier = "SsoEmail2faSessionToken";
-
     public string Identifier { get; set; } = TokenIdentifier;
     public Guid Id { get; set; }
     public string Email { get; set; }
-
-
     [JsonConstructor]
     public SsoEmail2faSessionTokenable()
     {
@@ -33,14 +30,12 @@ public SsoEmail2faSessionTokenable(User user) : this()
         Id = user?.Id ?? default;
         Email = user?.Email;
     }
-
     public bool TokenIsValid(User user)
     {
         if (Id == default || Email == default || user == null)
         {
             return false;
         }
-
         return Id == user.Id &&
                Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase);
     }
diff --git a/src/Core/Auth/Models/Business/Tokenables/WebAuthnCredentialCreateOptionsTokenable.cs b/src/Core/Auth/Models/Business/Tokenables/WebAuthnCredentialCreateOptionsTokenable.cs
new file mode 100644
index 000000000000..e64edace4558
--- /dev/null
+++ b/src/Core/Auth/Models/Business/Tokenables/WebAuthnCredentialCreateOptionsTokenable.cs
@@ -0,0 +1,44 @@
+using System.Text.Json.Serialization;
+using Bit.Core.Entities;
+using Bit.Core.Tokens;
+using Fido2NetLib;
+
+namespace Bit.Core.Auth.Models.Business.Tokenables;
+
+public class WebAuthnCredentialCreateOptionsTokenable : ExpiringTokenable
+{
+    // 7 minutes = max webauthn timeout (6 minutes) + slack for miscellaneous delays
+    private const double _tokenLifetimeInHours = (double)7 / 60;
+    public const string ClearTextPrefix = "BWWebAuthnCredentialCreateOptions_";
+    public const string DataProtectorPurpose = "WebAuthnCredentialCreateDataProtector";
+    public const string TokenIdentifier = "WebAuthnCredentialCreateOptionsToken";
+
+    public string Identifier { get; set; } = TokenIdentifier;
+    public Guid? UserId { get; set; }
+    public CredentialCreateOptions Options { get; set; }
+
+    [JsonConstructor]
+    public WebAuthnCredentialCreateOptionsTokenable()
+    {
+        ExpirationDate = DateTime.UtcNow.AddHours(_tokenLifetimeInHours);
+    }
+
+    public WebAuthnCredentialCreateOptionsTokenable(User user, CredentialCreateOptions options) : this()
+    {
+        UserId = user?.Id;
+        Options = options;
+    }
+
+    public bool TokenIsValid(User user)
+    {
+        if (!Valid || user == null)
+        {
+            return false;
+        }
+
+        return UserId == user.Id;
+    }
+
+    protected override bool TokenIsValid() => Identifier == TokenIdentifier && UserId != null && Options != null;
+}
+
diff --git a/src/Core/Auth/Models/Business/Tokenables/WebAuthnLoginTokenable.cs b/src/Core/Auth/Models/Business/Tokenables/WebAuthnLoginTokenable.cs
new file mode 100644
index 000000000000..b27b1fb35538
--- /dev/null
+++ b/src/Core/Auth/Models/Business/Tokenables/WebAuthnLoginTokenable.cs
@@ -0,0 +1,43 @@
+using System.Text.Json.Serialization;
+using Bit.Core.Entities;
+using Bit.Core.Tokens;
+
+namespace Bit.Core.Auth.Models.Business.Tokenables;
+
+public class WebAuthnLoginTokenable : ExpiringTokenable
+{
+    private const double _tokenLifetimeInHours = (double)1 / 60; // 1 minute
+    public const string ClearTextPrefix = "BWWebAuthnLogin_";
+    public const string DataProtectorPurpose = "WebAuthnLoginDataProtector";
+    public const string TokenIdentifier = "WebAuthnLoginToken";
+
+    public string Identifier { get; set; } = TokenIdentifier;
+    public Guid Id { get; set; }
+    public string Email { get; set; }
+
+    [JsonConstructor]
+    public WebAuthnLoginTokenable()
+    {
+        ExpirationDate = DateTime.UtcNow.AddHours(_tokenLifetimeInHours);
+    }
+
+    public WebAuthnLoginTokenable(User user) : this()
+    {
+        Id = user?.Id ?? default;
+        Email = user?.Email;
+    }
+
+    public bool TokenIsValid(User user)
+    {
+        if (Id == default || Email == default || user == null)
+        {
+            return false;
+        }
+
+        return Id == user.Id &&
+        Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase);
+    }
+
+    // Validates deserialized 
+    protected override bool TokenIsValid() => Identifier == TokenIdentifier && Id != default && !string.IsNullOrWhiteSpace(Email);
+}
diff --git a/src/Core/Auth/Repositories/IWebAuthnCredentialRepository.cs b/src/Core/Auth/Repositories/IWebAuthnCredentialRepository.cs
new file mode 100644
index 000000000000..7a052df6883e
--- /dev/null
+++ b/src/Core/Auth/Repositories/IWebAuthnCredentialRepository.cs
@@ -0,0 +1,10 @@
+using Bit.Core.Auth.Entities;
+using Bit.Core.Repositories;
+
+namespace Bit.Core.Auth.Repositories;
+
+public interface IWebAuthnCredentialRepository : IRepository<WebAuthnCredential, Guid>
+{
+    Task<WebAuthnCredential> GetByIdAsync(Guid id, Guid userId);
+    Task<ICollection<WebAuthnCredential>> GetManyByUserIdAsync(Guid userId);
+}
diff --git a/src/Core/Auth/UserFeatures/UserMasterPassword/Interfaces/ISetInitialMasterPasswordCommand.cs b/src/Core/Auth/UserFeatures/UserMasterPassword/Interfaces/ISetInitialMasterPasswordCommand.cs
new file mode 100644
index 000000000000..31dd19d5bfb7
--- /dev/null
+++ b/src/Core/Auth/UserFeatures/UserMasterPassword/Interfaces/ISetInitialMasterPasswordCommand.cs
@@ -0,0 +1,19 @@
+using Bit.Core.Entities;
+using Microsoft.AspNetCore.Identity;
+
+namespace Bit.Core.Auth.UserFeatures.UserMasterPassword.Interfaces;
+
+/// <summary>
+/// <para>Manages the setting of the initial master password for a <see cref="User"/> in an organization.</para>
+/// <para>This class is primarily invoked in two scenarios:</para>
+/// <para>1) In organizations configured with Single Sign-On (SSO) and master password decryption:
+/// just in time (JIT) provisioned users logging in via SSO are required to set a master password.</para>
+/// <para>2) In organizations configured with SSO and trusted devices decryption:
+/// Users who are upgraded to have admin account recovery permissions must set a master password
+/// to ensure their ability to reset other users' accounts.</para>
+/// </summary>
+public interface ISetInitialMasterPasswordCommand
+{
+    public Task<IdentityResult> SetInitialMasterPasswordAsync(User user, string masterPassword, string key,
+        string orgSsoIdentifier);
+}
diff --git a/src/Core/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommand.cs b/src/Core/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommand.cs
new file mode 100644
index 000000000000..32966f571064
--- /dev/null
+++ b/src/Core/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommand.cs
@@ -0,0 +1,103 @@
+using Bit.Core.Auth.UserFeatures.UserMasterPassword.Interfaces;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Microsoft.AspNetCore.Identity;
+using Microsoft.Extensions.Logging;
+
+namespace Bit.Core.Auth.UserFeatures.UserMasterPassword;
+
+public class SetInitialMasterPasswordCommand : ISetInitialMasterPasswordCommand
+{
+    private readonly ILogger<SetInitialMasterPasswordCommand> _logger;
+    private readonly IdentityErrorDescriber _identityErrorDescriber;
+    private readonly IUserService _userService;
+    private readonly IUserRepository _userRepository;
+    private readonly IEventService _eventService;
+    private readonly IAcceptOrgUserCommand _acceptOrgUserCommand;
+    private readonly IOrganizationUserRepository _organizationUserRepository;
+    private readonly IOrganizationRepository _organizationRepository;
+
+
+    public SetInitialMasterPasswordCommand(
+        ILogger<SetInitialMasterPasswordCommand> logger,
+        IdentityErrorDescriber identityErrorDescriber,
+        IUserService userService,
+        IUserRepository userRepository,
+        IEventService eventService,
+        IAcceptOrgUserCommand acceptOrgUserCommand,
+        IOrganizationUserRepository organizationUserRepository,
+        IOrganizationRepository organizationRepository)
+    {
+        _logger = logger;
+        _identityErrorDescriber = identityErrorDescriber;
+        _userService = userService;
+        _userRepository = userRepository;
+        _eventService = eventService;
+        _acceptOrgUserCommand = acceptOrgUserCommand;
+        _organizationUserRepository = organizationUserRepository;
+        _organizationRepository = organizationRepository;
+    }
+
+    public async Task<IdentityResult> SetInitialMasterPasswordAsync(User user, string masterPassword, string key,
+        string orgSsoIdentifier)
+    {
+        if (user == null)
+        {
+            throw new ArgumentNullException(nameof(user));
+        }
+
+        if (!string.IsNullOrWhiteSpace(user.MasterPassword))
+        {
+            _logger.LogWarning("Change password failed for user {userId} - already has password.", user.Id);
+            return IdentityResult.Failed(_identityErrorDescriber.UserAlreadyHasPassword());
+        }
+
+        var result = await _userService.UpdatePasswordHash(user, masterPassword, validatePassword: true, refreshStamp: false);
+        if (!result.Succeeded)
+        {
+            return result;
+        }
+
+        user.RevisionDate = user.AccountRevisionDate = DateTime.UtcNow;
+        user.Key = key;
+
+        await _userRepository.ReplaceAsync(user);
+        await _eventService.LogUserEventAsync(user.Id, EventType.User_ChangedPassword);
+
+
+        if (string.IsNullOrWhiteSpace(orgSsoIdentifier))
+        {
+            throw new BadRequestException("Organization SSO Identifier required.");
+        }
+
+        var org = await _organizationRepository.GetByIdentifierAsync(orgSsoIdentifier);
+
+        if (org == null)
+        {
+            throw new BadRequestException("Organization invalid.");
+        }
+
+        var orgUser = await _organizationUserRepository.GetByOrganizationAsync(org.Id, user.Id);
+
+        if (orgUser == null)
+        {
+            throw new BadRequestException("User not found within organization.");
+        }
+
+        // TDE users who go from a user without admin acct recovery permission to having it will be
+        // required to set a MP for the first time and we don't want to re-execute the accept logic
+        // as they are already confirmed.
+        // TLDR: only accept post SSO user if they are invited
+        if (orgUser.Status == OrganizationUserStatusType.Invited)
+        {
+            await _acceptOrgUserCommand.AcceptOrgUserAsync(orgUser, user, _userService);
+        }
+
+        return IdentityResult.Success;
+    }
+
+}
diff --git a/src/Core/Auth/UserFeatures/UserServiceCollectionExtensions.cs b/src/Core/Auth/UserFeatures/UserServiceCollectionExtensions.cs
new file mode 100644
index 000000000000..eff162c7397b
--- /dev/null
+++ b/src/Core/Auth/UserFeatures/UserServiceCollectionExtensions.cs
@@ -0,0 +1,24 @@
+
+
+using Bit.Core.Auth.UserFeatures.UserMasterPassword;
+using Bit.Core.Auth.UserFeatures.UserMasterPassword.Interfaces;
+using Bit.Core.Services;
+using Bit.Core.Settings;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Bit.Core.Auth.UserFeatures;
+
+public static class UserServiceCollectionExtensions
+{
+    public static void AddUserServices(this IServiceCollection services, IGlobalSettings globalSettings)
+    {
+        services.AddScoped<IUserService, UserService>();
+        services.AddUserPasswordCommands();
+    }
+
+    private static void AddUserPasswordCommands(this IServiceCollection services)
+    {
+        services.AddScoped<ISetInitialMasterPasswordCommand, SetInitialMasterPasswordCommand>();
+    }
+
+}
diff --git a/src/Core/Constants.cs b/src/Core/Constants.cs
index a9be2451677b..e32b0f4ce45a 100644
--- a/src/Core/Constants.cs
+++ b/src/Core/Constants.cs
@@ -5,6 +5,7 @@ namespace Bit.Core;
 public static class Constants
 {
     public const int BypassFiltersEventId = 12482444;
+    public const int FailedSecretVerificationDelay = 2000;
 
     // File size limits - give 1 MB extra for cushion.
     // Note: if request size limits are changed, 'client_max_body_size'
@@ -23,6 +24,20 @@ public static class Constants
     public const string Fido2KeyCipherMinimumVersion = "2023.10.0";
 
     public const string CipherKeyEncryptionMinimumVersion = "2023.9.2";
+
+    /// <summary>
+    /// When you set the ProrationBehavior to create_prorations,
+    /// Stripe will automatically create prorations for any changes made to the subscription,
+    /// such as changing the plan, adding or removing quantities, or applying discounts.
+    /// </summary>
+    public const string CreateProrations = "create_prorations";
+
+    /// <summary>
+    /// When you set the ProrationBehavior to always_invoice,
+    /// Stripe will always generate an invoice when a subscription update occurs,
+    /// regardless of whether there is a proration or not.
+    /// </summary>
+    public const string AlwaysInvoice = "always_invoice";
 }
 
 public static class TokenPurposes
@@ -39,12 +54,16 @@ public static class FeatureFlagKeys
 {
     public const string DisplayEuEnvironment = "display-eu-environment";
     public const string DisplayLowKdfIterationWarning = "display-kdf-iteration-warning";
+    public const string PasswordlessLogin = "passwordless-login";
     public const string TrustedDeviceEncryption = "trusted-device-encryption";
     public const string Fido2VaultCredentials = "fido2-vault-credentials";
     public const string AutofillV2 = "autofill-v2";
     public const string BrowserFilelessImport = "browser-fileless-import";
     public const string FlexibleCollections = "flexible-collections";
     public const string BulkCollectionAccess = "bulk-collection-access";
+    public const string AutofillOverlay = "autofill-overlay";
+    public const string ItemShare = "item-share";
+    public const string BillingPlansUpgrade = "billing-plans-upgrade";
 
     public static List<string> GetAllKeys()
     {
diff --git a/src/Core/Context/CurrentContext.cs b/src/Core/Context/CurrentContext.cs
index 1def551a8c25..06255d796617 100644
--- a/src/Core/Context/CurrentContext.cs
+++ b/src/Core/Context/CurrentContext.cs
@@ -1,7 +1,10 @@
 using System.Security.Claims;
+using Bit.Core.AdminConsole.Context;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Identity;
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
diff --git a/src/Core/Context/ICurrentContext.cs b/src/Core/Context/ICurrentContext.cs
index 035a8263fe44..444843a035f7 100644
--- a/src/Core/Context/ICurrentContext.cs
+++ b/src/Core/Context/ICurrentContext.cs
@@ -1,6 +1,8 @@
 #nullable enable
 
 using System.Security.Claims;
+using Bit.Core.AdminConsole.Context;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Identity;
diff --git a/src/Core/Enums/PlanType.cs b/src/Core/Enums/PlanType.cs
index ac32f217e40d..cb88e83601c9 100644
--- a/src/Core/Enums/PlanType.cs
+++ b/src/Core/Enums/PlanType.cs
@@ -20,12 +20,20 @@ public enum PlanType : byte
     Custom = 6,
     [Display(Name = "Families")]
     FamiliesAnnually = 7,
+    [Display(Name = "Teams (Monthly) 2020")]
+    TeamsMonthly2020 = 8,
+    [Display(Name = "Teams (Annually) 2020")]
+    TeamsAnnually2020 = 9,
+    [Display(Name = "Enterprise (Monthly) 2020")]
+    EnterpriseMonthly2020 = 10,
+    [Display(Name = "Enterprise (Annually) 2020")]
+    EnterpriseAnnually2020 = 11,
     [Display(Name = "Teams (Monthly)")]
-    TeamsMonthly = 8,
+    TeamsMonthly = 12,
     [Display(Name = "Teams (Annually)")]
-    TeamsAnnually = 9,
+    TeamsAnnually = 13,
     [Display(Name = "Enterprise (Monthly)")]
-    EnterpriseMonthly = 10,
+    EnterpriseMonthly = 14,
     [Display(Name = "Enterprise (Annually)")]
-    EnterpriseAnnually = 11,
+    EnterpriseAnnually = 15,
 }
diff --git a/src/Core/Models/Business/InvoicePreviewResult.cs b/src/Core/Models/Business/InvoicePreviewResult.cs
new file mode 100644
index 000000000000..d9e211cfb216
--- /dev/null
+++ b/src/Core/Models/Business/InvoicePreviewResult.cs
@@ -0,0 +1,7 @@
+namespace Bit.Core.Models.Business;
+
+public class InvoicePreviewResult
+{
+    public bool IsInvoicedNow { get; set; }
+    public string PaymentIntentClientSecret { get; set; }
+}
diff --git a/src/Core/Models/Business/OrganizationLicense.cs b/src/Core/Models/Business/OrganizationLicense.cs
index c8060263c810..c9d6724184fb 100644
--- a/src/Core/Models/Business/OrganizationLicense.cs
+++ b/src/Core/Models/Business/OrganizationLicense.cs
@@ -184,8 +184,11 @@ public byte[] GetDataBytes(bool forHash = false)
                     (Version >= 11 || !p.Name.Equals(nameof(UseCustomPermissions))) &&
                     // ExpirationWithoutGracePeriod was added in Version 12
                     (Version >= 12 || !p.Name.Equals(nameof(ExpirationWithoutGracePeriod))) &&
-                    // UseSecretsManager was added in Version 13
+                    // UseSecretsManager, UsePasswordManager, SmSeats, and SmServiceAccounts were added in Version 13
                     (Version >= 13 || !p.Name.Equals(nameof(UseSecretsManager))) &&
+                    (Version >= 13 || !p.Name.Equals(nameof(UsePasswordManager))) &&
+                    (Version >= 13 || !p.Name.Equals(nameof(SmSeats))) &&
+                    (Version >= 13 || !p.Name.Equals(nameof(SmServiceAccounts))) &&
                     (
                         !forHash ||
                         (
diff --git a/src/Core/Models/Business/PendingInoviceItems.cs b/src/Core/Models/Business/PendingInoviceItems.cs
new file mode 100644
index 000000000000..1aee15a3aab6
--- /dev/null
+++ b/src/Core/Models/Business/PendingInoviceItems.cs
@@ -0,0 +1,9 @@
+using Stripe;
+
+namespace Bit.Core.Models.Business;
+
+public class PendingInoviceItems
+{
+    public IEnumerable<InvoiceItem> PendingInvoiceItems { get; set; }
+    public IDictionary<string, InvoiceItem> PendingInvoiceItemsDict { get; set; }
+}
diff --git a/src/Core/Models/Business/SecretsManagerSubscribeUpdate.cs b/src/Core/Models/Business/SecretsManagerSubscribeUpdate.cs
index 8f3fb89349cb..54bc8cb95ec0 100644
--- a/src/Core/Models/Business/SecretsManagerSubscribeUpdate.cs
+++ b/src/Core/Models/Business/SecretsManagerSubscribeUpdate.cs
@@ -44,7 +44,7 @@ private void AddNewSecretsManagerItems(List<SubscriptionItemOptions> updatedItem
         {
             updatedItems.Add(new SubscriptionItemOptions
             {
-                Price = _plan.SecretsManager.StripeSeatPlanId,
+                Plan = _plan.SecretsManager.StripeSeatPlanId,
                 Quantity = _additionalSeats
             });
         }
@@ -53,7 +53,7 @@ private void AddNewSecretsManagerItems(List<SubscriptionItemOptions> updatedItem
         {
             updatedItems.Add(new SubscriptionItemOptions
             {
-                Price = _plan.SecretsManager.StripeServiceAccountPlanId,
+                Plan = _plan.SecretsManager.StripeServiceAccountPlanId,
                 Quantity = _additionalServiceAccounts
             });
         }
@@ -63,14 +63,14 @@ private void RemovePreviousSecretsManagerItems(List<SubscriptionItemOptions> upd
     {
         updatedItems.Add(new SubscriptionItemOptions
         {
-            Price = _plan.SecretsManager.StripeSeatPlanId,
+            Plan = _plan.SecretsManager.StripeSeatPlanId,
             Quantity = _previousSeats,
             Deleted = _previousSeats == 0 ? true : (bool?)null,
         });
 
         updatedItems.Add(new SubscriptionItemOptions
         {
-            Price = _plan.SecretsManager.StripeServiceAccountPlanId,
+            Plan = _plan.SecretsManager.StripeServiceAccountPlanId,
             Quantity = _previousServiceAccounts,
             Deleted = _previousServiceAccounts == 0 ? true : (bool?)null,
         });
diff --git a/src/Core/Models/Data/Organizations/OrganizationUsers/OrganizationUserOrganizationDetails.cs b/src/Core/Models/Data/Organizations/OrganizationUsers/OrganizationUserOrganizationDetails.cs
index 428f79da0172..6566568c1768 100644
--- a/src/Core/Models/Data/Organizations/OrganizationUsers/OrganizationUserOrganizationDetails.cs
+++ b/src/Core/Models/Data/Organizations/OrganizationUsers/OrganizationUserOrganizationDetails.cs
@@ -1,4 +1,4 @@
-using Bit.Core.Enums.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
 
 namespace Bit.Core.Models.Data.Organizations.OrganizationUsers;
 
diff --git a/src/Core/Models/StaticStore/Plan.cs b/src/Core/Models/StaticStore/Plan.cs
index 4f8b0435fff2..c381215f3852 100644
--- a/src/Core/Models/StaticStore/Plan.cs
+++ b/src/Core/Models/StaticStore/Plan.cs
@@ -28,7 +28,7 @@ public abstract record Plan
     public bool HasCustomPermissions { get; protected init; }
     public int UpgradeSortOrder { get; protected init; }
     public int DisplaySortOrder { get; protected init; }
-    public int? LegacyYear { get; protected init; }
+    public int? LegacyYear { get; set; }
     public bool Disabled { get; protected init; }
     public PasswordManagerPlanFeatures PasswordManager { get; protected init; }
     public SecretsManagerPlanFeatures SecretsManager { get; protected init; }
diff --git a/src/Core/Models/StaticStore/Plans/Enterprise2019Plan.cs b/src/Core/Models/StaticStore/Plans/Enterprise2019Plan.cs
index 8cbb579ea239..7684b0897cb4 100644
--- a/src/Core/Models/StaticStore/Plans/Enterprise2019Plan.cs
+++ b/src/Core/Models/StaticStore/Plans/Enterprise2019Plan.cs
@@ -24,6 +24,10 @@ public Enterprise2019Plan(bool isAnnual)
         HasTotp = true;
         Has2fa = true;
         HasApi = true;
+        HasSso = true;
+        HasKeyConnector = true;
+        HasScim = true;
+        HasResetPassword = true;
         UsersGetPremium = true;
         HasCustomPermissions = true;
 
@@ -31,9 +35,41 @@ public Enterprise2019Plan(bool isAnnual)
         DisplaySortOrder = 3;
         LegacyYear = 2020;
 
+        SecretsManager = new Enterprise2019SecretsManagerFeatures(isAnnual);
         PasswordManager = new Enterprise2019PasswordManagerFeatures(isAnnual);
     }
 
+    private record Enterprise2019SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Enterprise2019SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 200;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 144;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 13;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
     private record Enterprise2019PasswordManagerFeatures : PasswordManagerPlanFeatures
     {
         public Enterprise2019PasswordManagerFeatures(bool isAnnual)
diff --git a/src/Core/Models/StaticStore/Plans/Enterprise2020Plan.cs b/src/Core/Models/StaticStore/Plans/Enterprise2020Plan.cs
new file mode 100644
index 000000000000..4fa7eee972c1
--- /dev/null
+++ b/src/Core/Models/StaticStore/Plans/Enterprise2020Plan.cs
@@ -0,0 +1,101 @@
+using Bit.Core.Enums;
+
+namespace Bit.Core.Models.StaticStore.Plans;
+
+public record Enterprise2020Plan : Models.StaticStore.Plan
+{
+    public Enterprise2020Plan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.EnterpriseAnnually2020 : PlanType.EnterpriseMonthly2020;
+        Product = ProductType.Enterprise;
+        Name = isAnnual ? "Enterprise (Annually) 2020" : "Enterprise (Monthly) 2020";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameEnterprise";
+        DescriptionLocalizationKey = "planDescEnterprise";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasPolicies = true;
+        HasSelfHost = true;
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        HasSso = true;
+        HasKeyConnector = true;
+        HasScim = true;
+        HasResetPassword = true;
+        UsersGetPremium = true;
+        HasCustomPermissions = true;
+
+        UpgradeSortOrder = 3;
+        DisplaySortOrder = 3;
+        LegacyYear = 2023;
+
+        PasswordManager = new Enterprise2020PasswordManagerFeatures(isAnnual);
+        SecretsManager = new Enterprise2020SecretsManagerFeatures(isAnnual);
+    }
+
+    private record Enterprise2020SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Enterprise2020SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 200;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 144;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-enterprise-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 13;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
+    private record Enterprise2020PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Enterprise2020PasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                AdditionalStoragePricePerGb = 4;
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "2020-enterprise-org-seat-annually";
+                SeatPrice = 60;
+            }
+            else
+            {
+                StripeSeatPlanId = "2020-enterprise-seat-monthly";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 6;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}
diff --git a/src/Core/Models/StaticStore/Plans/EnterprisePlan.cs b/src/Core/Models/StaticStore/Plans/EnterprisePlan.cs
index fbb319883916..61eabc64363e 100644
--- a/src/Core/Models/StaticStore/Plans/EnterprisePlan.cs
+++ b/src/Core/Models/StaticStore/Plans/EnterprisePlan.cs
@@ -85,14 +85,14 @@ public EnterprisePasswordManagerFeatures(bool isAnnual)
             {
                 AdditionalStoragePricePerGb = 4;
                 StripeStoragePlanId = "storage-gb-annually";
-                StripeSeatPlanId = "2020-enterprise-org-seat-annually";
-                SeatPrice = 60;
+                StripeSeatPlanId = "2023-enterprise-org-seat-annually";
+                SeatPrice = 72;
             }
             else
             {
-                StripeSeatPlanId = "2020-enterprise-seat-monthly";
+                StripeSeatPlanId = "2023-enterprise-seat-monthly";
                 StripeStoragePlanId = "storage-gb-monthly";
-                SeatPrice = 6;
+                SeatPrice = 7;
                 AdditionalStoragePricePerGb = 0.5M;
             }
         }
diff --git a/src/Core/Models/StaticStore/Plans/Families2019Plan.cs b/src/Core/Models/StaticStore/Plans/Families2019Plan.cs
index 14ddb3405bae..4bc9abc1f336 100644
--- a/src/Core/Models/StaticStore/Plans/Families2019Plan.cs
+++ b/src/Core/Models/StaticStore/Plans/Families2019Plan.cs
@@ -17,6 +17,7 @@ public Families2019Plan()
 
         HasSelfHost = true;
         HasTotp = true;
+        UsersGetPremium = true;
 
         UpgradeSortOrder = 1;
         DisplaySortOrder = 1;
diff --git a/src/Core/Models/StaticStore/Plans/Teams2019Plan.cs b/src/Core/Models/StaticStore/Plans/Teams2019Plan.cs
index f806f377354d..d81a015de8eb 100644
--- a/src/Core/Models/StaticStore/Plans/Teams2019Plan.cs
+++ b/src/Core/Models/StaticStore/Plans/Teams2019Plan.cs
@@ -16,15 +16,53 @@ public Teams2019Plan(bool isAnnual)
 
         TrialPeriodDays = 7;
 
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
         HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        UsersGetPremium = true;
 
         UpgradeSortOrder = 2;
         DisplaySortOrder = 2;
         LegacyYear = 2020;
 
+        SecretsManager = new Teams2019SecretsManagerFeatures(isAnnual);
         PasswordManager = new Teams2019PasswordManagerFeatures(isAnnual);
     }
 
+    private record Teams2019SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Teams2019SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 50;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 72;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 7;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
     private record Teams2019PasswordManagerFeatures : PasswordManagerPlanFeatures
     {
         public Teams2019PasswordManagerFeatures(bool isAnnual)
diff --git a/src/Core/Models/StaticStore/Plans/Teams2020Plan.cs b/src/Core/Models/StaticStore/Plans/Teams2020Plan.cs
new file mode 100644
index 000000000000..680a5deecec2
--- /dev/null
+++ b/src/Core/Models/StaticStore/Plans/Teams2020Plan.cs
@@ -0,0 +1,95 @@
+using Bit.Core.Enums;
+
+namespace Bit.Core.Models.StaticStore.Plans;
+
+public record Teams2020Plan : Models.StaticStore.Plan
+{
+    public Teams2020Plan(bool isAnnual)
+    {
+        Type = isAnnual ? PlanType.TeamsAnnually2020 : PlanType.TeamsMonthly2020;
+        Product = ProductType.Teams;
+        Name = isAnnual ? "Teams (Annually) 2020" : "Teams (Monthly) 2020";
+        IsAnnual = isAnnual;
+        NameLocalizationKey = "planNameTeams";
+        DescriptionLocalizationKey = "planDescTeams";
+        CanBeUsedByBusiness = true;
+
+        TrialPeriodDays = 7;
+
+        HasGroups = true;
+        HasDirectory = true;
+        HasEvents = true;
+        HasTotp = true;
+        Has2fa = true;
+        HasApi = true;
+        UsersGetPremium = true;
+
+        UpgradeSortOrder = 2;
+        DisplaySortOrder = 2;
+        LegacyYear = 2023;
+
+        PasswordManager = new Teams2020PasswordManagerFeatures(isAnnual);
+        SecretsManager = new Teams2020SecretsManagerFeatures(isAnnual);
+    }
+
+    private record Teams2020SecretsManagerFeatures : SecretsManagerPlanFeatures
+    {
+        public Teams2020SecretsManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BasePrice = 0;
+            BaseServiceAccount = 50;
+
+            HasAdditionalSeatsOption = true;
+            HasAdditionalServiceAccountOption = true;
+
+            AllowSeatAutoscale = true;
+            AllowServiceAccountsAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-annually";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-annually";
+                SeatPrice = 72;
+                AdditionalPricePerServiceAccount = 6;
+            }
+            else
+            {
+                StripeSeatPlanId = "secrets-manager-teams-seat-monthly";
+                StripeServiceAccountPlanId = "secrets-manager-service-account-monthly";
+                SeatPrice = 7;
+                AdditionalPricePerServiceAccount = 0.5M;
+            }
+        }
+    }
+
+    private record Teams2020PasswordManagerFeatures : PasswordManagerPlanFeatures
+    {
+        public Teams2020PasswordManagerFeatures(bool isAnnual)
+        {
+            BaseSeats = 0;
+            BaseStorageGb = 1;
+            BasePrice = 0;
+
+            HasAdditionalStorageOption = true;
+            HasAdditionalSeatsOption = true;
+
+            AllowSeatAutoscale = true;
+
+            if (isAnnual)
+            {
+                StripeStoragePlanId = "storage-gb-annually";
+                StripeSeatPlanId = "2020-teams-org-seat-annually";
+                SeatPrice = 36;
+                AdditionalStoragePricePerGb = 4;
+            }
+            else
+            {
+                StripeSeatPlanId = "2020-teams-org-seat-monthly";
+                StripeStoragePlanId = "storage-gb-monthly";
+                SeatPrice = 4;
+                AdditionalStoragePricePerGb = 0.5M;
+            }
+        }
+    }
+}
diff --git a/src/Core/Models/StaticStore/Plans/TeamsPlan.cs b/src/Core/Models/StaticStore/Plans/TeamsPlan.cs
index 0e325242e3f1..77482d10fbf0 100644
--- a/src/Core/Models/StaticStore/Plans/TeamsPlan.cs
+++ b/src/Core/Models/StaticStore/Plans/TeamsPlan.cs
@@ -78,15 +78,15 @@ public TeamsPasswordManagerFeatures(bool isAnnual)
             if (isAnnual)
             {
                 StripeStoragePlanId = "storage-gb-annually";
-                StripeSeatPlanId = "2020-teams-org-seat-annually";
-                SeatPrice = 36;
+                StripeSeatPlanId = "2023-teams-org-seat-annually";
+                SeatPrice = 48;
                 AdditionalStoragePricePerGb = 4;
             }
             else
             {
-                StripeSeatPlanId = "2020-teams-org-seat-monthly";
+                StripeSeatPlanId = "2023-teams-org-seat-monthly";
                 StripeStoragePlanId = "storage-gb-monthly";
-                SeatPrice = 4;
+                SeatPrice = 5;
                 AdditionalStoragePricePerGb = 0.5M;
             }
         }
diff --git a/src/Core/OrganizationFeatures/OrganizationServiceCollectionExtensions.cs b/src/Core/OrganizationFeatures/OrganizationServiceCollectionExtensions.cs
index ed8c598abb28..e70738e06a2a 100644
--- a/src/Core/OrganizationFeatures/OrganizationServiceCollectionExtensions.cs
+++ b/src/Core/OrganizationFeatures/OrganizationServiceCollectionExtensions.cs
@@ -2,15 +2,17 @@
 using Bit.Core.AdminConsole.OrganizationAuth.Interfaces;
 using Bit.Core.AdminConsole.OrganizationFeatures.Groups;
 using Bit.Core.AdminConsole.OrganizationFeatures.Groups.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Models.Business.Tokenables;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
 using Bit.Core.OrganizationFeatures.OrganizationCollections;
 using Bit.Core.OrganizationFeatures.OrganizationCollections.Interfaces;
-using Bit.Core.OrganizationFeatures.OrganizationConnections;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
-using Bit.Core.OrganizationFeatures.OrganizationDomains;
-using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.OrganizationFeatures.OrganizationLicenses;
 using Bit.Core.OrganizationFeatures.OrganizationLicenses.Interfaces;
 using Bit.Core.OrganizationFeatures.OrganizationSponsorships.FamiliesForEnterprise;
@@ -132,6 +134,7 @@ private static void AddOrganizationAuthCommands(this IServiceCollection services
     private static void AddOrganizationUserCommandsQueries(this IServiceCollection services)
     {
         services.AddScoped<ICountNewSmSeatsRequiredQuery, CountNewSmSeatsRequiredQuery>();
+        services.AddScoped<IAcceptOrgUserCommand, AcceptOrgUserCommand>();
     }
 
     // TODO: move to OrganizationSubscriptionServiceCollectionExtensions when OrganizationUser methods are moved out of
diff --git a/src/Core/OrganizationFeatures/OrganizationSubscriptions/AddSecretsManagerSubscriptionCommand.cs b/src/Core/OrganizationFeatures/OrganizationSubscriptions/AddSecretsManagerSubscriptionCommand.cs
index bd33f336e47e..951246bd25e8 100644
--- a/src/Core/OrganizationFeatures/OrganizationSubscriptions/AddSecretsManagerSubscriptionCommand.cs
+++ b/src/Core/OrganizationFeatures/OrganizationSubscriptions/AddSecretsManagerSubscriptionCommand.cs
@@ -1,10 +1,10 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
-using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
 
diff --git a/src/Core/OrganizationFeatures/OrganizationUsers/AcceptOrgUserCommand.cs b/src/Core/OrganizationFeatures/OrganizationUsers/AcceptOrgUserCommand.cs
new file mode 100644
index 000000000000..5baff54634ea
--- /dev/null
+++ b/src/Core/OrganizationFeatures/OrganizationUsers/AcceptOrgUserCommand.cs
@@ -0,0 +1,220 @@
+using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Bit.Core.Settings;
+using Bit.Core.Tokens;
+using Bit.Core.Utilities;
+using Microsoft.AspNetCore.DataProtection;
+
+namespace Bit.Core.OrganizationFeatures.OrganizationUsers;
+
+public class AcceptOrgUserCommand : IAcceptOrgUserCommand
+{
+    private readonly IDataProtector _dataProtector;
+    private readonly IGlobalSettings _globalSettings;
+    private readonly IOrganizationUserRepository _organizationUserRepository;
+    private readonly IOrganizationRepository _organizationRepository;
+    private readonly IPolicyService _policyService;
+    private readonly IMailService _mailService;
+    private readonly IUserRepository _userRepository;
+    private readonly IDataProtectorTokenFactory<OrgUserInviteTokenable> _orgUserInviteTokenDataFactory;
+
+    public AcceptOrgUserCommand(
+        IDataProtectionProvider dataProtectionProvider,
+        IGlobalSettings globalSettings,
+        IOrganizationUserRepository organizationUserRepository,
+        IOrganizationRepository organizationRepository,
+        IPolicyService policyService,
+        IMailService mailService,
+        IUserRepository userRepository,
+        IDataProtectorTokenFactory<OrgUserInviteTokenable> orgUserInviteTokenDataFactory)
+    {
+
+        // TODO: remove data protector when old token validation removed
+        _dataProtector = dataProtectionProvider.CreateProtector(OrgUserInviteTokenable.DataProtectorPurpose);
+        _globalSettings = globalSettings;
+        _organizationUserRepository = organizationUserRepository;
+        _organizationRepository = organizationRepository;
+        _policyService = policyService;
+        _mailService = mailService;
+        _userRepository = userRepository;
+        _orgUserInviteTokenDataFactory = orgUserInviteTokenDataFactory;
+    }
+
+    public async Task<OrganizationUser> AcceptOrgUserByEmailTokenAsync(Guid organizationUserId, User user, string emailToken,
+        IUserService userService)
+    {
+        var orgUser = await _organizationUserRepository.GetByIdAsync(organizationUserId);
+        if (orgUser == null)
+        {
+            throw new BadRequestException("User invalid.");
+        }
+
+        // Tokens will have been created in two ways in the OrganizationService invite methods:
+        // 1. New way - via OrgUserInviteTokenable
+        // 2. Old way - via manual process using data protector initialized with purpose: "OrganizationServiceDataProtector"
+        // For backwards compatibility, must check validity of both types of tokens and accept if either is valid
+
+        // TODO: PM-4142 - remove old token validation logic once 3 releases of backwards compatibility are complete
+        var newTokenValid = OrgUserInviteTokenable.ValidateOrgUserInviteStringToken(
+            _orgUserInviteTokenDataFactory, emailToken, orgUser);
+
+        var tokenValid = newTokenValid ||
+                         CoreHelpers.UserInviteTokenIsValid(_dataProtector, emailToken, user.Email, orgUser.Id,
+                             _globalSettings);
+
+        if (!tokenValid)
+        {
+            throw new BadRequestException("Invalid token.");
+        }
+
+        var existingOrgUserCount = await _organizationUserRepository.GetCountByOrganizationAsync(
+            orgUser.OrganizationId, user.Email, true);
+        if (existingOrgUserCount > 0)
+        {
+            if (orgUser.Status == OrganizationUserStatusType.Accepted)
+            {
+                throw new BadRequestException("Invitation already accepted. You will receive an email when your organization membership is confirmed.");
+            }
+            throw new BadRequestException("You are already part of this organization.");
+        }
+
+        if (string.IsNullOrWhiteSpace(orgUser.Email) ||
+            !orgUser.Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase))
+        {
+            throw new BadRequestException("User email does not match invite.");
+        }
+
+        var organizationUser = await AcceptOrgUserAsync(orgUser, user, userService);
+
+        // Verify user email if they accept org invite via email link
+        if (user.EmailVerified == false)
+        {
+            user.EmailVerified = true;
+            await _userRepository.ReplaceAsync(user);
+        }
+
+        return organizationUser;
+    }
+
+    private bool ValidateOrgUserInviteToken(string orgUserInviteToken, OrganizationUser orgUser)
+    {
+        return _orgUserInviteTokenDataFactory.TryUnprotect(orgUserInviteToken, out var decryptedToken)
+               && decryptedToken.Valid
+               && decryptedToken.TokenIsValid(orgUser);
+    }
+
+    public async Task<OrganizationUser> AcceptOrgUserByOrgSsoIdAsync(string orgSsoIdentifier, User user, IUserService userService)
+    {
+        var org = await _organizationRepository.GetByIdentifierAsync(orgSsoIdentifier);
+        if (org == null)
+        {
+            throw new BadRequestException("Organization invalid.");
+        }
+
+        var orgUser = await _organizationUserRepository.GetByOrganizationAsync(org.Id, user.Id);
+        if (orgUser == null)
+        {
+            throw new BadRequestException("User not found within organization.");
+        }
+
+        return await AcceptOrgUserAsync(orgUser, user, userService);
+    }
+
+    public async Task<OrganizationUser> AcceptOrgUserByOrgIdAsync(Guid organizationId, User user, IUserService userService)
+    {
+        var org = await _organizationRepository.GetByIdAsync(organizationId);
+        if (org == null)
+        {
+            throw new BadRequestException("Organization invalid.");
+        }
+
+        var orgUser = await _organizationUserRepository.GetByOrganizationAsync(org.Id, user.Id);
+        if (orgUser == null)
+        {
+            throw new BadRequestException("User not found within organization.");
+        }
+
+        return await AcceptOrgUserAsync(orgUser, user, userService);
+    }
+
+    public async Task<OrganizationUser> AcceptOrgUserAsync(OrganizationUser orgUser, User user,
+        IUserService userService)
+    {
+        if (orgUser.Status == OrganizationUserStatusType.Revoked)
+        {
+            throw new BadRequestException("Your organization access has been revoked.");
+        }
+
+        if (orgUser.Status != OrganizationUserStatusType.Invited)
+        {
+            throw new BadRequestException("Already accepted.");
+        }
+
+        if (orgUser.Type == OrganizationUserType.Owner || orgUser.Type == OrganizationUserType.Admin)
+        {
+            var org = await _organizationRepository.GetByIdAsync(orgUser.OrganizationId);
+            if (org.PlanType == PlanType.Free)
+            {
+                var adminCount = await _organizationUserRepository.GetCountByFreeOrganizationAdminUserAsync(
+                    user.Id);
+                if (adminCount > 0)
+                {
+                    throw new BadRequestException("You can only be an admin of one free organization.");
+                }
+            }
+        }
+
+        // Enforce Single Organization Policy of organization user is trying to join
+        var allOrgUsers = await _organizationUserRepository.GetManyByUserAsync(user.Id);
+        var hasOtherOrgs = allOrgUsers.Any(ou => ou.OrganizationId != orgUser.OrganizationId);
+        var invitedSingleOrgPolicies = await _policyService.GetPoliciesApplicableToUserAsync(user.Id,
+            PolicyType.SingleOrg, OrganizationUserStatusType.Invited);
+
+        if (hasOtherOrgs && invitedSingleOrgPolicies.Any(p => p.OrganizationId == orgUser.OrganizationId))
+        {
+            throw new BadRequestException("You may not join this organization until you leave or remove all other organizations.");
+        }
+
+        // Enforce Single Organization Policy of other organizations user is a member of
+        var anySingleOrgPolicies = await _policyService.AnyPoliciesApplicableToUserAsync(user.Id,
+            PolicyType.SingleOrg);
+        if (anySingleOrgPolicies)
+        {
+            throw new BadRequestException("You cannot join this organization because you are a member of another organization which forbids it");
+        }
+
+        // Enforce Two Factor Authentication Policy of organization user is trying to join
+        if (!await userService.TwoFactorIsEnabledAsync(user))
+        {
+            var invitedTwoFactorPolicies = await _policyService.GetPoliciesApplicableToUserAsync(user.Id,
+                PolicyType.TwoFactorAuthentication, OrganizationUserStatusType.Invited);
+            if (invitedTwoFactorPolicies.Any(p => p.OrganizationId == orgUser.OrganizationId))
+            {
+                throw new BadRequestException("You cannot join this organization until you enable two-step login on your user account.");
+            }
+        }
+
+        orgUser.Status = OrganizationUserStatusType.Accepted;
+        orgUser.UserId = user.Id;
+        orgUser.Email = null;
+
+        await _organizationUserRepository.ReplaceAsync(orgUser);
+
+        var admins = await _organizationUserRepository.GetManyByMinimumRoleAsync(orgUser.OrganizationId, OrganizationUserType.Admin);
+        var adminEmails = admins.Select(a => a.Email).Distinct().ToList();
+
+        if (adminEmails.Count > 0)
+        {
+            var organization = await _organizationRepository.GetByIdAsync(orgUser.OrganizationId);
+            await _mailService.SendOrganizationAcceptedEmailAsync(organization, user.Email, adminEmails);
+        }
+
+        return orgUser;
+    }
+
+}
diff --git a/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IAcceptOrgUserCommand.cs b/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IAcceptOrgUserCommand.cs
new file mode 100644
index 000000000000..14cabda52137
--- /dev/null
+++ b/src/Core/OrganizationFeatures/OrganizationUsers/Interfaces/IAcceptOrgUserCommand.cs
@@ -0,0 +1,18 @@
+using Bit.Core.Entities;
+using Bit.Core.Services;
+
+namespace Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
+
+public interface IAcceptOrgUserCommand
+{
+    /// <summary>
+    /// Moves an OrganizationUser into the Accepted status and marks their email as verified.
+    /// This method is used where the user has clicked the invitation link sent by email.
+    /// </summary>
+    /// <param name="emailToken">The token embedded in the email invitation link</param>
+    /// <returns>The accepted OrganizationUser.</returns>
+    Task<OrganizationUser> AcceptOrgUserByEmailTokenAsync(Guid organizationUserId, User user, string emailToken, IUserService userService);
+    Task<OrganizationUser> AcceptOrgUserByOrgSsoIdAsync(string orgIdentifier, User user, IUserService userService);
+    Task<OrganizationUser> AcceptOrgUserByOrgIdAsync(Guid organizationId, User user, IUserService userService);
+    Task<OrganizationUser> AcceptOrgUserAsync(OrganizationUser orgUser, User user, IUserService userService);
+}
diff --git a/src/Core/Services/IApplicationCacheService.cs b/src/Core/Services/IApplicationCacheService.cs
index 7c21fac76f6f..0537251af2ef 100644
--- a/src/Core/Services/IApplicationCacheService.cs
+++ b/src/Core/Services/IApplicationCacheService.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.Entities;
 using Bit.Core.Models.Data.Organizations;
 
 namespace Bit.Core.Services;
diff --git a/src/Core/Services/IEventService.cs b/src/Core/Services/IEventService.cs
index 91a1a0782e2f..38d147b50b91 100644
--- a/src/Core/Services/IEventService.cs
+++ b/src/Core/Services/IEventService.cs
@@ -1,6 +1,6 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
 using Bit.Core.SecretsManager.Entities;
 using Bit.Core.Vault.Entities;
diff --git a/src/Core/Services/IMailService.cs b/src/Core/Services/IMailService.cs
index 6350a0e46183..1b673c9fae9f 100644
--- a/src/Core/Services/IMailService.cs
+++ b/src/Core/Services/IMailService.cs
@@ -1,7 +1,7 @@
-using Bit.Core.Auth.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Models.Business;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Models.Mail;
 
 namespace Bit.Core.Services;
diff --git a/src/Core/Services/IOrganizationService.cs b/src/Core/Services/IOrganizationService.cs
index 437e43a9b2c8..a2e23e48d552 100644
--- a/src/Core/Services/IOrganizationService.cs
+++ b/src/Core/Services/IOrganizationService.cs
@@ -40,15 +40,6 @@ Task<OrganizationUser> InviteUserAsync(Guid organizationId, EventSystemUser syst
         OrganizationUserType type, bool accessAll, string externalId, IEnumerable<CollectionAccessSelection> collections, IEnumerable<Guid> groups);
     Task<IEnumerable<Tuple<OrganizationUser, string>>> ResendInvitesAsync(Guid organizationId, Guid? invitingUserId, IEnumerable<Guid> organizationUsersId);
     Task ResendInviteAsync(Guid organizationId, Guid? invitingUserId, Guid organizationUserId, bool initOrganization = false);
-    /// <summary>
-    /// Moves an OrganizationUser into the Accepted status and marks their email as verified.
-    /// This method is used where the user has clicked the invitation link sent by email.
-    /// </summary>
-    /// <param name="token">The token embedded in the email invitation link</param>
-    /// <returns>The accepted OrganizationUser.</returns>
-    Task<OrganizationUser> AcceptUserAsync(Guid organizationUserId, User user, string token, IUserService userService);
-    Task<OrganizationUser> AcceptUserAsync(string orgIdentifier, User user, IUserService userService);
-    Task<OrganizationUser> AcceptUserAsync(Guid organizationId, User user, IUserService userService);
     Task<OrganizationUser> ConfirmUserAsync(Guid organizationId, Guid organizationUserId, string key,
         Guid confirmingUserId, IUserService userService);
     Task<List<Tuple<OrganizationUser, string>>> ConfirmUsersAsync(Guid organizationId, Dictionary<Guid, string> keys,
diff --git a/src/Core/Services/IStripeAdapter.cs b/src/Core/Services/IStripeAdapter.cs
index ff922161cc77..4f1cdd37eb2f 100644
--- a/src/Core/Services/IStripeAdapter.cs
+++ b/src/Core/Services/IStripeAdapter.cs
@@ -1,4 +1,5 @@
 using Bit.Core.Models.BitStripe;
+using Stripe;
 
 namespace Bit.Core.Services;
 
@@ -14,8 +15,11 @@ public interface IStripeAdapter
     Task<Stripe.Subscription> SubscriptionUpdateAsync(string id, Stripe.SubscriptionUpdateOptions options = null);
     Task<Stripe.Subscription> SubscriptionCancelAsync(string Id, Stripe.SubscriptionCancelOptions options = null);
     Task<Stripe.Invoice> InvoiceUpcomingAsync(Stripe.UpcomingInvoiceOptions options);
+    Task<Stripe.Invoice> InvoiceCreateAsync(Stripe.InvoiceCreateOptions options);
+    Task<Stripe.InvoiceItem> InvoiceItemCreateAsync(Stripe.InvoiceItemCreateOptions options);
     Task<Stripe.Invoice> InvoiceGetAsync(string id, Stripe.InvoiceGetOptions options);
     Task<Stripe.StripeList<Stripe.Invoice>> InvoiceListAsync(Stripe.InvoiceListOptions options);
+    IEnumerable<InvoiceItem> InvoiceItemListAsync(InvoiceItemListOptions options);
     Task<Stripe.Invoice> InvoiceUpdateAsync(string id, Stripe.InvoiceUpdateOptions options);
     Task<Stripe.Invoice> InvoiceFinalizeInvoiceAsync(string id, Stripe.InvoiceFinalizeOptions options);
     Task<Stripe.Invoice> InvoiceSendInvoiceAsync(string id, Stripe.InvoiceSendOptions options);
diff --git a/src/Core/Services/IUserService.cs b/src/Core/Services/IUserService.cs
index d0c078d40645..3340ec6a707b 100644
--- a/src/Core/Services/IUserService.cs
+++ b/src/Core/Services/IUserService.cs
@@ -27,13 +27,16 @@ public interface IUserService
     Task<CredentialCreateOptions> StartWebAuthnRegistrationAsync(User user);
     Task<bool> DeleteWebAuthnKeyAsync(User user, int id);
     Task<bool> CompleteWebAuthRegistrationAsync(User user, int value, string name, AuthenticatorAttestationRawResponse attestationResponse);
+    Task<CredentialCreateOptions> StartWebAuthnLoginRegistrationAsync(User user);
+    Task<bool> CompleteWebAuthLoginRegistrationAsync(User user, string name, CredentialCreateOptions options, AuthenticatorAttestationRawResponse attestationResponse);
+    Task<AssertionOptions> StartWebAuthnLoginAssertionAsync(User user);
+    Task<string> CompleteWebAuthLoginAssertionAsync(AuthenticatorAssertionRawResponse assertionResponse, User user);
     Task SendEmailVerificationAsync(User user);
     Task<IdentityResult> ConfirmEmailAsync(User user, string token);
     Task InitiateEmailChangeAsync(User user, string newEmail);
     Task<IdentityResult> ChangeEmailAsync(User user, string masterPassword, string newEmail, string newMasterPassword,
         string token, string key);
     Task<IdentityResult> ChangePasswordAsync(User user, string masterPassword, string newMasterPassword, string passwordHint, string key);
-    Task<IdentityResult> SetPasswordAsync(User user, string newMasterPassword, string key, string orgIdentifier = null);
     Task<IdentityResult> SetKeyConnectorKeyAsync(User user, string key, string orgIdentifier);
     Task<IdentityResult> ConvertToKeyConnectorAsync(User user);
     Task<IdentityResult> AdminResetPasswordAsync(OrganizationUserType type, Guid orgId, Guid id, string newMasterPassword, string key);
@@ -74,6 +77,9 @@ Task<UserLicense> GenerateLicenseAsync(User user, SubscriptionInfo subscriptionI
     Task<bool> TwoFactorIsEnabledAsync(ITwoFactorProvidersUser user);
     Task<bool> TwoFactorProviderIsEnabledAsync(TwoFactorProviderType provider, ITwoFactorProvidersUser user);
     Task<string> GenerateSignInTokenAsync(User user, string purpose);
+
+    Task<IdentityResult> UpdatePasswordHash(User user, string newPassword,
+        bool validatePassword = true, bool refreshStamp = true);
     Task RotateApiKeyAsync(User user);
     string GetUserName(ClaimsPrincipal principal);
     Task SendOTPAsync(User user);
diff --git a/src/Core/Services/Implementations/CollectionService.cs b/src/Core/Services/Implementations/CollectionService.cs
index 5e907e927cb9..0e703dcedf8b 100644
--- a/src/Core/Services/Implementations/CollectionService.cs
+++ b/src/Core/Services/Implementations/CollectionService.cs
@@ -103,7 +103,13 @@ public async Task DeleteUserAsync(Collection collection, Guid organizationUserId
 
     public async Task<IEnumerable<Collection>> GetOrganizationCollectionsAsync(Guid organizationId)
     {
-        if (!await _currentContext.ViewAssignedCollections(organizationId) && !await _currentContext.ManageUsers(organizationId) && !await _currentContext.ManageGroups(organizationId) && !await _currentContext.AccessImportExport(organizationId))
+        if (
+            !await _currentContext.ViewAssignedCollections(organizationId) &&
+            !await _currentContext.ViewAllCollections(organizationId) &&
+            !await _currentContext.ManageUsers(organizationId) &&
+            !await _currentContext.ManageGroups(organizationId) &&
+            !await _currentContext.AccessImportExport(organizationId)
+        )
         {
             throw new NotFoundException();
         }
diff --git a/src/Core/Services/Implementations/EventService.cs b/src/Core/Services/Implementations/EventService.cs
index e2545ba6e5a3..a11354c5177d 100644
--- a/src/Core/Services/Implementations/EventService.cs
+++ b/src/Core/Services/Implementations/EventService.cs
@@ -1,7 +1,9 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations;
diff --git a/src/Core/Services/Implementations/HandlebarsMailService.cs b/src/Core/Services/Implementations/HandlebarsMailService.cs
index 24974f7ff061..0e55407da73f 100644
--- a/src/Core/Services/Implementations/HandlebarsMailService.cs
+++ b/src/Core/Services/Implementations/HandlebarsMailService.cs
@@ -1,10 +1,10 @@
 using System.Net;
 using System.Reflection;
+using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Models.Business;
 using Bit.Core.Auth.Models.Mail;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Models.Mail;
 using Bit.Core.Models.Mail.FamiliesForEnterprise;
 using Bit.Core.Models.Mail.Provider;
diff --git a/src/Core/Services/Implementations/InMemoryApplicationCacheService.cs b/src/Core/Services/Implementations/InMemoryApplicationCacheService.cs
index dc23fcdb825f..140392ba2b04 100644
--- a/src/Core/Services/Implementations/InMemoryApplicationCacheService.cs
+++ b/src/Core/Services/Implementations/InMemoryApplicationCacheService.cs
@@ -1,6 +1,7 @@
-using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Entities;
 using Bit.Core.Models.Data.Organizations;
 using Bit.Core.Repositories;
 
diff --git a/src/Core/Services/Implementations/InMemoryServiceBusApplicationCacheService.cs b/src/Core/Services/Implementations/InMemoryServiceBusApplicationCacheService.cs
index 7067efd82cf2..e4ae0331696c 100644
--- a/src/Core/Services/Implementations/InMemoryServiceBusApplicationCacheService.cs
+++ b/src/Core/Services/Implementations/InMemoryServiceBusApplicationCacheService.cs
@@ -1,4 +1,5 @@
 using Azure.Messaging.ServiceBus;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Repositories;
diff --git a/src/Core/Services/Implementations/OrganizationService.cs b/src/Core/Services/Implementations/OrganizationService.cs
index 449ed71e43e1..aa8808244a17 100644
--- a/src/Core/Services/Implementations/OrganizationService.cs
+++ b/src/Core/Services/Implementations/OrganizationService.cs
@@ -1,28 +1,29 @@
 using System.Security.Claims;
 using System.Text.Json;
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.AdminConsole.Models.Business;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models.Business;
+using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Auth.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations.Policies;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
-using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Settings;
+using Bit.Core.Tokens;
 using Bit.Core.Tools.Enums;
 using Bit.Core.Tools.Models.Business;
 using Bit.Core.Tools.Services;
 using Bit.Core.Utilities;
-using Microsoft.AspNetCore.DataProtection;
 using Microsoft.Extensions.Logging;
 using Stripe;
 
@@ -35,7 +36,6 @@ public class OrganizationService : IOrganizationService
     private readonly ICollectionRepository _collectionRepository;
     private readonly IUserRepository _userRepository;
     private readonly IGroupRepository _groupRepository;
-    private readonly IDataProtector _dataProtector;
     private readonly IMailService _mailService;
     private readonly IPushNotificationService _pushNotificationService;
     private readonly IPushRegistrationService _pushRegistrationService;
@@ -57,6 +57,8 @@ public class OrganizationService : IOrganizationService
     private readonly IProviderUserRepository _providerUserRepository;
     private readonly ICountNewSmSeatsRequiredQuery _countNewSmSeatsRequiredQuery;
     private readonly IUpdateSecretsManagerSubscriptionCommand _updateSecretsManagerSubscriptionCommand;
+    private readonly IOrgUserInviteTokenableFactory _orgUserInviteTokenableFactory;
+    private readonly IDataProtectorTokenFactory<OrgUserInviteTokenable> _orgUserInviteTokenDataFactory;
     private readonly IFeatureService _featureService;
 
     public OrganizationService(
@@ -65,7 +67,6 @@ public OrganizationService(
         ICollectionRepository collectionRepository,
         IUserRepository userRepository,
         IGroupRepository groupRepository,
-        IDataProtectionProvider dataProtectionProvider,
         IMailService mailService,
         IPushNotificationService pushNotificationService,
         IPushRegistrationService pushRegistrationService,
@@ -86,6 +87,8 @@ public OrganizationService(
         IProviderOrganizationRepository providerOrganizationRepository,
         IProviderUserRepository providerUserRepository,
         ICountNewSmSeatsRequiredQuery countNewSmSeatsRequiredQuery,
+        IOrgUserInviteTokenableFactory orgUserInviteTokenableFactory,
+        IDataProtectorTokenFactory<OrgUserInviteTokenable> orgUserInviteTokenDataFactory,
         IUpdateSecretsManagerSubscriptionCommand updateSecretsManagerSubscriptionCommand,
         IFeatureService featureService)
     {
@@ -94,7 +97,6 @@ public OrganizationService(
         _collectionRepository = collectionRepository;
         _userRepository = userRepository;
         _groupRepository = groupRepository;
-        _dataProtector = dataProtectionProvider.CreateProtector("OrganizationServiceDataProtector");
         _mailService = mailService;
         _pushNotificationService = pushNotificationService;
         _pushRegistrationService = pushRegistrationService;
@@ -116,6 +118,8 @@ public OrganizationService(
         _providerUserRepository = providerUserRepository;
         _countNewSmSeatsRequiredQuery = countNewSmSeatsRequiredQuery;
         _updateSecretsManagerSubscriptionCommand = updateSecretsManagerSubscriptionCommand;
+        _orgUserInviteTokenableFactory = orgUserInviteTokenableFactory;
+        _orgUserInviteTokenDataFactory = orgUserInviteTokenDataFactory;
         _featureService = featureService;
     }
 
@@ -1060,176 +1064,33 @@ public async Task ResendInviteAsync(Guid organizationId, Guid? invitingUserId, G
 
     private async Task SendInvitesAsync(IEnumerable<OrganizationUser> orgUsers, Organization organization)
     {
-        string MakeToken(OrganizationUser orgUser) =>
-            _dataProtector.Protect($"OrganizationUserInvite {orgUser.Id} {orgUser.Email} {CoreHelpers.ToEpocMilliseconds(DateTime.UtcNow)}");
-
-        await _mailService.BulkSendOrganizationInviteEmailAsync(organization.Name,
-            orgUsers.Select(o => (o, new ExpiringToken(MakeToken(o), DateTime.UtcNow.AddDays(5)))), organization.PlanType == PlanType.Free);
-    }
-
-    private async Task SendInviteAsync(OrganizationUser orgUser, Organization organization, bool initOrganization)
-    {
-        var now = DateTime.UtcNow;
-        var nowMillis = CoreHelpers.ToEpocMilliseconds(now);
-        var token = _dataProtector.Protect(
-            $"OrganizationUserInvite {orgUser.Id} {orgUser.Email} {nowMillis}");
-        await _mailService.SendOrganizationInviteEmailAsync(organization.Name, orgUser, new ExpiringToken(token, now.AddDays(5)), organization.PlanType == PlanType.Free, initOrganization);
-    }
-
-    public async Task<OrganizationUser> AcceptUserAsync(Guid organizationUserId, User user, string token,
-        IUserService userService)
-    {
-        var orgUser = await _organizationUserRepository.GetByIdAsync(organizationUserId);
-        if (orgUser == null)
-        {
-            throw new BadRequestException("User invalid.");
-        }
-
-        if (!CoreHelpers.UserInviteTokenIsValid(_dataProtector, token, user.Email, orgUser.Id, _globalSettings))
-        {
-            throw new BadRequestException("Invalid token.");
-        }
-
-        var existingOrgUserCount = await _organizationUserRepository.GetCountByOrganizationAsync(
-            orgUser.OrganizationId, user.Email, true);
-        if (existingOrgUserCount > 0)
+        (OrganizationUser, ExpiringToken) MakeOrgUserExpiringTokenPair(OrganizationUser orgUser)
         {
-            if (orgUser.Status == OrganizationUserStatusType.Accepted)
-            {
-                throw new BadRequestException("Invitation already accepted. You will receive an email when your organization membership is confirmed.");
-            }
-            throw new BadRequestException("You are already part of this organization.");
-        }
-
-        if (string.IsNullOrWhiteSpace(orgUser.Email) ||
-            !orgUser.Email.Equals(user.Email, StringComparison.InvariantCultureIgnoreCase))
-        {
-            throw new BadRequestException("User email does not match invite.");
+            var orgUserInviteTokenable = _orgUserInviteTokenableFactory.CreateToken(orgUser);
+            var protectedToken = _orgUserInviteTokenDataFactory.Protect(orgUserInviteTokenable);
+            return (orgUser, new ExpiringToken(protectedToken, orgUserInviteTokenable.ExpirationDate));
         }
 
-        var organizationUser = await AcceptUserAsync(orgUser, user, userService);
+        var orgUsersWithExpTokens = orgUsers.Select(MakeOrgUserExpiringTokenPair);
 
-        if (user.EmailVerified == false)
-        {
-            user.EmailVerified = true;
-            await _userRepository.ReplaceAsync(user);
-        }
-
-        return organizationUser;
+        await _mailService.BulkSendOrganizationInviteEmailAsync(
+            organization.Name,
+            orgUsersWithExpTokens,
+            organization.PlanType == PlanType.Free
+        );
     }
 
-    public async Task<OrganizationUser> AcceptUserAsync(string orgIdentifier, User user, IUserService userService)
-    {
-        var org = await _organizationRepository.GetByIdentifierAsync(orgIdentifier);
-        if (org == null)
-        {
-            throw new BadRequestException("Organization invalid.");
-        }
-
-        var usersOrgs = await _organizationUserRepository.GetManyByUserAsync(user.Id);
-        var orgUser = usersOrgs.FirstOrDefault(u => u.OrganizationId == org.Id);
-        if (orgUser == null)
-        {
-            throw new BadRequestException("User not found within organization.");
-        }
-
-        return await AcceptUserAsync(orgUser, user, userService);
-    }
-
-    public async Task<OrganizationUser> AcceptUserAsync(Guid organizationId, User user, IUserService userService)
-    {
-        var org = await _organizationRepository.GetByIdAsync(organizationId);
-        if (org == null)
-        {
-            throw new BadRequestException("Organization invalid.");
-        }
-
-        var usersOrgs = await _organizationUserRepository.GetManyByUserAsync(user.Id);
-        var orgUser = usersOrgs.FirstOrDefault(u => u.OrganizationId == org.Id);
-        if (orgUser == null)
-        {
-            throw new BadRequestException("User not found within organization.");
-        }
-
-        return await AcceptUserAsync(orgUser, user, userService);
-    }
-
-    private async Task<OrganizationUser> AcceptUserAsync(OrganizationUser orgUser, User user,
-        IUserService userService)
+    private async Task SendInviteAsync(OrganizationUser orgUser, Organization organization, bool initOrganization)
     {
-        if (orgUser.Status == OrganizationUserStatusType.Revoked)
-        {
-            throw new BadRequestException("Your organization access has been revoked.");
-        }
-
-        if (orgUser.Status != OrganizationUserStatusType.Invited)
-        {
-            throw new BadRequestException("Already accepted.");
-        }
-
-        if (orgUser.Type == OrganizationUserType.Owner || orgUser.Type == OrganizationUserType.Admin)
-        {
-            var org = await GetOrgById(orgUser.OrganizationId);
-            if (org.PlanType == PlanType.Free)
-            {
-                var adminCount = await _organizationUserRepository.GetCountByFreeOrganizationAdminUserAsync(
-                    user.Id);
-                if (adminCount > 0)
-                {
-                    throw new BadRequestException("You can only be an admin of one free organization.");
-                }
-            }
-        }
-
-        // Enforce Single Organization Policy of organization user is trying to join
-        var allOrgUsers = await _organizationUserRepository.GetManyByUserAsync(user.Id);
-        var hasOtherOrgs = allOrgUsers.Any(ou => ou.OrganizationId != orgUser.OrganizationId);
-        var invitedSingleOrgPolicies = await _policyService.GetPoliciesApplicableToUserAsync(user.Id,
-            PolicyType.SingleOrg, OrganizationUserStatusType.Invited);
-
-        if (hasOtherOrgs && invitedSingleOrgPolicies.Any(p => p.OrganizationId == orgUser.OrganizationId))
-        {
-            throw new BadRequestException("You may not join this organization until you leave or remove " +
-                "all other organizations.");
-        }
-
-        // Enforce Single Organization Policy of other organizations user is a member of
-        var anySingleOrgPolicies = await _policyService.AnyPoliciesApplicableToUserAsync(user.Id,
-            PolicyType.SingleOrg);
-        if (anySingleOrgPolicies)
-        {
-            throw new BadRequestException("You cannot join this organization because you are a member of " +
-                "another organization which forbids it");
-        }
-
-        // Enforce Two Factor Authentication Policy of organization user is trying to join
-        if (!await userService.TwoFactorIsEnabledAsync(user))
-        {
-            var invitedTwoFactorPolicies = await _policyService.GetPoliciesApplicableToUserAsync(user.Id,
-                PolicyType.TwoFactorAuthentication, OrganizationUserStatusType.Invited);
-            if (invitedTwoFactorPolicies.Any(p => p.OrganizationId == orgUser.OrganizationId))
-            {
-                throw new BadRequestException("You cannot join this organization until you enable " +
-                    "two-step login on your user account.");
-            }
-        }
-
-        orgUser.Status = OrganizationUserStatusType.Accepted;
-        orgUser.UserId = user.Id;
-        orgUser.Email = null;
-
-        await _organizationUserRepository.ReplaceAsync(orgUser);
-
-        var admins = await _organizationUserRepository.GetManyByMinimumRoleAsync(orgUser.OrganizationId, OrganizationUserType.Admin);
-        var adminEmails = admins.Select(a => a.Email).Distinct().ToList();
-
-        if (adminEmails.Count > 0)
-        {
-            var organization = await _organizationRepository.GetByIdAsync(orgUser.OrganizationId);
-            await _mailService.SendOrganizationAcceptedEmailAsync(organization, user.Email, adminEmails);
-        }
-
-        return orgUser;
+        var orgUserInviteTokenable = _orgUserInviteTokenableFactory.CreateToken(orgUser);
+        var protectedToken = _orgUserInviteTokenDataFactory.Protect(orgUserInviteTokenable);
+        await _mailService.SendOrganizationInviteEmailAsync(
+            organization.Name,
+            orgUser,
+            new ExpiringToken(protectedToken, orgUserInviteTokenable.ExpirationDate),
+            organization.PlanType == PlanType.Free,
+            initOrganization
+        );
     }
 
     public async Task<OrganizationUser> ConfirmUserAsync(Guid organizationId, Guid organizationUserId, string key,
diff --git a/src/Core/Services/Implementations/PolicyService.cs b/src/Core/Services/Implementations/PolicyService.cs
index 5f4e680df74d..2c9b6c73e1bb 100644
--- a/src/Core/Services/Implementations/PolicyService.cs
+++ b/src/Core/Services/Implementations/PolicyService.cs
@@ -98,14 +98,6 @@ public async Task SaveAsync(Policy policy, IUserService userService, IOrganizati
                     await DependsOnSingleOrgAsync(org);
                 }
                 break;
-
-            // Activate Autofill is only available to Enterprise 2020-current plans
-            case PolicyType.ActivateAutofill:
-                if (policy.Enabled)
-                {
-                    LockedTo2020Plan(org);
-                }
-                break;
         }
 
         var now = DateTime.UtcNow;
@@ -274,14 +266,6 @@ private async Task RequiredByVaultTimeoutAsync(Organization org)
         }
     }
 
-    private void LockedTo2020Plan(Organization org)
-    {
-        if (org.PlanType != PlanType.EnterpriseAnnually && org.PlanType != PlanType.EnterpriseMonthly)
-        {
-            throw new BadRequestException("This policy is only available to 2020 Enterprise plans.");
-        }
-    }
-
     private async Task RequiredBySsoTrustedDeviceEncryptionAsync(Organization org)
     {
         var ssoConfig = await _ssoConfigRepository.GetByOrganizationIdAsync(org.Id);
diff --git a/src/Core/Services/Implementations/StripeAdapter.cs b/src/Core/Services/Implementations/StripeAdapter.cs
index b4776bc6efda..478d092fdcef 100644
--- a/src/Core/Services/Implementations/StripeAdapter.cs
+++ b/src/Core/Services/Implementations/StripeAdapter.cs
@@ -1,4 +1,5 @@
 using Bit.Core.Models.BitStripe;
+using Stripe;
 
 namespace Bit.Core.Services;
 
@@ -16,6 +17,7 @@ public class StripeAdapter : IStripeAdapter
     private readonly Stripe.BankAccountService _bankAccountService;
     private readonly Stripe.PriceService _priceService;
     private readonly Stripe.TestHelpers.TestClockService _testClockService;
+    private readonly Stripe.InvoiceItemService _invoiceItemService;
 
     public StripeAdapter()
     {
@@ -31,6 +33,7 @@ public StripeAdapter()
         _bankAccountService = new Stripe.BankAccountService();
         _priceService = new Stripe.PriceService();
         _testClockService = new Stripe.TestHelpers.TestClockService();
+        _invoiceItemService = new Stripe.InvoiceItemService();
     }
 
     public Task<Stripe.Customer> CustomerCreateAsync(Stripe.CustomerCreateOptions options)
@@ -79,6 +82,16 @@ public StripeAdapter()
         return _invoiceService.UpcomingAsync(options);
     }
 
+    public Task<Stripe.Invoice> InvoiceCreateAsync(Stripe.InvoiceCreateOptions options)
+    {
+        return _invoiceService.CreateAsync(options);
+    }
+
+    public Task<Stripe.InvoiceItem> InvoiceItemCreateAsync(Stripe.InvoiceItemCreateOptions options)
+    {
+        return _invoiceItemService.CreateAsync(options);
+    }
+
     public Task<Stripe.Invoice> InvoiceGetAsync(string id, Stripe.InvoiceGetOptions options)
     {
         return _invoiceService.GetAsync(id, options);
@@ -89,6 +102,11 @@ public StripeAdapter()
         return _invoiceService.ListAsync(options);
     }
 
+    public IEnumerable<InvoiceItem> InvoiceItemListAsync(InvoiceItemListOptions options)
+    {
+        return _invoiceItemService.ListAutoPaging(options);
+    }
+
     public Task<Stripe.Invoice> InvoiceUpdateAsync(string id, Stripe.InvoiceUpdateOptions options)
     {
         return _invoiceService.UpdateAsync(id, options);
diff --git a/src/Core/Services/Implementations/StripePaymentService.cs b/src/Core/Services/Implementations/StripePaymentService.cs
index 0f7965db7702..214b2bff102b 100644
--- a/src/Core/Services/Implementations/StripePaymentService.cs
+++ b/src/Core/Services/Implementations/StripePaymentService.cs
@@ -6,6 +6,7 @@
 using Bit.Core.Repositories;
 using Bit.Core.Settings;
 using Microsoft.Extensions.Logging;
+using Stripe;
 using StaticStore = Bit.Core.Models.StaticStore;
 using TaxRate = Bit.Core.Entities.TaxRate;
 
@@ -749,16 +750,14 @@ private async Task<string> FinalizeSubscriptionChangeAsync(IStorableSubscriber s
         prorationDate ??= DateTime.UtcNow;
         var collectionMethod = sub.CollectionMethod;
         var daysUntilDue = sub.DaysUntilDue;
-        var chargeNow = collectionMethod == "charge_automatically";
         var updatedItemOptions = subscriptionUpdate.UpgradeItemsOptions(sub);
 
         var subUpdateOptions = new Stripe.SubscriptionUpdateOptions
         {
             Items = updatedItemOptions,
-            ProrationBehavior = "always_invoice",
+            ProrationBehavior = Constants.CreateProrations,
             DaysUntilDue = daysUntilDue ?? 1,
-            CollectionMethod = "send_invoice",
-            ProrationDate = prorationDate,
+            CollectionMethod = "send_invoice"
         };
 
         if (!subscriptionUpdate.UpdateNeeded(sub))
@@ -792,66 +791,50 @@ private async Task<string> FinalizeSubscriptionChangeAsync(IStorableSubscriber s
         string paymentIntentClientSecret = null;
         try
         {
-            var subResponse = await _stripeAdapter.SubscriptionUpdateAsync(sub.Id, subUpdateOptions);
+            var subItemOptions = updatedItemOptions.Select(itemOption =>
+                new Stripe.InvoiceSubscriptionItemOptions
+                {
+                    Id = itemOption.Id,
+                    Plan = itemOption.Plan,
+                    Quantity = itemOption.Quantity,
+                }).ToList();
+
+            var reviewInvoiceResponse = await PreviewUpcomingInvoiceAndPayAsync(storableSubscriber, subItemOptions);
+            paymentIntentClientSecret = reviewInvoiceResponse.PaymentIntentClientSecret;
 
-            var invoice = await _stripeAdapter.InvoiceGetAsync(subResponse?.LatestInvoiceId, new Stripe.InvoiceGetOptions());
+            var subResponse = await _stripeAdapter.SubscriptionUpdateAsync(sub.Id, subUpdateOptions);
+            var invoice =
+                await _stripeAdapter.InvoiceGetAsync(subResponse?.LatestInvoiceId, new Stripe.InvoiceGetOptions());
             if (invoice == null)
             {
                 throw new BadRequestException("Unable to locate draft invoice for subscription update.");
             }
-
-            if (invoice.AmountDue > 0 && updatedItemOptions.Any(i => i.Quantity > 0))
-            {
-                try
-                {
-                    if (chargeNow)
-                    {
-                        paymentIntentClientSecret = await PayInvoiceAfterSubscriptionChangeAsync(
-                            storableSubscriber, invoice);
-                    }
-                    else
-                    {
-                        invoice = await _stripeAdapter.InvoiceFinalizeInvoiceAsync(subResponse.LatestInvoiceId, new Stripe.InvoiceFinalizeOptions
-                        {
-                            AutoAdvance = false,
-                        });
-                        await _stripeAdapter.InvoiceSendInvoiceAsync(invoice.Id, new Stripe.InvoiceSendOptions());
-                        paymentIntentClientSecret = null;
-                    }
-                }
-                catch
-                {
-                    // Need to revert the subscription
-                    await _stripeAdapter.SubscriptionUpdateAsync(sub.Id, new Stripe.SubscriptionUpdateOptions
-                    {
-                        Items = subscriptionUpdate.RevertItemsOptions(sub),
-                        // This proration behavior prevents a false "credit" from
-                        //  being applied forward to the next month's invoice
-                        ProrationBehavior = "none",
-                        CollectionMethod = collectionMethod,
-                        DaysUntilDue = daysUntilDue,
-                    });
-                    throw;
-                }
-            }
-            else if (!invoice.Paid)
+        }
+        catch (Exception e)
+        {
+            // Need to revert the subscription
+            await _stripeAdapter.SubscriptionUpdateAsync(sub.Id, new Stripe.SubscriptionUpdateOptions
             {
-                // Pay invoice with no charge to customer this completes the invoice immediately without waiting the scheduled 1h
-                invoice = await _stripeAdapter.InvoicePayAsync(subResponse.LatestInvoiceId);
-                paymentIntentClientSecret = null;
-            }
-
+                Items = subscriptionUpdate.RevertItemsOptions(sub),
+                // This proration behavior prevents a false "credit" from
+                //  being applied forward to the next month's invoice
+                ProrationBehavior = "none",
+                CollectionMethod = collectionMethod,
+                DaysUntilDue = daysUntilDue,
+            });
+            throw;
         }
         finally
         {
             // Change back the subscription collection method and/or days until due
             if (collectionMethod != "send_invoice" || daysUntilDue == null)
             {
-                await _stripeAdapter.SubscriptionUpdateAsync(sub.Id, new Stripe.SubscriptionUpdateOptions
-                {
-                    CollectionMethod = collectionMethod,
-                    DaysUntilDue = daysUntilDue,
-                });
+                await _stripeAdapter.SubscriptionUpdateAsync(sub.Id,
+                    new Stripe.SubscriptionUpdateOptions
+                    {
+                        CollectionMethod = collectionMethod,
+                        DaysUntilDue = daysUntilDue,
+                    });
             }
         }
 
@@ -934,6 +917,7 @@ await _stripeAdapter.SubscriptionCancelAsync(subscriber.GatewaySubscriptionId,
         await _stripeAdapter.CustomerDeleteAsync(subscriber.GatewayCustomerId);
     }
 
+    //This method is no-longer is use because we return the dollar threshold feature on invoice will be generated. but we dont want to lose this implementation.
     public async Task<string> PayInvoiceAfterSubscriptionChangeAsync(ISubscriber subscriber, Stripe.Invoice invoice)
     {
         var customerOptions = new Stripe.CustomerGetOptions();
@@ -1103,6 +1087,310 @@ public async Task<string> PayInvoiceAfterSubscriptionChangeAsync(ISubscriber sub
         return paymentIntentClientSecret;
     }
 
+    internal async Task<InvoicePreviewResult> PreviewUpcomingInvoiceAndPayAsync(ISubscriber subscriber,
+        List<Stripe.InvoiceSubscriptionItemOptions> subItemOptions, int prorateThreshold = 50000)
+    {
+        var customer = await CheckInAppPurchaseMethod(subscriber);
+
+        string paymentIntentClientSecret = null;
+
+        var pendingInvoiceItems = GetPendingInvoiceItems(subscriber);
+
+        var upcomingPreview = await GetUpcomingInvoiceAsync(subscriber, subItemOptions);
+
+        var itemsForInvoice = GetItemsForInvoice(subItemOptions, upcomingPreview, pendingInvoiceItems);
+        var invoiceAmount = itemsForInvoice?.Sum(i => i.Amount) ?? 0;
+        var invoiceNow = invoiceAmount >= prorateThreshold;
+        if (invoiceNow)
+        {
+            await ProcessImmediateInvoiceAsync(subscriber, upcomingPreview, invoiceAmount, customer, itemsForInvoice, pendingInvoiceItems, paymentIntentClientSecret);
+        }
+
+        return new InvoicePreviewResult { IsInvoicedNow = invoiceNow, PaymentIntentClientSecret = paymentIntentClientSecret };
+    }
+
+    private async Task<InvoicePreviewResult> ProcessImmediateInvoiceAsync(ISubscriber subscriber, Invoice upcomingPreview, long invoiceAmount,
+     Customer customer, IEnumerable<InvoiceLineItem> itemsForInvoice, PendingInoviceItems pendingInvoiceItems,
+     string paymentIntentClientSecret)
+    {
+        // Owes more than prorateThreshold on the next invoice.
+        // Invoice them and pay now instead of waiting until the next billing cycle.
+
+        string cardPaymentMethodId = null;
+        var invoiceAmountDue = upcomingPreview.StartingBalance + invoiceAmount;
+        cardPaymentMethodId = GetCardPaymentMethodId(invoiceAmountDue, customer, cardPaymentMethodId);
+
+        Stripe.Invoice invoice = null;
+        var createdInvoiceItems = new List<Stripe.InvoiceItem>();
+        Braintree.Transaction braintreeTransaction = null;
+
+        try
+        {
+            await CreateInvoiceItemsAsync(subscriber, itemsForInvoice, pendingInvoiceItems, createdInvoiceItems);
+
+            invoice = await CreateInvoiceAsync(subscriber, cardPaymentMethodId);
+
+            var invoicePayOptions = new Stripe.InvoicePayOptions();
+            await CreateBrainTreeTransactionRequestAsync(subscriber, invoice, customer, invoicePayOptions,
+                cardPaymentMethodId, braintreeTransaction);
+
+            await InvoicePayAsync(invoicePayOptions, invoice, paymentIntentClientSecret);
+        }
+        catch (Exception e)
+        {
+            if (braintreeTransaction != null)
+            {
+                await _btGateway.Transaction.RefundAsync(braintreeTransaction.Id);
+            }
+
+            if (invoice != null)
+            {
+                if (invoice.Status == "paid")
+                {
+                    // It's apparently paid, so we return without throwing an exception
+                    return new InvoicePreviewResult
+                    {
+                        IsInvoicedNow = false,
+                        PaymentIntentClientSecret = paymentIntentClientSecret
+                    };
+                }
+
+                await RestoreInvoiceItemsAsync(invoice, customer, pendingInvoiceItems.PendingInvoiceItems);
+            }
+            else
+            {
+                foreach (var ii in createdInvoiceItems)
+                {
+                    await _stripeAdapter.InvoiceDeleteAsync(ii.Id);
+                }
+            }
+
+            if (e is Stripe.StripeException strEx &&
+                (strEx.StripeError?.Message?.Contains("cannot be used because it is not verified") ?? false))
+            {
+                throw new GatewayException("Bank account is not yet verified.");
+            }
+
+            throw;
+        }
+
+        return new InvoicePreviewResult
+        {
+            IsInvoicedNow = false,
+            PaymentIntentClientSecret = paymentIntentClientSecret
+        };
+    }
+
+    private static IEnumerable<InvoiceLineItem> GetItemsForInvoice(List<InvoiceSubscriptionItemOptions> subItemOptions, Invoice upcomingPreview,
+        PendingInoviceItems pendingInvoiceItems)
+    {
+        var itemsForInvoice = upcomingPreview.Lines?.Data?
+            .Where(i => pendingInvoiceItems.PendingInvoiceItemsDict.ContainsKey(i.Id) ||
+                        (i.Plan.Id == subItemOptions[0]?.Plan && i.Proration));
+        return itemsForInvoice;
+    }
+
+    private PendingInoviceItems GetPendingInvoiceItems(ISubscriber subscriber)
+    {
+        var pendingInvoiceItems = new PendingInoviceItems();
+        var invoiceItems = _stripeAdapter.InvoiceItemListAsync(new Stripe.InvoiceItemListOptions
+        {
+            Customer = subscriber.GatewayCustomerId
+        }).ToList().Where(i => i.InvoiceId == null);
+        pendingInvoiceItems.PendingInvoiceItemsDict = invoiceItems.ToDictionary(pii => pii.Id);
+        return pendingInvoiceItems;
+    }
+
+    private async Task<Customer> CheckInAppPurchaseMethod(ISubscriber subscriber)
+    {
+        var customerOptions = GetCustomerPaymentOptions();
+        var customer = await _stripeAdapter.CustomerGetAsync(subscriber.GatewayCustomerId, customerOptions);
+        var usingInAppPaymentMethod = customer.Metadata.ContainsKey("appleReceipt");
+        if (usingInAppPaymentMethod)
+        {
+            throw new BadRequestException("Cannot perform this action with in-app purchase payment method. " +
+                                          "Contact support.");
+        }
+
+        return customer;
+    }
+
+    private string GetCardPaymentMethodId(long invoiceAmountDue, Customer customer, string cardPaymentMethodId)
+    {
+        try
+        {
+            if (invoiceAmountDue <= 0 || customer.Metadata.ContainsKey("btCustomerId")) return cardPaymentMethodId;
+            var hasDefaultCardPaymentMethod = customer.InvoiceSettings?.DefaultPaymentMethod?.Type == "card";
+            var hasDefaultValidSource = customer.DefaultSource != null &&
+                                        (customer.DefaultSource is Stripe.Card ||
+                                         customer.DefaultSource is Stripe.BankAccount);
+            if (hasDefaultCardPaymentMethod || hasDefaultValidSource) return cardPaymentMethodId;
+            cardPaymentMethodId = GetLatestCardPaymentMethod(customer.Id)?.Id;
+            if (cardPaymentMethodId == null)
+            {
+                throw new BadRequestException("No payment method is available.");
+            }
+        }
+        catch (Exception e)
+        {
+            throw new BadRequestException("No payment method is available.");
+        }
+
+
+        return cardPaymentMethodId;
+    }
+
+    private async Task<Invoice> GetUpcomingInvoiceAsync(ISubscriber subscriber, List<InvoiceSubscriptionItemOptions> subItemOptions)
+    {
+        var upcomingPreview = await _stripeAdapter.InvoiceUpcomingAsync(new Stripe.UpcomingInvoiceOptions
+        {
+            Customer = subscriber.GatewayCustomerId,
+            Subscription = subscriber.GatewaySubscriptionId,
+            SubscriptionItems = subItemOptions
+        });
+        return upcomingPreview;
+    }
+
+    private async Task RestoreInvoiceItemsAsync(Invoice invoice, Customer customer, IEnumerable<InvoiceItem> pendingInvoiceItems)
+    {
+        invoice = await _stripeAdapter.InvoiceVoidInvoiceAsync(invoice.Id, new Stripe.InvoiceVoidOptions());
+        if (invoice.StartingBalance != 0)
+        {
+            await _stripeAdapter.CustomerUpdateAsync(customer.Id,
+                new Stripe.CustomerUpdateOptions { Balance = customer.Balance });
+        }
+
+        // Restore invoice items that were brought in
+        foreach (var item in pendingInvoiceItems)
+        {
+            var i = new Stripe.InvoiceItemCreateOptions
+            {
+                Currency = item.Currency,
+                Description = item.Description,
+                Customer = item.CustomerId,
+                Subscription = item.SubscriptionId,
+                Discountable = item.Discountable,
+                Metadata = item.Metadata,
+                Quantity = item.Proration ? 1 : item.Quantity,
+                UnitAmount = item.UnitAmount
+            };
+            await _stripeAdapter.InvoiceItemCreateAsync(i);
+        }
+    }
+
+    private async Task InvoicePayAsync(InvoicePayOptions invoicePayOptions, Invoice invoice, string paymentIntentClientSecret)
+    {
+        try
+        {
+            await _stripeAdapter.InvoicePayAsync(invoice.Id, invoicePayOptions);
+        }
+        catch (Stripe.StripeException e)
+        {
+            if (e.HttpStatusCode == System.Net.HttpStatusCode.PaymentRequired &&
+                e.StripeError?.Code == "invoice_payment_intent_requires_action")
+            {
+                // SCA required, get intent client secret
+                var invoiceGetOptions = new Stripe.InvoiceGetOptions();
+                invoiceGetOptions.AddExpand("payment_intent");
+                invoice = await _stripeAdapter.InvoiceGetAsync(invoice.Id, invoiceGetOptions);
+                paymentIntentClientSecret = invoice?.PaymentIntent?.ClientSecret;
+            }
+            else
+            {
+                throw new GatewayException("Unable to pay invoice.");
+            }
+        }
+    }
+
+    private async Task CreateBrainTreeTransactionRequestAsync(ISubscriber subscriber, Invoice invoice, Customer customer,
+        InvoicePayOptions invoicePayOptions, string cardPaymentMethodId, Braintree.Transaction braintreeTransaction)
+    {
+        if (invoice.AmountDue > 0)
+        {
+            if (customer?.Metadata?.ContainsKey("btCustomerId") ?? false)
+            {
+                invoicePayOptions.PaidOutOfBand = true;
+                var btInvoiceAmount = (invoice.AmountDue / 100M);
+                var transactionResult = await _btGateway.Transaction.SaleAsync(
+                    new Braintree.TransactionRequest
+                    {
+                        Amount = btInvoiceAmount,
+                        CustomerId = customer.Metadata["btCustomerId"],
+                        Options = new Braintree.TransactionOptionsRequest
+                        {
+                            SubmitForSettlement = true,
+                            PayPal = new Braintree.TransactionOptionsPayPalRequest
+                            {
+                                CustomField = $"{subscriber.BraintreeIdField()}:{subscriber.Id}"
+                            }
+                        },
+                        CustomFields = new Dictionary<string, string>
+                        {
+                            [subscriber.BraintreeIdField()] = subscriber.Id.ToString()
+                        }
+                    });
+
+                if (!transactionResult.IsSuccess())
+                {
+                    throw new GatewayException("Failed to charge PayPal customer.");
+                }
+
+                braintreeTransaction = transactionResult.Target;
+                await _stripeAdapter.InvoiceUpdateAsync(invoice.Id, new Stripe.InvoiceUpdateOptions
+                {
+                    Metadata = new Dictionary<string, string>
+                    {
+                        ["btTransactionId"] = braintreeTransaction.Id,
+                        ["btPayPalTransactionId"] =
+                            braintreeTransaction.PayPalDetails.AuthorizationId
+                    }
+                });
+            }
+            else
+            {
+                invoicePayOptions.OffSession = true;
+                invoicePayOptions.PaymentMethod = cardPaymentMethodId;
+            }
+        }
+    }
+
+    private async Task<Invoice> CreateInvoiceAsync(ISubscriber subscriber, string cardPaymentMethodId)
+    {
+        Invoice invoice;
+        invoice = await _stripeAdapter.InvoiceCreateAsync(new Stripe.InvoiceCreateOptions
+        {
+            CollectionMethod = "send_invoice",
+            DaysUntilDue = 1,
+            Customer = subscriber.GatewayCustomerId,
+            Subscription = subscriber.GatewaySubscriptionId,
+            DefaultPaymentMethod = cardPaymentMethodId
+        });
+        return invoice;
+    }
+
+    private async Task CreateInvoiceItemsAsync(ISubscriber subscriber, IEnumerable<InvoiceLineItem> itemsForInvoice,
+        PendingInoviceItems pendingInvoiceItems, List<InvoiceItem> createdInvoiceItems)
+    {
+        foreach (var invoiceLineItem in itemsForInvoice)
+        {
+            if (pendingInvoiceItems.PendingInvoiceItemsDict.ContainsKey(invoiceLineItem.Id))
+            {
+                continue;
+            }
+
+            var invoiceItem = await _stripeAdapter.InvoiceItemCreateAsync(new Stripe.InvoiceItemCreateOptions
+            {
+                Currency = invoiceLineItem.Currency,
+                Description = invoiceLineItem.Description,
+                Customer = subscriber.GatewayCustomerId,
+                Subscription = invoiceLineItem.Subscription,
+                Discountable = invoiceLineItem.Discountable,
+                Amount = invoiceLineItem.Amount
+            });
+            createdInvoiceItems.Add(invoiceItem);
+        }
+    }
+
     public async Task CancelSubscriptionAsync(ISubscriber subscriber, bool endOfPeriod = false,
         bool skipInAppPurchaseCheck = false)
     {
diff --git a/src/Core/Services/Implementations/UserService.cs b/src/Core/Services/Implementations/UserService.cs
index 643e1bf18ea8..abe01d2e9a72 100644
--- a/src/Core/Services/Implementations/UserService.cs
+++ b/src/Core/Services/Implementations/UserService.cs
@@ -1,14 +1,20 @@
 using System.Security.Claims;
 using System.Text.Json;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models;
+using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Auth.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
+using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Settings;
+using Bit.Core.Tokens;
 using Bit.Core.Tools.Entities;
 using Bit.Core.Tools.Enums;
 using Bit.Core.Tools.Models.Business;
@@ -52,9 +58,12 @@ public class UserService : UserManager<User>, IUserService, IDisposable
     private readonly IFido2 _fido2;
     private readonly ICurrentContext _currentContext;
     private readonly IGlobalSettings _globalSettings;
-    private readonly IOrganizationService _organizationService;
+    private readonly IAcceptOrgUserCommand _acceptOrgUserCommand;
     private readonly IProviderUserRepository _providerUserRepository;
     private readonly IStripeSyncService _stripeSyncService;
+    private readonly IWebAuthnCredentialRepository _webAuthnCredentialRepository;
+    private readonly IDataProtectorTokenFactory<WebAuthnLoginTokenable> _webAuthnLoginTokenizer;
+    private readonly IDataProtectorTokenFactory<OrgUserInviteTokenable> _orgUserInviteTokenDataFactory;
 
     public UserService(
         IUserRepository userRepository,
@@ -83,9 +92,12 @@ public UserService(
         IFido2 fido2,
         ICurrentContext currentContext,
         IGlobalSettings globalSettings,
-        IOrganizationService organizationService,
+        IAcceptOrgUserCommand acceptOrgUserCommand,
         IProviderUserRepository providerUserRepository,
-        IStripeSyncService stripeSyncService)
+        IStripeSyncService stripeSyncService,
+        IDataProtectorTokenFactory<OrgUserInviteTokenable> orgUserInviteTokenDataFactory,
+        IWebAuthnCredentialRepository webAuthnRepository,
+        IDataProtectorTokenFactory<WebAuthnLoginTokenable> webAuthnLoginTokenizer)
         : base(
               store,
               optionsAccessor,
@@ -119,9 +131,12 @@ public UserService(
         _fido2 = fido2;
         _currentContext = currentContext;
         _globalSettings = globalSettings;
-        _organizationService = organizationService;
+        _acceptOrgUserCommand = acceptOrgUserCommand;
         _providerUserRepository = providerUserRepository;
         _stripeSyncService = stripeSyncService;
+        _orgUserInviteTokenDataFactory = orgUserInviteTokenDataFactory;
+        _webAuthnCredentialRepository = webAuthnRepository;
+        _webAuthnLoginTokenizer = webAuthnLoginTokenizer;
     }
 
     public Guid? GetProperUserId(ClaimsPrincipal principal)
@@ -287,8 +302,13 @@ public async Task<IdentityResult> RegisterUserAsync(User user, string masterPass
         var tokenValid = false;
         if (_globalSettings.DisableUserRegistration && !string.IsNullOrWhiteSpace(token) && orgUserId.HasValue)
         {
-            tokenValid = CoreHelpers.UserInviteTokenIsValid(_organizationServiceDataProtector, token,
-                user.Email, orgUserId.Value, _globalSettings);
+            // TODO: PM-4142 - remove old token validation logic once 3 releases of backwards compatibility are complete
+            var newTokenValid = OrgUserInviteTokenable.ValidateOrgUserInviteStringToken(
+                _orgUserInviteTokenDataFactory, token, orgUserId.Value, user.Email);
+
+            tokenValid = newTokenValid ||
+                          CoreHelpers.UserInviteTokenIsValid(_organizationServiceDataProtector, token,
+                              user.Email, orgUserId.Value, _globalSettings);
         }
 
         if (_globalSettings.DisableUserRegistration && !tokenValid)
@@ -502,6 +522,125 @@ public async Task<bool> DeleteWebAuthnKeyAsync(User user, int id)
         return true;
     }
 
+    public async Task<CredentialCreateOptions> StartWebAuthnLoginRegistrationAsync(User user)
+    {
+        var fidoUser = new Fido2User
+        {
+            DisplayName = user.Name,
+            Name = user.Email,
+            Id = user.Id.ToByteArray(),
+        };
+
+        // Get existing keys to exclude
+        var existingKeys = await _webAuthnCredentialRepository.GetManyByUserIdAsync(user.Id);
+        var excludeCredentials = existingKeys
+            .Select(k => new PublicKeyCredentialDescriptor(CoreHelpers.Base64UrlDecode(k.CredentialId)))
+            .ToList();
+
+        var authenticatorSelection = new AuthenticatorSelection
+        {
+            AuthenticatorAttachment = null,
+            RequireResidentKey = false, // TODO: This is using the old residentKey selection variant, we need to update our lib so that we can set this to preferred
+            UserVerification = UserVerificationRequirement.Preferred
+        };
+
+        var extensions = new AuthenticationExtensionsClientInputs { };
+
+        var options = _fido2.RequestNewCredential(fidoUser, excludeCredentials, authenticatorSelection,
+            AttestationConveyancePreference.None, extensions);
+
+        return options;
+    }
+
+    public async Task<bool> CompleteWebAuthLoginRegistrationAsync(User user, string name,
+        CredentialCreateOptions options,
+        AuthenticatorAttestationRawResponse attestationResponse)
+    {
+        var existingCredentials = await _webAuthnCredentialRepository.GetManyByUserIdAsync(user.Id);
+        if (existingCredentials.Count >= 5)
+        {
+            return false;
+        }
+
+        var existingCredentialIds = existingCredentials.Select(c => c.CredentialId);
+        IsCredentialIdUniqueToUserAsyncDelegate callback = (args, cancellationToken) => Task.FromResult(!existingCredentialIds.Contains(CoreHelpers.Base64UrlEncode(args.CredentialId)));
+
+        var success = await _fido2.MakeNewCredentialAsync(attestationResponse, options, callback);
+
+        var credential = new WebAuthnCredential
+        {
+            Name = name,
+            CredentialId = CoreHelpers.Base64UrlEncode(success.Result.CredentialId),
+            PublicKey = CoreHelpers.Base64UrlEncode(success.Result.PublicKey),
+            Type = success.Result.CredType,
+            AaGuid = success.Result.Aaguid,
+            Counter = (int)success.Result.Counter,
+            UserId = user.Id
+        };
+
+        await _webAuthnCredentialRepository.CreateAsync(credential);
+        return true;
+    }
+
+    public async Task<AssertionOptions> StartWebAuthnLoginAssertionAsync(User user)
+    {
+        var provider = user.GetTwoFactorProvider(TwoFactorProviderType.WebAuthn);
+        var existingKeys = await _webAuthnCredentialRepository.GetManyByUserIdAsync(user.Id);
+        var existingCredentials = existingKeys
+            .Select(k => new PublicKeyCredentialDescriptor(CoreHelpers.Base64UrlDecode(k.CredentialId)))
+            .ToList();
+
+        if (existingCredentials.Count == 0)
+        {
+            return null;
+        }
+
+        // TODO: PRF?
+        var exts = new AuthenticationExtensionsClientInputs
+        {
+            UserVerificationMethod = true
+        };
+        var options = _fido2.GetAssertionOptions(existingCredentials, UserVerificationRequirement.Preferred, exts);
+
+        // TODO: temp save options to user record somehow
+
+        return options;
+    }
+
+    public async Task<string> CompleteWebAuthLoginAssertionAsync(AuthenticatorAssertionRawResponse assertionResponse, User user)
+    {
+        // TODO: Get options from user record somehow, then clear them
+        var options = AssertionOptions.FromJson("");
+
+        var userCredentials = await _webAuthnCredentialRepository.GetManyByUserIdAsync(user.Id);
+        var assertionId = CoreHelpers.Base64UrlEncode(assertionResponse.Id);
+        var credential = userCredentials.FirstOrDefault(c => c.CredentialId == assertionId);
+        if (credential == null)
+        {
+            return null;
+        }
+
+        // TODO: Callback to ensure credential ID is unique. Do we care? I don't think so.
+        IsUserHandleOwnerOfCredentialIdAsync callback = (args, cancellationToken) => Task.FromResult(true);
+        var credentialPublicKey = CoreHelpers.Base64UrlDecode(credential.PublicKey);
+        var assertionVerificationResult = await _fido2.MakeAssertionAsync(
+            assertionResponse, options, credentialPublicKey, (uint)credential.Counter, callback);
+
+        // Update SignatureCounter
+        credential.Counter = (int)assertionVerificationResult.Counter;
+        await _webAuthnCredentialRepository.ReplaceAsync(credential);
+
+        if (assertionVerificationResult.Status == "ok")
+        {
+            var token = _webAuthnLoginTokenizer.Protect(new WebAuthnLoginTokenable(user));
+            return token;
+        }
+        else
+        {
+            return null;
+        }
+    }
+
     public async Task SendEmailVerificationAsync(User user)
     {
         if (user.EmailVerified)
@@ -600,11 +739,6 @@ await _stripeSyncService.UpdateCustomerEmailAddress(user.GatewayCustomerId,
         return IdentityResult.Success;
     }
 
-    public override Task<IdentityResult> ChangePasswordAsync(User user, string masterPassword, string newMasterPassword)
-    {
-        throw new NotImplementedException();
-    }
-
     public async Task<IdentityResult> ChangePasswordAsync(User user, string masterPassword, string newMasterPassword, string passwordHint,
         string key)
     {
@@ -638,40 +772,6 @@ public async Task<IdentityResult> ChangePasswordAsync(User user, string masterPa
         return IdentityResult.Failed(_identityErrorDescriber.PasswordMismatch());
     }
 
-    public async Task<IdentityResult> SetPasswordAsync(User user, string masterPassword, string key,
-        string orgIdentifier = null)
-    {
-        if (user == null)
-        {
-            throw new ArgumentNullException(nameof(user));
-        }
-
-        if (!string.IsNullOrWhiteSpace(user.MasterPassword))
-        {
-            Logger.LogWarning("Change password failed for user {userId} - already has password.", user.Id);
-            return IdentityResult.Failed(_identityErrorDescriber.UserAlreadyHasPassword());
-        }
-
-        var result = await UpdatePasswordHash(user, masterPassword, true, false);
-        if (!result.Succeeded)
-        {
-            return result;
-        }
-
-        user.RevisionDate = user.AccountRevisionDate = DateTime.UtcNow;
-        user.Key = key;
-
-        await _userRepository.ReplaceAsync(user);
-        await _eventService.LogUserEventAsync(user.Id, EventType.User_ChangedPassword);
-
-        if (!string.IsNullOrWhiteSpace(orgIdentifier))
-        {
-            await _organizationService.AcceptUserAsync(orgIdentifier, user, this);
-        }
-
-        return IdentityResult.Success;
-    }
-
     public async Task<IdentityResult> SetKeyConnectorKeyAsync(User user, string key, string orgIdentifier)
     {
         var identityResult = CheckCanUseKeyConnector(user);
@@ -687,7 +787,7 @@ public async Task<IdentityResult> SetKeyConnectorKeyAsync(User user, string key,
         await _userRepository.ReplaceAsync(user);
         await _eventService.LogUserEventAsync(user.Id, EventType.User_MigratedKeyToKeyConnector);
 
-        await _organizationService.AcceptUserAsync(orgIdentifier, user, this);
+        await _acceptOrgUserCommand.AcceptOrgUserByOrgSsoIdAsync(orgIdentifier, user, this);
 
         return IdentityResult.Success;
     }
@@ -1352,7 +1452,7 @@ public async Task<string> GenerateSignInTokenAsync(User user, string purpose)
         return token;
     }
 
-    private async Task<IdentityResult> UpdatePasswordHash(User user, string newPassword,
+    public async Task<IdentityResult> UpdatePasswordHash(User user, string newPassword,
         bool validatePassword = true, bool refreshStamp = true)
     {
         if (validatePassword)
diff --git a/src/Core/Services/NoopImplementations/NoopEventService.cs b/src/Core/Services/NoopImplementations/NoopEventService.cs
index 5d5dba16fb6d..9a9d831c4e65 100644
--- a/src/Core/Services/NoopImplementations/NoopEventService.cs
+++ b/src/Core/Services/NoopImplementations/NoopEventService.cs
@@ -1,6 +1,6 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
 using Bit.Core.SecretsManager.Entities;
 using Bit.Core.Vault.Entities;
diff --git a/src/Core/Services/NoopImplementations/NoopMailService.cs b/src/Core/Services/NoopImplementations/NoopMailService.cs
index 089ae18f181c..e098d7051e7c 100644
--- a/src/Core/Services/NoopImplementations/NoopMailService.cs
+++ b/src/Core/Services/NoopImplementations/NoopMailService.cs
@@ -1,7 +1,7 @@
-using Bit.Core.Auth.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Models.Business;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Models.Mail;
 
 namespace Bit.Core.Services;
diff --git a/src/Core/Tokens/ExpiringTokenable.cs b/src/Core/Tokens/ExpiringTokenable.cs
index 089405e53636..5e90a2406606 100644
--- a/src/Core/Tokens/ExpiringTokenable.cs
+++ b/src/Core/Tokens/ExpiringTokenable.cs
@@ -7,7 +7,16 @@ public abstract class ExpiringTokenable : Tokenable
 {
     [JsonConverter(typeof(EpochDateTimeJsonConverter))]
     public DateTime ExpirationDate { get; set; }
+
+    /// <summary>
+    /// Checks if the token is still within its valid duration and if its data is valid.
+    /// <para>For data validation, this property relies on the <see cref="TokenIsValid"/> method.</para>
+    /// </summary>
     public override bool Valid => ExpirationDate > DateTime.UtcNow && TokenIsValid();
 
+    /// <summary>
+    /// Validates that the token data properties are correct.
+    /// <para>For expiration checks, refer to the <see cref="Valid"/> property.</para>
+    /// </summary>
     protected abstract bool TokenIsValid();
 }
diff --git a/src/Core/Utilities/CoreHelpers.cs b/src/Core/Utilities/CoreHelpers.cs
index c128fa8e46e5..b44283f6e93f 100644
--- a/src/Core/Utilities/CoreHelpers.cs
+++ b/src/Core/Utilities/CoreHelpers.cs
@@ -10,11 +10,12 @@
 using Azure.Storage.Blobs;
 using Azure.Storage.Blobs.Models;
 using Azure.Storage.Queues.Models;
+using Bit.Core.AdminConsole.Context;
+using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Identity;
 using Bit.Core.Settings;
 using IdentityModel;
@@ -494,6 +495,7 @@ public static string CustomProviderName(TwoFactorProviderType type)
         return string.Concat("Custom_", type.ToString());
     }
 
+    // TODO: PM-4142 - remove old token validation logic once 3 releases of backwards compatibility are complete
     public static bool UserInviteTokenIsValid(IDataProtector protector, string token, string userEmail,
         Guid orgUserId, IGlobalSettings globalSettings)
     {
diff --git a/src/Core/Utilities/StaticStore.cs b/src/Core/Utilities/StaticStore.cs
index 6726d9cd319b..11052a4468e2 100644
--- a/src/Core/Utilities/StaticStore.cs
+++ b/src/Core/Utilities/StaticStore.cs
@@ -6,7 +6,7 @@
 
 namespace Bit.Core.Utilities;
 
-public class StaticStore
+public static class StaticStore
 {
     static StaticStore()
     {
@@ -112,6 +112,11 @@ static StaticStore()
             new EnterprisePlan(false),
             new TeamsPlan(true),
             new TeamsPlan(false),
+
+            new Enterprise2020Plan(true),
+            new Enterprise2020Plan(false),
+            new Teams2020Plan(true),
+            new Teams2020Plan(false),
             new FamiliesPlan(),
             new FreePlan(),
             new CustomPlan(),
@@ -139,8 +144,7 @@ static StaticStore()
             }
         };
 
-    public static Models.StaticStore.Plan GetPlan(PlanType planType) =>
-        Plans.SingleOrDefault(p => p.Type == planType);
+    public static Plan GetPlan(PlanType planType) => Plans.SingleOrDefault(p => p.Type == planType);
 
 
     public static SponsoredPlan GetSponsoredPlan(PlanSponsorshipType planSponsorshipType) =>
diff --git a/src/Events/packages.lock.json b/src/Events/packages.lock.json
index 16a42f355d3f..722ede68b886 100644
--- a/src/Events/packages.lock.json
+++ b/src/Events/packages.lock.json
@@ -2631,7 +2631,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2639,7 +2639,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2651,9 +2651,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/EventsProcessor/packages.lock.json b/src/EventsProcessor/packages.lock.json
index 16a42f355d3f..722ede68b886 100644
--- a/src/EventsProcessor/packages.lock.json
+++ b/src/EventsProcessor/packages.lock.json
@@ -2631,7 +2631,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2639,7 +2639,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2651,9 +2651,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/Icons/packages.lock.json b/src/Icons/packages.lock.json
index 0b2c51d0c0c9..a5c16d3f7463 100644
--- a/src/Icons/packages.lock.json
+++ b/src/Icons/packages.lock.json
@@ -2640,7 +2640,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2648,7 +2648,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2660,9 +2660,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/Identity/Controllers/AccountsController.cs b/src/Identity/Controllers/AccountsController.cs
index 40451727440c..9073884d8c05 100644
--- a/src/Identity/Controllers/AccountsController.cs
+++ b/src/Identity/Controllers/AccountsController.cs
@@ -1,4 +1,5 @@
-using Bit.Core.Auth.Models.Api.Request.Accounts;
+using Bit.Core;
+using Bit.Core.Auth.Models.Api.Request.Accounts;
 using Bit.Core.Auth.Models.Api.Response.Accounts;
 using Bit.Core.Auth.Services;
 using Bit.Core.Auth.Utilities;
@@ -7,7 +8,9 @@
 using Bit.Core.Models.Data;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
+using Bit.Core.Utilities;
 using Bit.SharedWeb.Utilities;
+using Fido2NetLib;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Bit.Identity.Controllers;
@@ -71,4 +74,37 @@ public async Task<PreloginResponseModel> PostPrelogin([FromBody] PreloginRequest
         }
         return new PreloginResponseModel(kdfInformation);
     }
+
+    [HttpPost("webauthn-assertion-options")]
+    [ApiExplorerSettings(IgnoreApi = true)] // Disable Swagger due to CredentialCreateOptions not converting properly
+    [RequireFeature(FeatureFlagKeys.PasswordlessLogin)]
+    // TODO: Create proper models for this call
+    public async Task<AssertionOptions> PostWebAuthnAssertionOptions([FromBody] PreloginRequestModel model)
+    {
+        var user = await _userRepository.GetByEmailAsync(model.Email);
+        if (user == null)
+        {
+            // TODO: return something? possible enumeration attacks with this response
+            return new AssertionOptions();
+        }
+
+        var options = await _userService.StartWebAuthnLoginAssertionAsync(user);
+        return options;
+    }
+
+    [HttpPost("webauthn-assertion")]
+    [RequireFeature(FeatureFlagKeys.PasswordlessLogin)]
+    // TODO: Create proper models for this call
+    public async Task<string> PostWebAuthnAssertion([FromBody] PreloginRequestModel model)
+    {
+        var user = await _userRepository.GetByEmailAsync(model.Email);
+        if (user == null)
+        {
+            // TODO: proper response here?
+            throw new BadRequestException();
+        }
+
+        var token = await _userService.CompleteWebAuthLoginAssertionAsync(null, user);
+        return token;
+    }
 }
diff --git a/src/Identity/IdentityServer/ClientStore.cs b/src/Identity/IdentityServer/ClientStore.cs
index f857e722598d..259898f20901 100644
--- a/src/Identity/IdentityServer/ClientStore.cs
+++ b/src/Identity/IdentityServer/ClientStore.cs
@@ -1,5 +1,6 @@
 using System.Collections.ObjectModel;
 using System.Security.Claims;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Enums;
 using Bit.Core.Identity;
diff --git a/src/Identity/IdentityServer/ProfileService.cs b/src/Identity/IdentityServer/ProfileService.cs
index e8cad3c01d94..bbec6739ba5a 100644
--- a/src/Identity/IdentityServer/ProfileService.cs
+++ b/src/Identity/IdentityServer/ProfileService.cs
@@ -1,4 +1,5 @@
 using System.Security.Claims;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Identity;
 using Bit.Core.Repositories;
diff --git a/src/Identity/packages.lock.json b/src/Identity/packages.lock.json
index 3577f2faef16..375aef79d52a 100644
--- a/src/Identity/packages.lock.json
+++ b/src/Identity/packages.lock.json
@@ -2653,7 +2653,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2661,7 +2661,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2673,9 +2673,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/Infrastructure.Dapper/Repositories/ProviderOrganizationRepository.cs b/src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderOrganizationRepository.cs
similarity index 96%
rename from src/Infrastructure.Dapper/Repositories/ProviderOrganizationRepository.cs
rename to src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderOrganizationRepository.cs
index 604d81a6e2db..66b4ad856067 100644
--- a/src/Infrastructure.Dapper/Repositories/ProviderOrganizationRepository.cs
+++ b/src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderOrganizationRepository.cs
@@ -1,12 +1,13 @@
 using System.Data;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
-using Bit.Core.Repositories;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Settings;
+using Bit.Infrastructure.Dapper.Repositories;
 using Dapper;
 using Microsoft.Data.SqlClient;
 
-namespace Bit.Infrastructure.Dapper.Repositories;
+namespace Bit.Infrastructure.Dapper.AdminConsole.Repositories;
 
 public class ProviderOrganizationRepository : Repository<ProviderOrganization, Guid>, IProviderOrganizationRepository
 {
diff --git a/src/Infrastructure.Dapper/Repositories/ProviderRepository.cs b/src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderRepository.cs
similarity index 88%
rename from src/Infrastructure.Dapper/Repositories/ProviderRepository.cs
rename to src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderRepository.cs
index 39bc02931202..812ed30ff1c2 100644
--- a/src/Infrastructure.Dapper/Repositories/ProviderRepository.cs
+++ b/src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderRepository.cs
@@ -1,12 +1,13 @@
 using System.Data;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
-using Bit.Core.Repositories;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Settings;
+using Bit.Infrastructure.Dapper.Repositories;
 using Dapper;
 using Microsoft.Data.SqlClient;
 
-namespace Bit.Infrastructure.Dapper.Repositories;
+namespace Bit.Infrastructure.Dapper.AdminConsole.Repositories;
 
 public class ProviderRepository : Repository<Provider, Guid>, IProviderRepository
 {
diff --git a/src/Infrastructure.Dapper/Repositories/ProviderUserRepository.cs b/src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderUserRepository.cs
similarity index 95%
rename from src/Infrastructure.Dapper/Repositories/ProviderUserRepository.cs
rename to src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderUserRepository.cs
index 114ed53f5433..dafa78a07f4f 100644
--- a/src/Infrastructure.Dapper/Repositories/ProviderUserRepository.cs
+++ b/src/Infrastructure.Dapper/AdminConsole/Repositories/ProviderUserRepository.cs
@@ -1,13 +1,14 @@
 using System.Data;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
-using Bit.Core.Models.Data;
-using Bit.Core.Repositories;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Settings;
+using Bit.Infrastructure.Dapper.Repositories;
 using Dapper;
 using Microsoft.Data.SqlClient;
 
-namespace Bit.Infrastructure.Dapper.Repositories;
+namespace Bit.Infrastructure.Dapper.AdminConsole.Repositories;
 
 public class ProviderUserRepository : Repository<ProviderUser, Guid>, IProviderUserRepository
 {
diff --git a/src/Infrastructure.Dapper/Auth/Repositories/WebAuthnCredentialRepository.cs b/src/Infrastructure.Dapper/Auth/Repositories/WebAuthnCredentialRepository.cs
new file mode 100644
index 000000000000..502569136f2a
--- /dev/null
+++ b/src/Infrastructure.Dapper/Auth/Repositories/WebAuthnCredentialRepository.cs
@@ -0,0 +1,47 @@
+using System.Data;
+using Bit.Core.Auth.Entities;
+using Bit.Core.Auth.Repositories;
+using Bit.Core.Settings;
+using Bit.Infrastructure.Dapper.Repositories;
+using Dapper;
+using Microsoft.Data.SqlClient;
+
+
+namespace Bit.Infrastructure.Dapper.Auth.Repositories;
+
+public class WebAuthnCredentialRepository : Repository<WebAuthnCredential, Guid>, IWebAuthnCredentialRepository
+{
+    public WebAuthnCredentialRepository(GlobalSettings globalSettings)
+        : this(globalSettings.SqlServer.ConnectionString, globalSettings.SqlServer.ReadOnlyConnectionString)
+    { }
+
+    public WebAuthnCredentialRepository(string connectionString, string readOnlyConnectionString)
+        : base(connectionString, readOnlyConnectionString)
+    { }
+
+    public async Task<WebAuthnCredential> GetByIdAsync(Guid id, Guid userId)
+    {
+        using (var connection = new SqlConnection(ConnectionString))
+        {
+            var results = await connection.QueryAsync<WebAuthnCredential>(
+                $"[{Schema}].[{Table}_ReadByIdUserId]",
+                new { Id = id, UserId = userId },
+                commandType: CommandType.StoredProcedure);
+
+            return results.FirstOrDefault();
+        }
+    }
+
+    public async Task<ICollection<WebAuthnCredential>> GetManyByUserIdAsync(Guid userId)
+    {
+        using (var connection = new SqlConnection(ConnectionString))
+        {
+            var results = await connection.QueryAsync<WebAuthnCredential>(
+                $"[{Schema}].[{Table}_ReadByUserId]",
+                new { UserId = userId },
+                commandType: CommandType.StoredProcedure);
+
+            return results.ToList();
+        }
+    }
+}
diff --git a/src/Infrastructure.Dapper/DapperServiceCollectionExtensions.cs b/src/Infrastructure.Dapper/DapperServiceCollectionExtensions.cs
index 8b8c54568a6f..0b9790764dad 100644
--- a/src/Infrastructure.Dapper/DapperServiceCollectionExtensions.cs
+++ b/src/Infrastructure.Dapper/DapperServiceCollectionExtensions.cs
@@ -47,6 +47,7 @@ public static void AddDapperRepositories(this IServiceCollection services, bool
         services.AddSingleton<ITransactionRepository, TransactionRepository>();
         services.AddSingleton<IUserRepository, UserRepository>();
         services.AddSingleton<IOrganizationDomainRepository, OrganizationDomainRepository>();
+        services.AddSingleton<IWebAuthnCredentialRepository, WebAuthnCredentialRepository>();
 
         if (selfHosted)
         {
diff --git a/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/Provider.cs b/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/Provider.cs
new file mode 100644
index 000000000000..3801c9ee69ca
--- /dev/null
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/Provider.cs
@@ -0,0 +1,15 @@
+using AutoMapper;
+
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Models.Provider;
+
+public class Provider : Core.AdminConsole.Entities.Provider.Provider
+{
+}
+
+public class ProviderMapperProfile : Profile
+{
+    public ProviderMapperProfile()
+    {
+        CreateMap<Core.AdminConsole.Entities.Provider.Provider, Provider>().ReverseMap();
+    }
+}
diff --git a/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/ProviderOrganization.cs b/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/ProviderOrganization.cs
new file mode 100644
index 000000000000..82bc26c5d55a
--- /dev/null
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/ProviderOrganization.cs
@@ -0,0 +1,18 @@
+using AutoMapper;
+using Bit.Infrastructure.EntityFramework.Models;
+
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Models.Provider;
+
+public class ProviderOrganization : Core.AdminConsole.Entities.Provider.ProviderOrganization
+{
+    public virtual Provider Provider { get; set; }
+    public virtual Organization Organization { get; set; }
+}
+
+public class ProviderOrganizationMapperProfile : Profile
+{
+    public ProviderOrganizationMapperProfile()
+    {
+        CreateMap<Core.AdminConsole.Entities.Provider.ProviderOrganization, ProviderOrganization>().ReverseMap();
+    }
+}
diff --git a/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/ProviderUser.cs b/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/ProviderUser.cs
new file mode 100644
index 000000000000..1b6de00960c3
--- /dev/null
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Models/Provider/ProviderUser.cs
@@ -0,0 +1,18 @@
+using AutoMapper;
+using Bit.Infrastructure.EntityFramework.Models;
+
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Models.Provider;
+
+public class ProviderUser : Core.AdminConsole.Entities.Provider.ProviderUser
+{
+    public virtual User User { get; set; }
+    public virtual Provider Provider { get; set; }
+}
+
+public class ProviderUserMapperProfile : Profile
+{
+    public ProviderUserMapperProfile()
+    {
+        CreateMap<Core.AdminConsole.Entities.Provider.ProviderUser, ProviderUser>().ReverseMap();
+    }
+}
diff --git a/src/Infrastructure.EntityFramework/Repositories/ProviderOrganizationRepository.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderOrganizationRepository.cs
similarity index 84%
rename from src/Infrastructure.EntityFramework/Repositories/ProviderOrganizationRepository.cs
rename to src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderOrganizationRepository.cs
index c5a6d34e2796..77f5f8edc153 100644
--- a/src/Infrastructure.EntityFramework/Repositories/ProviderOrganizationRepository.cs
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderOrganizationRepository.cs
@@ -1,15 +1,16 @@
 using AutoMapper;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
-using Bit.Core.Repositories;
-using Bit.Infrastructure.EntityFramework.Repositories.Queries;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Infrastructure.EntityFramework.AdminConsole.Repositories.Queries;
+using Bit.Infrastructure.EntityFramework.Repositories;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
 
-namespace Bit.Infrastructure.EntityFramework.Repositories;
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Repositories;
 
 public class ProviderOrganizationRepository :
-    Repository<ProviderOrganization, Models.ProviderOrganization, Guid>, IProviderOrganizationRepository
+    Repository<ProviderOrganization, Models.Provider.ProviderOrganization, Guid>, IProviderOrganizationRepository
 {
     public ProviderOrganizationRepository(IServiceScopeFactory serviceScopeFactory, IMapper mapper)
         : base(serviceScopeFactory, mapper, context => context.ProviderOrganizations)
diff --git a/src/Infrastructure.EntityFramework/Repositories/ProviderRepository.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderRepository.cs
similarity index 90%
rename from src/Infrastructure.EntityFramework/Repositories/ProviderRepository.cs
rename to src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderRepository.cs
index 8f66100738e7..3c2ac73b83f7 100644
--- a/src/Infrastructure.EntityFramework/Repositories/ProviderRepository.cs
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderRepository.cs
@@ -1,13 +1,14 @@
 using AutoMapper;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Models.Data;
-using Bit.Core.Repositories;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Infrastructure.EntityFramework.Repositories;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
 
-namespace Bit.Infrastructure.EntityFramework.Repositories;
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Repositories;
 
-public class ProviderRepository : Repository<Provider, Models.Provider, Guid>, IProviderRepository
+public class ProviderRepository : Repository<Provider, Models.Provider.Provider, Guid>, IProviderRepository
 {
 
     public ProviderRepository(IServiceScopeFactory serviceScopeFactory, IMapper mapper)
diff --git a/src/Infrastructure.EntityFramework/Repositories/ProviderUserRepository.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderUserRepository.cs
similarity index 94%
rename from src/Infrastructure.EntityFramework/Repositories/ProviderUserRepository.cs
rename to src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderUserRepository.cs
index e858347fe292..ad4422da63af 100644
--- a/src/Infrastructure.EntityFramework/Repositories/ProviderUserRepository.cs
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/ProviderUserRepository.cs
@@ -1,16 +1,18 @@
 using AutoMapper;
-using Bit.Core.Entities.Provider;
-using Bit.Core.Enums.Provider;
-using Bit.Core.Models.Data;
-using Bit.Core.Repositories;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Infrastructure.EntityFramework.AdminConsole.Repositories.Queries;
+using Bit.Infrastructure.EntityFramework.Repositories;
 using Bit.Infrastructure.EntityFramework.Repositories.Queries;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.DependencyInjection;
 
-namespace Bit.Infrastructure.EntityFramework.Repositories;
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Repositories;
 
 public class ProviderUserRepository :
-    Repository<ProviderUser, Models.ProviderUser, Guid>, IProviderUserRepository
+    Repository<ProviderUser, Models.Provider.ProviderUser, Guid>, IProviderUserRepository
 {
     public ProviderUserRepository(IServiceScopeFactory serviceScopeFactory, IMapper mapper)
         : base(serviceScopeFactory, mapper, (DatabaseContext context) => context.ProviderUsers)
diff --git a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationCountByOrganizationIdsQuery.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationCountByOrganizationIdsQuery.cs
similarity index 70%
rename from src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationCountByOrganizationIdsQuery.cs
rename to src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationCountByOrganizationIdsQuery.cs
index 4d9357f2f70d..3f39f2fc520e 100644
--- a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationCountByOrganizationIdsQuery.cs
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationCountByOrganizationIdsQuery.cs
@@ -1,6 +1,8 @@
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Infrastructure.EntityFramework.Repositories;
+using Bit.Infrastructure.EntityFramework.Repositories.Queries;
 
-namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Repositories.Queries;
 
 public class ProviderOrganizationCountByOrganizationIdsQuery : IQuery<ProviderOrganization>
 {
diff --git a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationOrganizationDetailsReadByProviderIdQuery.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationOrganizationDetailsReadByProviderIdQuery.cs
similarity index 85%
rename from src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationOrganizationDetailsReadByProviderIdQuery.cs
rename to src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationOrganizationDetailsReadByProviderIdQuery.cs
index 04d690a74340..af42114ad8a2 100644
--- a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationOrganizationDetailsReadByProviderIdQuery.cs
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationOrganizationDetailsReadByProviderIdQuery.cs
@@ -1,6 +1,8 @@
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Infrastructure.EntityFramework.Repositories;
+using Bit.Infrastructure.EntityFramework.Repositories.Queries;
 
-namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Repositories.Queries;
 
 public class ProviderOrganizationOrganizationDetailsReadByProviderIdQuery : IQuery<ProviderOrganizationOrganizationDetails>
 {
diff --git a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationReadByUserIdQuery.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationReadByUserIdQuery.cs
similarity index 80%
rename from src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationReadByUserIdQuery.cs
rename to src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationReadByUserIdQuery.cs
index d28e178ab088..896be67a0598 100644
--- a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderOrganizationReadByUserIdQuery.cs
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderOrganizationReadByUserIdQuery.cs
@@ -1,6 +1,8 @@
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Infrastructure.EntityFramework.Repositories;
+using Bit.Infrastructure.EntityFramework.Repositories.Queries;
 
-namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Repositories.Queries;
 
 public class ProviderOrganizationReadByUserIdQuery : IQuery<ProviderOrganizationProviderDetails>
 {
diff --git a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderUserOrganizationDetailsViewQuery.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderUserOrganizationDetailsViewQuery.cs
similarity index 87%
rename from src/Infrastructure.EntityFramework/Repositories/Queries/ProviderUserOrganizationDetailsViewQuery.cs
rename to src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderUserOrganizationDetailsViewQuery.cs
index d578012f42ab..95a83968bc4e 100644
--- a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderUserOrganizationDetailsViewQuery.cs
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderUserOrganizationDetailsViewQuery.cs
@@ -1,6 +1,8 @@
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Infrastructure.EntityFramework.Repositories;
+using Bit.Infrastructure.EntityFramework.Repositories.Queries;
 
-namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Repositories.Queries;
 
 public class ProviderUserOrganizationDetailsViewQuery : IQuery<ProviderUserOrganizationDetails>
 {
diff --git a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderUserProviderDetailsReadByUserIdStatusQuery.cs b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderUserProviderDetailsReadByUserIdStatusQuery.cs
similarity index 81%
rename from src/Infrastructure.EntityFramework/Repositories/Queries/ProviderUserProviderDetailsReadByUserIdStatusQuery.cs
rename to src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderUserProviderDetailsReadByUserIdStatusQuery.cs
index 1cae8437ac3a..6469ffc9ce9e 100644
--- a/src/Infrastructure.EntityFramework/Repositories/Queries/ProviderUserProviderDetailsReadByUserIdStatusQuery.cs
+++ b/src/Infrastructure.EntityFramework/AdminConsole/Repositories/Queries/ProviderUserProviderDetailsReadByUserIdStatusQuery.cs
@@ -1,7 +1,9 @@
-using Bit.Core.Enums.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Infrastructure.EntityFramework.Repositories;
+using Bit.Infrastructure.EntityFramework.Repositories.Queries;
 
-namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
+namespace Bit.Infrastructure.EntityFramework.AdminConsole.Repositories.Queries;
 
 public class ProviderUserProviderDetailsReadByUserIdStatusQuery : IQuery<ProviderUserProviderDetails>
 {
diff --git a/src/Infrastructure.EntityFramework/Auth/Models/WebAuthnCredential.cs b/src/Infrastructure.EntityFramework/Auth/Models/WebAuthnCredential.cs
new file mode 100644
index 000000000000..696fad79215b
--- /dev/null
+++ b/src/Infrastructure.EntityFramework/Auth/Models/WebAuthnCredential.cs
@@ -0,0 +1,17 @@
+using AutoMapper;
+using Bit.Infrastructure.EntityFramework.Models;
+
+namespace Bit.Infrastructure.EntityFramework.Auth.Models;
+
+public class WebAuthnCredential : Core.Auth.Entities.WebAuthnCredential
+{
+    public virtual User User { get; set; }
+}
+
+public class WebAuthnCredentialMapperProfile : Profile
+{
+    public WebAuthnCredentialMapperProfile()
+    {
+        CreateMap<Core.Auth.Entities.WebAuthnCredential, WebAuthnCredential>().ReverseMap();
+    }
+}
diff --git a/src/Infrastructure.EntityFramework/Auth/Repositories/WebAuthnCredentialRepository.cs b/src/Infrastructure.EntityFramework/Auth/Repositories/WebAuthnCredentialRepository.cs
new file mode 100644
index 000000000000..68f14243c41e
--- /dev/null
+++ b/src/Infrastructure.EntityFramework/Auth/Repositories/WebAuthnCredentialRepository.cs
@@ -0,0 +1,37 @@
+using AutoMapper;
+using Bit.Core.Auth.Repositories;
+using Bit.Infrastructure.EntityFramework.Auth.Models;
+using Bit.Infrastructure.EntityFramework.Repositories;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.DependencyInjection;
+
+namespace Bit.Infrastructure.EntityFramework.Auth.Repositories;
+
+public class WebAuthnCredentialRepository : Repository<Core.Auth.Entities.WebAuthnCredential, WebAuthnCredential, Guid>, IWebAuthnCredentialRepository
+{
+    public WebAuthnCredentialRepository(IServiceScopeFactory serviceScopeFactory, IMapper mapper)
+        : base(serviceScopeFactory, mapper, (context) => context.WebAuthnCredentials)
+    { }
+
+    public async Task<Core.Auth.Entities.WebAuthnCredential> GetByIdAsync(Guid id, Guid userId)
+    {
+        using (var scope = ServiceScopeFactory.CreateScope())
+        {
+            var dbContext = GetDatabaseContext(scope);
+            var query = dbContext.WebAuthnCredentials.Where(d => d.Id == id && d.UserId == userId);
+            var cred = await query.FirstOrDefaultAsync();
+            return Mapper.Map<Core.Auth.Entities.WebAuthnCredential>(cred);
+        }
+    }
+
+    public async Task<ICollection<Core.Auth.Entities.WebAuthnCredential>> GetManyByUserIdAsync(Guid userId)
+    {
+        using (var scope = ServiceScopeFactory.CreateScope())
+        {
+            var dbContext = GetDatabaseContext(scope);
+            var query = dbContext.WebAuthnCredentials.Where(d => d.UserId == userId);
+            var creds = await query.ToListAsync();
+            return Mapper.Map<List<Core.Auth.Entities.WebAuthnCredential>>(creds);
+        }
+    }
+}
diff --git a/src/Infrastructure.EntityFramework/EntityFrameworkServiceCollectionExtensions.cs b/src/Infrastructure.EntityFramework/EntityFrameworkServiceCollectionExtensions.cs
index 9026a7abd14a..9123100aed20 100644
--- a/src/Infrastructure.EntityFramework/EntityFrameworkServiceCollectionExtensions.cs
+++ b/src/Infrastructure.EntityFramework/EntityFrameworkServiceCollectionExtensions.cs
@@ -84,6 +84,7 @@ public static void AddPasswordManagerEFRepositories(this IServiceCollection serv
         services.AddSingleton<ITransactionRepository, TransactionRepository>();
         services.AddSingleton<IUserRepository, UserRepository>();
         services.AddSingleton<IOrganizationDomainRepository, OrganizationDomainRepository>();
+        services.AddSingleton<IWebAuthnCredentialRepository, WebAuthnCredentialRepository>();
 
         if (selfHosted)
         {
diff --git a/src/Infrastructure.EntityFramework/Models/Provider/Provider.cs b/src/Infrastructure.EntityFramework/Models/Provider/Provider.cs
deleted file mode 100644
index d639d6d01dc2..000000000000
--- a/src/Infrastructure.EntityFramework/Models/Provider/Provider.cs
+++ /dev/null
@@ -1,15 +0,0 @@
-using AutoMapper;
-
-namespace Bit.Infrastructure.EntityFramework.Models;
-
-public class Provider : Core.Entities.Provider.Provider
-{
-}
-
-public class ProviderMapperProfile : Profile
-{
-    public ProviderMapperProfile()
-    {
-        CreateMap<Core.Entities.Provider.Provider, Provider>().ReverseMap();
-    }
-}
diff --git a/src/Infrastructure.EntityFramework/Models/Provider/ProviderOrganization.cs b/src/Infrastructure.EntityFramework/Models/Provider/ProviderOrganization.cs
deleted file mode 100644
index af23ba978c7f..000000000000
--- a/src/Infrastructure.EntityFramework/Models/Provider/ProviderOrganization.cs
+++ /dev/null
@@ -1,17 +0,0 @@
-using AutoMapper;
-
-namespace Bit.Infrastructure.EntityFramework.Models;
-
-public class ProviderOrganization : Core.Entities.Provider.ProviderOrganization
-{
-    public virtual Provider Provider { get; set; }
-    public virtual Organization Organization { get; set; }
-}
-
-public class ProviderOrganizationMapperProfile : Profile
-{
-    public ProviderOrganizationMapperProfile()
-    {
-        CreateMap<Core.Entities.Provider.ProviderOrganization, ProviderOrganization>().ReverseMap();
-    }
-}
diff --git a/src/Infrastructure.EntityFramework/Models/Provider/ProviderUser.cs b/src/Infrastructure.EntityFramework/Models/Provider/ProviderUser.cs
deleted file mode 100644
index 5c53c4d97969..000000000000
--- a/src/Infrastructure.EntityFramework/Models/Provider/ProviderUser.cs
+++ /dev/null
@@ -1,17 +0,0 @@
-using AutoMapper;
-
-namespace Bit.Infrastructure.EntityFramework.Models;
-
-public class ProviderUser : Core.Entities.Provider.ProviderUser
-{
-    public virtual User User { get; set; }
-    public virtual Provider Provider { get; set; }
-}
-
-public class ProviderUserMapperProfile : Profile
-{
-    public ProviderUserMapperProfile()
-    {
-        CreateMap<Core.Entities.Provider.ProviderUser, ProviderUser>().ReverseMap();
-    }
-}
diff --git a/src/Infrastructure.EntityFramework/Repositories/DatabaseContext.cs b/src/Infrastructure.EntityFramework/Repositories/DatabaseContext.cs
index bf10d6d559bf..f0275d5760b1 100644
--- a/src/Infrastructure.EntityFramework/Repositories/DatabaseContext.cs
+++ b/src/Infrastructure.EntityFramework/Repositories/DatabaseContext.cs
@@ -1,4 +1,5 @@
 using Bit.Core;
+using Bit.Infrastructure.EntityFramework.AdminConsole.Models.Provider;
 using Bit.Infrastructure.EntityFramework.Auth.Models;
 using Bit.Infrastructure.EntityFramework.Converters;
 using Bit.Infrastructure.EntityFramework.Models;
@@ -59,6 +60,7 @@ public DatabaseContext(DbContextOptions<DatabaseContext> options)
     public DbSet<User> Users { get; set; }
     public DbSet<AuthRequest> AuthRequests { get; set; }
     public DbSet<OrganizationDomain> OrganizationDomains { get; set; }
+    public DbSet<WebAuthnCredential> WebAuthnCredentials { get; set; }
 
     protected override void OnModelCreating(ModelBuilder builder)
     {
@@ -98,6 +100,7 @@ protected override void OnModelCreating(ModelBuilder builder)
         var eOrganizationApiKey = builder.Entity<OrganizationApiKey>();
         var eOrganizationConnection = builder.Entity<OrganizationConnection>();
         var eOrganizationDomain = builder.Entity<OrganizationDomain>();
+        var aWebAuthnCredential = builder.Entity<WebAuthnCredential>();
 
         eCipher.Property(c => c.Id).ValueGeneratedNever();
         eCollection.Property(c => c.Id).ValueGeneratedNever();
@@ -122,6 +125,7 @@ protected override void OnModelCreating(ModelBuilder builder)
         eOrganizationApiKey.Property(c => c.Id).ValueGeneratedNever();
         eOrganizationConnection.Property(c => c.Id).ValueGeneratedNever();
         eOrganizationDomain.Property(ar => ar.Id).ValueGeneratedNever();
+        aWebAuthnCredential.Property(ar => ar.Id).ValueGeneratedNever();
 
         eCollectionCipher.HasKey(cc => new { cc.CollectionId, cc.CipherId });
         eCollectionUser.HasKey(cu => new { cu.CollectionId, cu.OrganizationUserId });
@@ -173,6 +177,7 @@ protected override void OnModelCreating(ModelBuilder builder)
         eOrganizationApiKey.ToTable(nameof(OrganizationApiKey));
         eOrganizationConnection.ToTable(nameof(OrganizationConnection));
         eOrganizationDomain.ToTable(nameof(OrganizationDomain));
+        aWebAuthnCredential.ToTable(nameof(WebAuthnCredential));
 
         ConfigureDateTimeUtcQueries(builder);
     }
diff --git a/src/Infrastructure.EntityFramework/Repositories/DatabaseContextExtensions.cs b/src/Infrastructure.EntityFramework/Repositories/DatabaseContextExtensions.cs
index 94d8bb52d8aa..223a47d2b0f6 100644
--- a/src/Infrastructure.EntityFramework/Repositories/DatabaseContextExtensions.cs
+++ b/src/Infrastructure.EntityFramework/Repositories/DatabaseContextExtensions.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Auth.Enums;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.Auth.Enums;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Infrastructure.EntityFramework.Repositories.Queries;
 using Microsoft.EntityFrameworkCore;
 
diff --git a/src/Infrastructure.EntityFramework/Repositories/OrganizationRepository.cs b/src/Infrastructure.EntityFramework/Repositories/OrganizationRepository.cs
index 62f4df63e366..b20026a6b70f 100644
--- a/src/Infrastructure.EntityFramework/Repositories/OrganizationRepository.cs
+++ b/src/Infrastructure.EntityFramework/Repositories/OrganizationRepository.cs
@@ -95,41 +95,44 @@ public async Task<ICollection<OrganizationAbility>> GetManyAbilitiesAsync()
 
     public async Task<ICollection<Core.Entities.Organization>> SearchUnassignedToProviderAsync(string name, string ownerEmail, int skip, int take)
     {
-        using (var scope = ServiceScopeFactory.CreateScope())
+        using var scope = ServiceScopeFactory.CreateScope();
+        var dbContext = GetDatabaseContext(scope);
+        var query = from o in dbContext.Organizations
+                    where o.PlanType >= PlanType.TeamsMonthly2020 && o.PlanType <= PlanType.EnterpriseAnnually &&
+                          !dbContext.ProviderOrganizations.Any(po => po.OrganizationId == o.Id) &&
+                          (string.IsNullOrWhiteSpace(name) || EF.Functions.Like(o.Name, $"%{name}%"))
+                    select o;
+
+        if (string.IsNullOrWhiteSpace(ownerEmail))
         {
-            var dbContext = GetDatabaseContext(scope);
-            var query = from o in dbContext.Organizations
-                        where o.PlanType >= PlanType.TeamsMonthly && o.PlanType <= PlanType.EnterpriseAnnually &&
-                              !dbContext.ProviderOrganizations.Any(po => po.OrganizationId == o.Id) &&
-                              (string.IsNullOrWhiteSpace(name) || EF.Functions.Like(o.Name, $"%{name}%"))
-                        select o;
+            return await query.OrderByDescending(o => o.CreationDate)
+                .Skip(skip)
+                .Take(take)
+                .ToArrayAsync();
+        }
 
-            if (!string.IsNullOrWhiteSpace(ownerEmail))
-            {
-                if (dbContext.Database.IsNpgsql())
-                {
-                    query = from o in query
-                            join ou in dbContext.OrganizationUsers
-                                on o.Id equals ou.OrganizationId
-                            join u in dbContext.Users
-                                on ou.UserId equals u.Id
-                            where ou.Type == OrganizationUserType.Owner && EF.Functions.ILike(EF.Functions.Collate(u.Email, "default"), $"{ownerEmail}%")
-                            select o;
-                }
-                else
-                {
-                    query = from o in query
-                            join ou in dbContext.OrganizationUsers
-                                on o.Id equals ou.OrganizationId
-                            join u in dbContext.Users
-                                on ou.UserId equals u.Id
-                            where ou.Type == OrganizationUserType.Owner && EF.Functions.Like(u.Email, $"{ownerEmail}%")
-                            select o;
-                }
-            }
-
-            return await query.OrderByDescending(o => o.CreationDate).Skip(skip).Take(take).ToArrayAsync();
+        if (dbContext.Database.IsNpgsql())
+        {
+            query = from o in query
+                    join ou in dbContext.OrganizationUsers
+                        on o.Id equals ou.OrganizationId
+                    join u in dbContext.Users
+                        on ou.UserId equals u.Id
+                    where ou.Type == OrganizationUserType.Owner && EF.Functions.ILike(EF.Functions.Collate(u.Email, "default"), $"{ownerEmail}%")
+                    select o;
         }
+        else
+        {
+            query = from o in query
+                    join ou in dbContext.OrganizationUsers
+                        on o.Id equals ou.OrganizationId
+                    join u in dbContext.Users
+                        on ou.UserId equals u.Id
+                    where ou.Type == OrganizationUserType.Owner && EF.Functions.Like(u.Email, $"{ownerEmail}%")
+                    select o;
+        }
+
+        return await query.OrderByDescending(o => o.CreationDate).Skip(skip).Take(take).ToArrayAsync();
     }
 
     public async Task UpdateStorageAsync(Guid id)
diff --git a/src/Infrastructure.EntityFramework/Repositories/Queries/UserReadPublicKeysByProviderUserIdsQuery.cs b/src/Infrastructure.EntityFramework/Repositories/Queries/UserReadPublicKeysByProviderUserIdsQuery.cs
index db347b99b4a2..bb54520f4b04 100644
--- a/src/Infrastructure.EntityFramework/Repositories/Queries/UserReadPublicKeysByProviderUserIdsQuery.cs
+++ b/src/Infrastructure.EntityFramework/Repositories/Queries/UserReadPublicKeysByProviderUserIdsQuery.cs
@@ -1,5 +1,5 @@
-using Bit.Core.Enums.Provider;
-using Bit.Core.Models.Data;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 
 namespace Bit.Infrastructure.EntityFramework.Repositories.Queries;
 
diff --git a/src/Notifications/packages.lock.json b/src/Notifications/packages.lock.json
index 3da9edc48ef3..69046d6f34de 100644
--- a/src/Notifications/packages.lock.json
+++ b/src/Notifications/packages.lock.json
@@ -2681,7 +2681,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2689,7 +2689,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2701,9 +2701,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/src/SharedWeb/Utilities/ServiceCollectionExtensions.cs b/src/SharedWeb/Utilities/ServiceCollectionExtensions.cs
index 20b8d31c8f3a..c12c849e3789 100644
--- a/src/SharedWeb/Utilities/ServiceCollectionExtensions.cs
+++ b/src/SharedWeb/Utilities/ServiceCollectionExtensions.cs
@@ -5,6 +5,7 @@
 using AspNetCoreRateLimit;
 using Bit.Core.AdminConsole.Services;
 using Bit.Core.AdminConsole.Services.Implementations;
+using Bit.Core.AdminConsole.Services.NoopImplementations;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Identity;
 using Bit.Core.Auth.IdentityServer;
@@ -12,6 +13,7 @@
 using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Auth.Services;
 using Bit.Core.Auth.Services.Implementations;
+using Bit.Core.Auth.UserFeatures;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.HostedServices;
@@ -126,7 +128,7 @@ public static SupportedDatabaseProviders AddDatabaseRepositories(this IServiceCo
     public static void AddBaseServices(this IServiceCollection services, IGlobalSettings globalSettings)
     {
         services.AddScoped<ICipherService, CipherService>();
-        services.AddScoped<IUserService, UserService>();
+        services.AddUserServices(globalSettings);
         services.AddOrganizationServices(globalSettings);
         services.AddScoped<ICollectionService, CollectionService>();
         services.AddScoped<IGroupService, GroupService>();
@@ -151,6 +153,7 @@ public static void AddTokenizers(this IServiceCollection services)
                 serviceProvider.GetDataProtectionProvider(),
                 serviceProvider.GetRequiredService<ILogger<DataProtectorTokenFactory<EmergencyAccessInviteTokenable>>>())
         );
+
         services.AddSingleton<IDataProtectorTokenFactory<HCaptchaTokenable>>(serviceProvider =>
             new DataProtectorTokenFactory<HCaptchaTokenable>(
                 HCaptchaTokenable.ClearTextPrefix,
@@ -158,18 +161,39 @@ public static void AddTokenizers(this IServiceCollection services)
                 serviceProvider.GetDataProtectionProvider(),
                 serviceProvider.GetRequiredService<ILogger<DataProtectorTokenFactory<HCaptchaTokenable>>>())
         );
+
         services.AddSingleton<IDataProtectorTokenFactory<SsoTokenable>>(serviceProvider =>
             new DataProtectorTokenFactory<SsoTokenable>(
                 SsoTokenable.ClearTextPrefix,
                 SsoTokenable.DataProtectorPurpose,
                 serviceProvider.GetDataProtectionProvider(),
                 serviceProvider.GetRequiredService<ILogger<DataProtectorTokenFactory<SsoTokenable>>>()));
+        services.AddSingleton<IDataProtectorTokenFactory<WebAuthnLoginTokenable>>(serviceProvider =>
+            new DataProtectorTokenFactory<WebAuthnLoginTokenable>(
+                WebAuthnLoginTokenable.ClearTextPrefix,
+                WebAuthnLoginTokenable.DataProtectorPurpose,
+                serviceProvider.GetDataProtectionProvider(),
+                serviceProvider.GetRequiredService<ILogger<DataProtectorTokenFactory<WebAuthnLoginTokenable>>>()));
+        services.AddSingleton<IDataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable>>(serviceProvider =>
+            new DataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable>(
+                WebAuthnCredentialCreateOptionsTokenable.ClearTextPrefix,
+                WebAuthnCredentialCreateOptionsTokenable.DataProtectorPurpose,
+                serviceProvider.GetDataProtectionProvider(),
+                serviceProvider.GetRequiredService<ILogger<DataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable>>>()));
         services.AddSingleton<IDataProtectorTokenFactory<SsoEmail2faSessionTokenable>>(serviceProvider =>
             new DataProtectorTokenFactory<SsoEmail2faSessionTokenable>(
                 SsoEmail2faSessionTokenable.ClearTextPrefix,
                 SsoEmail2faSessionTokenable.DataProtectorPurpose,
                 serviceProvider.GetDataProtectionProvider(),
                 serviceProvider.GetRequiredService<ILogger<DataProtectorTokenFactory<SsoEmail2faSessionTokenable>>>()));
+
+        services.AddSingleton<IOrgUserInviteTokenableFactory, OrgUserInviteTokenableFactory>();
+        services.AddSingleton<IDataProtectorTokenFactory<OrgUserInviteTokenable>>(serviceProvider =>
+            new DataProtectorTokenFactory<OrgUserInviteTokenable>(
+                OrgUserInviteTokenable.ClearTextPrefix,
+                OrgUserInviteTokenable.DataProtectorPurpose,
+                serviceProvider.GetDataProtectionProvider(),
+                serviceProvider.GetRequiredService<ILogger<DataProtectorTokenFactory<OrgUserInviteTokenable>>>()));
     }
 
     public static void AddDefaultServices(this IServiceCollection services, GlobalSettings globalSettings)
diff --git a/src/SharedWeb/packages.lock.json b/src/SharedWeb/packages.lock.json
index 08d941f5b0cb..50125960fa70 100644
--- a/src/SharedWeb/packages.lock.json
+++ b/src/SharedWeb/packages.lock.json
@@ -2631,7 +2631,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2639,7 +2639,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
diff --git a/src/Sql/Sql.sqlproj b/src/Sql/Sql.sqlproj
index 09f8eceddb3f..b53ba1aeb361 100644
--- a/src/Sql/Sql.sqlproj
+++ b/src/Sql/Sql.sqlproj
@@ -6,8 +6,11 @@
     <ProjectGuid>{58554e52-fdec-4832-aff9-302b01e08dca}</ProjectGuid>
     <DSP>Microsoft.Data.Tools.Schema.Sql.SqlAzureV12DatabaseSchemaProvider</DSP>
     <ModelCollation>1033,CI</ModelCollation>
+    <TargetDatabaseSet>True</TargetDatabaseSet>
+    <TargetFrameworkVersion>v4.7.2</TargetFrameworkVersion>
+    <TargetFrameworkProfile />
   </PropertyGroup>
   <ItemGroup>
-    <Build Remove="dbo_future/**/*"/>
+    <Build Remove="dbo_future/**/*" />
   </ItemGroup>
-</Project>
+</Project>
\ No newline at end of file
diff --git a/src/Sql/dbo/Stored Procedures/WebAuthnCredential_Create.sql b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_Create.sql
new file mode 100644
index 000000000000..b5f45e094a6a
--- /dev/null
+++ b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_Create.sql	
@@ -0,0 +1,54 @@
+CREATE PROCEDURE [dbo].[WebAuthnCredential_Create]
+    @Id UNIQUEIDENTIFIER OUTPUT,
+    @UserId UNIQUEIDENTIFIER,
+    @Name NVARCHAR(50),
+    @PublicKey VARCHAR (256),
+    @CredentialId VARCHAR(256),
+    @Counter INT,
+    @Type VARCHAR(20),
+    @AaGuid UNIQUEIDENTIFIER,
+    @EncryptedUserKey VARCHAR (MAX),
+    @EncryptedPrivateKey VARCHAR (MAX),
+    @EncryptedPublicKey VARCHAR (MAX),
+    @SupportsPrf BIT,
+    @CreationDate DATETIME2(7),
+    @RevisionDate DATETIME2(7)
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    INSERT INTO [dbo].[WebAuthnCredential]
+    (
+        [Id],
+        [UserId],
+        [Name],
+        [PublicKey],
+        [CredentialId],
+        [Counter],
+        [Type],
+        [AaGuid],
+        [EncryptedUserKey],
+        [EncryptedPrivateKey],
+        [EncryptedPublicKey],
+        [SupportsPrf],
+        [CreationDate],
+        [RevisionDate]
+    )
+    VALUES
+    (
+        @Id,
+        @UserId,
+        @Name,
+        @PublicKey,
+        @CredentialId,
+        @Counter,
+        @Type,
+        @AaGuid,
+        @EncryptedUserKey,
+        @EncryptedPrivateKey,
+        @EncryptedPublicKey,
+        @SupportsPrf,
+        @CreationDate,
+        @RevisionDate
+    )
+END
diff --git a/src/Sql/dbo/Stored Procedures/WebAuthnCredential_DeleteById.sql b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_DeleteById.sql
new file mode 100644
index 000000000000..cb3be12dca10
--- /dev/null
+++ b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_DeleteById.sql	
@@ -0,0 +1,12 @@
+CREATE PROCEDURE [dbo].[WebAuthnCredential_DeleteById]
+    @Id UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    DELETE
+    FROM
+        [dbo].[WebAuthnCredential]
+    WHERE
+        [Id] = @Id
+END
\ No newline at end of file
diff --git a/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadById.sql b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadById.sql
new file mode 100644
index 000000000000..f960fecf9b45
--- /dev/null
+++ b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadById.sql	
@@ -0,0 +1,13 @@
+CREATE PROCEDURE [dbo].[WebAuthnCredential_ReadById]
+    @Id UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        *
+    FROM
+        [dbo].[WebAuthnCredentialView]
+    WHERE
+        [Id] = @Id
+END
\ No newline at end of file
diff --git a/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadByIdUserId.sql b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadByIdUserId.sql
new file mode 100644
index 000000000000..8b0f1d19f99f
--- /dev/null
+++ b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadByIdUserId.sql	
@@ -0,0 +1,16 @@
+CREATE PROCEDURE [dbo].[WebAuthnCredential_ReadByIdUserId]
+    @Id UNIQUEIDENTIFIER,
+    @UserId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        *
+    FROM
+        [dbo].[WebAuthnCredentialView]
+    WHERE
+        [Id] = @Id
+    AND
+        [UserId] = @UserId
+END
diff --git a/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadByUserId.sql b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadByUserId.sql
new file mode 100644
index 000000000000..001f2fe0b949
--- /dev/null
+++ b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_ReadByUserId.sql	
@@ -0,0 +1,13 @@
+CREATE PROCEDURE [dbo].[WebAuthnCredential_ReadByUserId]
+    @UserId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        *
+    FROM
+        [dbo].[WebAuthnCredentialView]
+    WHERE
+        [UserId] = @UserId
+END
\ No newline at end of file
diff --git a/src/Sql/dbo/Stored Procedures/WebAuthnCredential_Update.sql b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_Update.sql
new file mode 100644
index 000000000000..5a4da528c8fb
--- /dev/null
+++ b/src/Sql/dbo/Stored Procedures/WebAuthnCredential_Update.sql	
@@ -0,0 +1,38 @@
+CREATE PROCEDURE [dbo].[WebAuthnCredential_Update]
+    @Id UNIQUEIDENTIFIER,
+    @UserId UNIQUEIDENTIFIER,
+    @Name NVARCHAR(50),
+    @PublicKey VARCHAR (256),
+    @CredentialId VARCHAR(256),
+    @Counter INT,
+    @Type VARCHAR(20),
+    @AaGuid UNIQUEIDENTIFIER,
+    @EncryptedUserKey VARCHAR (MAX),
+    @EncryptedPrivateKey VARCHAR (MAX),
+    @EncryptedPublicKey VARCHAR (MAX),
+    @SupportsPrf BIT,
+    @CreationDate DATETIME2(7),
+    @RevisionDate DATETIME2(7)
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    UPDATE
+        [dbo].[WebAuthnCredential]
+    SET
+        [UserId] = @UserId,
+        [Name] = @Name,
+        [PublicKey] = @PublicKey,
+        [CredentialId] = @CredentialId,
+        [Counter] = @Counter,
+        [Type] = @Type,
+        [AaGuid] = @AaGuid,
+        [EncryptedUserKey] = @EncryptedUserKey,
+        [EncryptedPrivateKey] = @EncryptedPrivateKey,
+        [EncryptedPublicKey] = @EncryptedPublicKey,
+        [SupportsPrf] = @SupportsPrf,
+        [CreationDate] = @CreationDate,
+        [RevisionDate] = @RevisionDate
+    WHERE
+        [Id] = @Id
+END
diff --git a/src/Sql/dbo/Tables/WebAuthnCredential.sql b/src/Sql/dbo/Tables/WebAuthnCredential.sql
new file mode 100644
index 000000000000..17828df706ed
--- /dev/null
+++ b/src/Sql/dbo/Tables/WebAuthnCredential.sql
@@ -0,0 +1,24 @@
+CREATE TABLE [dbo].[WebAuthnCredential] (
+    [Id]                    UNIQUEIDENTIFIER NOT NULL,
+    [UserId]                UNIQUEIDENTIFIER NOT NULL,
+    [Name]                  NVARCHAR (50)    NOT NULL,
+    [PublicKey]             VARCHAR (256)    NOT NULL,
+    [CredentialId]          VARCHAR (256)    NOT NULL,
+    [Counter]               INT              NOT NULL,
+    [Type]                  VARCHAR (20)     NULL,
+    [AaGuid]                UNIQUEIDENTIFIER NOT NULL,
+    [EncryptedUserKey]      VARCHAR (MAX)    NULL,
+    [EncryptedPrivateKey]   VARCHAR (MAX)    NULL,
+    [EncryptedPublicKey]    VARCHAR (MAX)    NULL,
+    [SupportsPrf]           BIT              NOT NULL,
+    [CreationDate]          DATETIME2 (7)    NOT NULL,
+    [RevisionDate]          DATETIME2 (7)    NOT NULL,
+    CONSTRAINT [PK_WebAuthnCredential] PRIMARY KEY CLUSTERED ([Id] ASC),
+    CONSTRAINT [FK_WebAuthnCredential_User] FOREIGN KEY ([UserId]) REFERENCES [dbo].[User] ([Id])
+);
+
+
+GO
+CREATE NONCLUSTERED INDEX [IX_WebAuthnCredential_UserId]
+    ON [dbo].[WebAuthnCredential]([UserId] ASC);
+
diff --git a/src/Sql/dbo/Views/WebAuthnCredentialView.sql b/src/Sql/dbo/Views/WebAuthnCredentialView.sql
new file mode 100644
index 000000000000..69b92eff2359
--- /dev/null
+++ b/src/Sql/dbo/Views/WebAuthnCredentialView.sql
@@ -0,0 +1,6 @@
+CREATE VIEW [dbo].[WebAuthnCredentialView]
+AS
+SELECT
+    *
+FROM
+    [dbo].[WebAuthnCredential]
diff --git a/test/Api.IntegrationTest/Factories/ApiApplicationFactory.cs b/test/Api.IntegrationTest/Factories/ApiApplicationFactory.cs
index b0d9594bc51f..dc27ad506878 100644
--- a/test/Api.IntegrationTest/Factories/ApiApplicationFactory.cs
+++ b/test/Api.IntegrationTest/Factories/ApiApplicationFactory.cs
@@ -2,17 +2,22 @@
 using Bit.IntegrationTestCommon.Factories;
 using IdentityServer4.AccessTokenValidation;
 using Microsoft.AspNetCore.TestHost;
+using Microsoft.Data.Sqlite;
 
 namespace Bit.Api.IntegrationTest.Factories;
 
 public class ApiApplicationFactory : WebApplicationFactoryBase<Startup>
 {
     private readonly IdentityApplicationFactory _identityApplicationFactory;
+    private const string _connectionString = "DataSource=:memory:";
 
     public ApiApplicationFactory()
     {
+        SqliteConnection = new SqliteConnection(_connectionString);
+        SqliteConnection.Open();
+
         _identityApplicationFactory = new IdentityApplicationFactory();
-        _identityApplicationFactory.DatabaseName = DatabaseName;
+        _identityApplicationFactory.SqliteConnection = SqliteConnection;
     }
 
     protected override void ConfigureWebHost(IWebHostBuilder builder)
@@ -53,4 +58,10 @@ await _identityApplicationFactory.RegisterAsync(new RegisterRequestModel
     {
         return await _identityApplicationFactory.TokenFromPasswordAsync(email, masterPasswordHash);
     }
+
+    protected override void Dispose(bool disposing)
+    {
+        base.Dispose(disposing);
+        SqliteConnection.Dispose();
+    }
 }
diff --git a/test/Api.IntegrationTest/SecretsManager/Controllers/AccessPoliciesControllerTests.cs b/test/Api.IntegrationTest/SecretsManager/Controllers/AccessPoliciesControllerTests.cs
index 006bcc2c246d..c5873b12b842 100644
--- a/test/Api.IntegrationTest/SecretsManager/Controllers/AccessPoliciesControllerTests.cs
+++ b/test/Api.IntegrationTest/SecretsManager/Controllers/AccessPoliciesControllerTests.cs
@@ -5,6 +5,7 @@
 using Bit.Api.Models.Response;
 using Bit.Api.SecretsManager.Models.Request;
 using Bit.Api.SecretsManager.Models.Response;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.SecretsManager.Entities;
 using Bit.Core.SecretsManager.Repositories;
@@ -661,16 +662,15 @@ public async Task CreateServiceAccountAccessPolicies_MismatchOrgId_NotFound(Perm
     {
         var (org, orgUser) = await _organizationHelper.Initialize(true, true, true);
         await LoginAsync(_email);
-        var ownerOrgUserId = orgUser.Id;
+        var anotherOrg = await _organizationHelper.CreateSmOrganizationAsync();
 
         var serviceAccount = await _serviceAccountRepository.CreateAsync(new ServiceAccount
         {
-            OrganizationId = Guid.NewGuid(),
+            OrganizationId = anotherOrg.Id,
             Name = _mockEncryptedString,
         });
         var request =
-            await SetupUserServiceAccountAccessPolicyRequestAsync(permissionType, org.Id, orgUser.Id,
-                serviceAccount.Id);
+            await SetupUserServiceAccountAccessPolicyRequestAsync(permissionType, orgUser.Id, serviceAccount.Id);
 
         var response =
             await _client.PostAsJsonAsync($"/service-accounts/{serviceAccount.Id}/access-policies", request);
@@ -692,8 +692,7 @@ public async Task CreateServiceAccountAccessPolicies_Success(PermissionType perm
             Name = _mockEncryptedString,
         });
         var request =
-            await SetupUserServiceAccountAccessPolicyRequestAsync(permissionType, org.Id, orgUser.Id,
-                serviceAccount.Id);
+            await SetupUserServiceAccountAccessPolicyRequestAsync(permissionType, orgUser.Id, serviceAccount.Id);
 
         var response =
             await _client.PostAsJsonAsync($"/service-accounts/{serviceAccount.Id}/access-policies", request);
@@ -1086,9 +1085,15 @@ private async Task<RequestSetupData> SetupAccessPolicyRequest(Guid organizationI
     private async Task<(Guid ProjectId, Guid ServiceAccountId)> CreateProjectAndServiceAccountAsync(Guid organizationId,
         bool misMatchOrganization = false)
     {
+        var newOrg = new Organization();
+        if (misMatchOrganization)
+        {
+            newOrg = await _organizationHelper.CreateSmOrganizationAsync();
+        }
+
         var project = await _projectRepository.CreateAsync(new Project
         {
-            OrganizationId = misMatchOrganization ? Guid.NewGuid() : organizationId,
+            OrganizationId = misMatchOrganization ? newOrg.Id : organizationId,
             Name = _mockEncryptedString,
         });
 
@@ -1127,7 +1132,7 @@ private async Task SetupProjectAndServiceAccountPermissionAsync(PermissionType p
     }
 
     private async Task<AccessPoliciesCreateRequest> SetupUserServiceAccountAccessPolicyRequestAsync(
-        PermissionType permissionType, Guid organizationId, Guid userId, Guid serviceAccountId)
+        PermissionType permissionType, Guid userId, Guid serviceAccountId)
     {
         if (permissionType == PermissionType.RunAsUserWithPermission)
         {
diff --git a/test/Api.IntegrationTest/SecretsManager/Controllers/SecretsControllerTests.cs b/test/Api.IntegrationTest/SecretsManager/Controllers/SecretsControllerTests.cs
index 8cea05c5cb7f..4932ad9b9b89 100644
--- a/test/Api.IntegrationTest/SecretsManager/Controllers/SecretsControllerTests.cs
+++ b/test/Api.IntegrationTest/SecretsManager/Controllers/SecretsControllerTests.cs
@@ -189,15 +189,17 @@ public async Task CreateWithDifferentProjectOrgId_RunAsAdmin_NotFound()
     {
         var (org, _) = await _organizationHelper.Initialize(true, true, true);
         await LoginAsync(_email);
+        var anotherOrg = await _organizationHelper.CreateSmOrganizationAsync();
 
-        var project = await _projectRepository.CreateAsync(new Project { Name = "123" });
+        var project =
+            await _projectRepository.CreateAsync(new Project { Name = "123", OrganizationId = anotherOrg.Id });
 
         var request = new SecretCreateRequestModel
         {
-            ProjectIds = new Guid[] { project.Id },
+            ProjectIds = new[] { project.Id },
             Key = _mockEncryptedString,
             Value = _mockEncryptedString,
-            Note = _mockEncryptedString,
+            Note = _mockEncryptedString
         };
 
         var response = await _client.PostAsJsonAsync($"/organizations/{org.Id}/secrets", request);
@@ -594,8 +596,9 @@ public async Task UpdateWithDifferentProjectOrgId_RunAsAdmin_NotFound()
     {
         var (org, _) = await _organizationHelper.Initialize(true, true, true);
         await LoginAsync(_email);
+        var anotherOrg = await _organizationHelper.CreateSmOrganizationAsync();
 
-        var project = await _projectRepository.CreateAsync(new Project { Name = "123" });
+        var project = await _projectRepository.CreateAsync(new Project { Name = "123", OrganizationId = anotherOrg.Id });
 
         var secret = await _secretRepository.CreateAsync(new Secret
         {
@@ -698,7 +701,7 @@ public async Task Delete_Success(PermissionType permissionType)
         var (org, _) = await _organizationHelper.Initialize(true, true, true);
         await LoginAsync(_email);
 
-        var (project, secretIds) = await CreateSecretsAsync(org.Id, 3);
+        var (project, secretIds) = await CreateSecretsAsync(org.Id);
 
         if (permissionType == PermissionType.RunAsUserWithPermission)
         {
@@ -709,24 +712,22 @@ public async Task Delete_Success(PermissionType permissionType)
             {
                 new UserProjectAccessPolicy
                 {
-                    GrantedProjectId = project.Id, OrganizationUserId = orgUser.Id, Read = true, Write = true,
-                },
+                    GrantedProjectId = project.Id, OrganizationUserId = orgUser.Id, Read = true, Write = true
+                }
             };
             await _accessPolicyRepository.CreateManyAsync(accessPolicies);
         }
 
-        var response = await _client.PostAsJsonAsync($"/secrets/delete", secretIds);
+        var response = await _client.PostAsJsonAsync("/secrets/delete", secretIds);
         response.EnsureSuccessStatusCode();
 
         var results = await response.Content.ReadFromJsonAsync<ListResponseModel<BulkDeleteResponseModel>>();
-        Assert.NotNull(results);
-
-        var index = 0;
+        Assert.NotNull(results?.Data);
+        Assert.Equal(secretIds.Count, results!.Data.Count());
         foreach (var result in results!.Data)
         {
-            Assert.Equal(secretIds[index], result.Id);
+            Assert.Contains(result.Id, secretIds);
             Assert.Null(result.Error);
-            index++;
         }
 
         var secrets = await _secretRepository.GetManyByIds(secretIds);
diff --git a/test/Api.IntegrationTest/SecretsManager/Controllers/ServiceAccountsControllerTests.cs b/test/Api.IntegrationTest/SecretsManager/Controllers/ServiceAccountsControllerTests.cs
index 8150dced5229..86e8c81b13c6 100644
--- a/test/Api.IntegrationTest/SecretsManager/Controllers/ServiceAccountsControllerTests.cs
+++ b/test/Api.IntegrationTest/SecretsManager/Controllers/ServiceAccountsControllerTests.cs
@@ -704,14 +704,14 @@ public async Task RevokeAccessToken_SmAccessDenied_NotFound(bool useSecrets, boo
         var serviceAccount = await _serviceAccountRepository.CreateAsync(new ServiceAccount
         {
             OrganizationId = org.Id,
-            Name = _mockEncryptedString,
+            Name = _mockEncryptedString
         });
 
         var accessToken = await _apiKeyRepository.CreateAsync(new ApiKey
         {
-            ServiceAccountId = org.Id,
+            ServiceAccountId = serviceAccount.Id,
             Name = _mockEncryptedString,
-            ExpireAt = DateTime.UtcNow.AddDays(30),
+            ExpireAt = DateTime.UtcNow.AddDays(30)
         });
 
         var request = new RevokeAccessTokensRequest
@@ -753,9 +753,9 @@ await _accessPolicyRepository.CreateManyAsync(new List<BaseAccessPolicy> {
 
         var accessToken = await _apiKeyRepository.CreateAsync(new ApiKey
         {
-            ServiceAccountId = org.Id,
+            ServiceAccountId = serviceAccount.Id,
             Name = _mockEncryptedString,
-            ExpireAt = DateTime.UtcNow.AddDays(30),
+            ExpireAt = DateTime.UtcNow.AddDays(30)
         });
 
         var request = new RevokeAccessTokensRequest
diff --git a/test/Api.IntegrationTest/SecretsManager/SecretsManagerOrganizationHelper.cs b/test/Api.IntegrationTest/SecretsManager/SecretsManagerOrganizationHelper.cs
index 6430f7199a97..fdb14e8cc6b2 100644
--- a/test/Api.IntegrationTest/SecretsManager/SecretsManagerOrganizationHelper.cs
+++ b/test/Api.IntegrationTest/SecretsManager/SecretsManagerOrganizationHelper.cs
@@ -53,6 +53,15 @@ public SecretsManagerOrganizationHelper(ApiApplicationFactory factory, string ow
         return (_organization, _owner);
     }
 
+    public async Task<Organization> CreateSmOrganizationAsync()
+    {
+        var email = $"integration-test{Guid.NewGuid()}@bitwarden.com";
+        await _factory.LoginWithNewAccount(email);
+        var (organization, owner) =
+            await OrganizationTestHelpers.SignUpAsync(_factory, ownerEmail: email, billingEmail: email);
+        return organization;
+    }
+
     public async Task<(string email, OrganizationUser orgUser)> CreateNewUser(OrganizationUserType userType, bool accessSecrets)
     {
         var email = $"integration-test{Guid.NewGuid()}@bitwarden.com";
diff --git a/test/Api.IntegrationTest/packages.lock.json b/test/Api.IntegrationTest/packages.lock.json
index 4dacbaa00735..1632bc886980 100644
--- a/test/Api.IntegrationTest/packages.lock.json
+++ b/test/Api.IntegrationTest/packages.lock.json
@@ -747,14 +747,6 @@
         "resolved": "7.0.5",
         "contentHash": "yMLM/aK1MikVqpjxd7PJ1Pjgztd3VAd26ZHxyjxG3RPeM9cHjvS5tCg9kAAayR6eHmBg0ffZsHdT28WfA5tTlA=="
       },
-      "Microsoft.EntityFrameworkCore.InMemory": {
-        "type": "Transitive",
-        "resolved": "7.0.5",
-        "contentHash": "y3S/A/0uJX7KOhppC3xqyta6Z0PRz0qPLngH5GFu4GZ7/+Sw2u/amf7MavvR5GfZjGabGcohMpsRSahMmpF9gA==",
-        "dependencies": {
-          "Microsoft.EntityFrameworkCore": "7.0.5"
-        }
-      },
       "Microsoft.EntityFrameworkCore.Relational": {
         "type": "Transitive",
         "resolved": "7.0.5",
@@ -3146,25 +3138,25 @@
           "AspNetCore.HealthChecks.SqlServer": "[6.0.2, )",
           "AspNetCore.HealthChecks.Uris": "[6.0.3, )",
           "Azure.Messaging.EventGrid": "[4.10.0, )",
-          "Commercial.Core": "[2023.9.0, )",
-          "Commercial.Infrastructure.EntityFramework": "[2023.9.0, )",
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )",
+          "Commercial.Core": "[2023.10.1, )",
+          "Commercial.Infrastructure.EntityFramework": "[2023.10.1, )",
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )",
           "Swashbuckle.AspNetCore": "[6.5.0, )"
         }
       },
       "commercial.core": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )"
+          "Core": "[2023.10.1, )"
         }
       },
       "commercial.infrastructure.entityframework": {
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       },
       "common": {
@@ -3172,7 +3164,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -3224,15 +3216,15 @@
       "identity": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )",
           "Swashbuckle.AspNetCore.SwaggerGen": "[6.5.0, )"
         }
       },
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -3240,7 +3232,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -3252,19 +3244,18 @@
       "integrationtestcommon": {
         "type": "Project",
         "dependencies": {
-          "Common": "[2023.9.0, )",
-          "Identity": "[2023.9.0, )",
+          "Common": "[2023.10.1, )",
+          "Identity": "[2023.10.1, )",
           "Microsoft.AspNetCore.Mvc.Testing": "[6.0.5, )",
-          "Microsoft.EntityFrameworkCore.InMemory": "[7.0.5, )",
           "Microsoft.Extensions.Configuration": "[6.0.1, )"
         }
       },
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/test/Api.Test/Controllers/OrganizationConnectionsControllerTests.cs b/test/Api.Test/AdminConsole/Controllers/OrganizationConnectionsControllerTests.cs
similarity index 98%
rename from test/Api.Test/Controllers/OrganizationConnectionsControllerTests.cs
rename to test/Api.Test/AdminConsole/Controllers/OrganizationConnectionsControllerTests.cs
index bbeb50b18223..dff61aa2b456 100644
--- a/test/Api.Test/Controllers/OrganizationConnectionsControllerTests.cs
+++ b/test/Api.Test/AdminConsole/Controllers/OrganizationConnectionsControllerTests.cs
@@ -1,15 +1,15 @@
 using System.Text.Json;
-using Bit.Api.Controllers;
-using Bit.Api.Models.Request.Organizations;
-using Bit.Api.Models.Response.Organizations;
+using Bit.Api.AdminConsole.Controllers;
+using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Api.AdminConsole.Models.Response.Organizations;
 using Bit.Core.AdminConsole.Models.OrganizationConnectionConfigs;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.OrganizationConnectionConfigs;
-using Bit.Core.OrganizationFeatures.OrganizationConnections.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
@@ -19,7 +19,7 @@
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Api.Test.Controllers;
+namespace Bit.Api.Test.AdminConsole.Controllers;
 
 [ControllerCustomize(typeof(OrganizationConnectionsController))]
 [SutProviderCustomize]
diff --git a/test/Api.Test/Controllers/OrganizationDomainControllerTests.cs b/test/Api.Test/AdminConsole/Controllers/OrganizationDomainControllerTests.cs
similarity index 97%
rename from test/Api.Test/Controllers/OrganizationDomainControllerTests.cs
rename to test/Api.Test/AdminConsole/Controllers/OrganizationDomainControllerTests.cs
index 019dbdcba0bb..90a977157b47 100644
--- a/test/Api.Test/Controllers/OrganizationDomainControllerTests.cs
+++ b/test/Api.Test/AdminConsole/Controllers/OrganizationDomainControllerTests.cs
@@ -1,13 +1,13 @@
-using Bit.Api.Controllers;
-using Bit.Api.Models.Request;
-using Bit.Api.Models.Request.Organizations;
+using Bit.Api.AdminConsole.Controllers;
+using Bit.Api.AdminConsole.Models.Request;
+using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Api.AdminConsole.Models.Response.Organizations;
 using Bit.Api.Models.Response;
-using Bit.Api.Models.Response.Organizations;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Data.Organizations;
-using Bit.Core.OrganizationFeatures.OrganizationDomains.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
@@ -15,7 +15,7 @@
 using NSubstitute.ReturnsExtensions;
 using Xunit;
 
-namespace Bit.Api.Test.Controllers;
+namespace Bit.Api.Test.AdminConsole.Controllers;
 
 [ControllerCustomize(typeof(OrganizationDomainController))]
 [SutProviderCustomize]
diff --git a/test/Api.Test/AdminConsole/Controllers/OrganizationUsersControllerTests.cs b/test/Api.Test/AdminConsole/Controllers/OrganizationUsersControllerTests.cs
index 4b5c633cbeed..b62027919c47 100644
--- a/test/Api.Test/AdminConsole/Controllers/OrganizationUsersControllerTests.cs
+++ b/test/Api.Test/AdminConsole/Controllers/OrganizationUsersControllerTests.cs
@@ -2,6 +2,7 @@
 using Bit.Api.AdminConsole.Models.Request.Organizations;
 using Bit.Core.Entities;
 using Bit.Core.Models.Data.Organizations.Policies;
+using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
@@ -27,7 +28,7 @@ public async Task PutResetPasswordEnrollment_InivitedUser_AcceptsInvite(Guid org
 
         await sutProvider.Sut.PutResetPasswordEnrollment(orgId, userId, model);
 
-        await sutProvider.GetDependency<IOrganizationService>().Received(1).AcceptUserAsync(orgId, user, sutProvider.GetDependency<IUserService>());
+        await sutProvider.GetDependency<IAcceptOrgUserCommand>().Received(1).AcceptOrgUserByOrgIdAsync(orgId, user, sutProvider.GetDependency<IUserService>());
     }
 
     [Theory]
@@ -41,7 +42,7 @@ public async Task PutResetPasswordEnrollment_ConfirmedUser_AcceptsInvite(Guid or
 
         await sutProvider.Sut.PutResetPasswordEnrollment(orgId, userId, model);
 
-        await sutProvider.GetDependency<IOrganizationService>().Received(0).AcceptUserAsync(orgId, user, sutProvider.GetDependency<IUserService>());
+        await sutProvider.GetDependency<IAcceptOrgUserCommand>().Received(0).AcceptOrgUserByOrgIdAsync(orgId, user, sutProvider.GetDependency<IUserService>());
     }
 
     [Theory]
@@ -63,8 +64,8 @@ public async Task Accept_NoMasterPasswordReset(Guid orgId, Guid orgUserId,
 
         await sutProvider.Sut.Accept(orgId, orgUserId, model);
 
-        await sutProvider.GetDependency<IOrganizationService>().Received(1)
-            .AcceptUserAsync(orgUserId, user, model.Token, sutProvider.GetDependency<IUserService>());
+        await sutProvider.GetDependency<IAcceptOrgUserCommand>().Received(1)
+            .AcceptOrgUserByEmailTokenAsync(orgUserId, user, model.Token, sutProvider.GetDependency<IUserService>());
         await sutProvider.GetDependency<IOrganizationService>().DidNotReceiveWithAnyArgs()
             .UpdateUserResetPasswordEnrollmentAsync(default, default, default, default);
     }
@@ -85,8 +86,8 @@ public async Task Accept_RequireMasterPasswordReset(Guid orgId, Guid orgUserId,
 
         await sutProvider.Sut.Accept(orgId, orgUserId, model);
 
-        await sutProvider.GetDependency<IOrganizationService>().Received(1)
-            .AcceptUserAsync(orgUserId, user, model.Token, sutProvider.GetDependency<IUserService>());
+        await sutProvider.GetDependency<IAcceptOrgUserCommand>().Received(1)
+            .AcceptOrgUserByEmailTokenAsync(orgUserId, user, model.Token, sutProvider.GetDependency<IUserService>());
         await sutProvider.GetDependency<IOrganizationService>().Received(1)
             .UpdateUserResetPasswordEnrollmentAsync(orgId, user.Id, model.ResetPasswordKey, user.Id);
     }
diff --git a/test/Api.Test/AdminConsole/Controllers/OrganizationsControllerTests.cs b/test/Api.Test/AdminConsole/Controllers/OrganizationsControllerTests.cs
index 2568ba518a89..7a3f4437cab4 100644
--- a/test/Api.Test/AdminConsole/Controllers/OrganizationsControllerTests.cs
+++ b/test/Api.Test/AdminConsole/Controllers/OrganizationsControllerTests.cs
@@ -1,6 +1,10 @@
 using System.Security.Claims;
 using AutoFixture.Xunit2;
 using Bit.Api.AdminConsole.Controllers;
+using Bit.Api.AdminConsole.Models.Request.Organizations;
+using Bit.Api.Models.Request.Organizations;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models.Data;
@@ -8,14 +12,17 @@
 using Bit.Core.Auth.Services;
 using Bit.Core.Context;
 using Bit.Core.Entities;
+using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys.Interfaces;
+using Bit.Core.Models.Business;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.OrganizationFeatures.OrganizationLicenses.Interfaces;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
 using NSubstitute;
+using NSubstitute.ReturnsExtensions;
 using Xunit;
 
 namespace Bit.Api.Test.AdminConsole.Controllers;
@@ -144,4 +151,194 @@ public async Task OrganizationsController_UserCanLeaveOrganizationThatDoesntProv
         await _organizationService.DeleteUserAsync(orgId, user.Id);
         await _organizationService.Received(1).DeleteUserAsync(orgId, user.Id);
     }
+
+    [Theory, AutoData]
+    public async Task OrganizationsController_PostUpgrade_UserCannotEditSubscription_ThrowsNotFoundException(
+        Guid organizationId,
+        OrganizationUpgradeRequestModel model)
+    {
+        _currentContext.EditSubscription(organizationId).Returns(false);
+
+        await Assert.ThrowsAsync<NotFoundException>(() => _sut.PostUpgrade(organizationId.ToString(), model));
+    }
+
+    [Theory, AutoData]
+    public async Task OrganizationsController_PostUpgrade_NonSMUpgrade_ReturnsCorrectResponse(
+        Guid organizationId,
+        OrganizationUpgradeRequestModel model,
+        bool success,
+        string paymentIntentClientSecret)
+    {
+        model.UseSecretsManager = false;
+
+        _currentContext.EditSubscription(organizationId).Returns(true);
+
+        _upgradeOrganizationPlanCommand.UpgradePlanAsync(organizationId, Arg.Any<OrganizationUpgrade>())
+            .Returns(new Tuple<bool, string>(success, paymentIntentClientSecret));
+
+        var response = await _sut.PostUpgrade(organizationId.ToString(), model);
+
+        Assert.Equal(success, response.Success);
+        Assert.Equal(paymentIntentClientSecret, response.PaymentIntentClientSecret);
+    }
+
+    [Theory, AutoData]
+    public async Task OrganizationsController_PostUpgrade_SMUpgrade_ProvidesAccess_ReturnsCorrectResponse(
+        Guid organizationId,
+        Guid userId,
+        OrganizationUpgradeRequestModel model,
+        bool success,
+        string paymentIntentClientSecret,
+        OrganizationUser organizationUser)
+    {
+        model.UseSecretsManager = true;
+        organizationUser.AccessSecretsManager = false;
+
+        _currentContext.EditSubscription(organizationId).Returns(true);
+
+        _upgradeOrganizationPlanCommand.UpgradePlanAsync(organizationId, Arg.Any<OrganizationUpgrade>())
+            .Returns(new Tuple<bool, string>(success, paymentIntentClientSecret));
+
+        _userService.GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(userId);
+
+        _organizationUserRepository.GetByOrganizationAsync(organizationId, userId).Returns(organizationUser);
+
+        var response = await _sut.PostUpgrade(organizationId.ToString(), model);
+
+        Assert.Equal(success, response.Success);
+        Assert.Equal(paymentIntentClientSecret, response.PaymentIntentClientSecret);
+
+        await _organizationUserRepository.Received(1).ReplaceAsync(Arg.Is<OrganizationUser>(orgUser =>
+            orgUser.Id == organizationUser.Id && orgUser.AccessSecretsManager == true));
+    }
+
+    [Theory, AutoData]
+    public async Task OrganizationsController_PostUpgrade_SMUpgrade_NullOrgUser_ReturnsCorrectResponse(
+        Guid organizationId,
+        Guid userId,
+        OrganizationUpgradeRequestModel model,
+        bool success,
+        string paymentIntentClientSecret)
+    {
+        model.UseSecretsManager = true;
+
+        _currentContext.EditSubscription(organizationId).Returns(true);
+
+        _upgradeOrganizationPlanCommand.UpgradePlanAsync(organizationId, Arg.Any<OrganizationUpgrade>())
+            .Returns(new Tuple<bool, string>(success, paymentIntentClientSecret));
+
+        _userService.GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(userId);
+
+        _organizationUserRepository.GetByOrganizationAsync(organizationId, userId).ReturnsNull();
+
+        var response = await _sut.PostUpgrade(organizationId.ToString(), model);
+
+        Assert.Equal(success, response.Success);
+        Assert.Equal(paymentIntentClientSecret, response.PaymentIntentClientSecret);
+
+        await _organizationUserRepository.DidNotReceiveWithAnyArgs().ReplaceAsync(Arg.Any<OrganizationUser>());
+    }
+
+    [Theory, AutoData]
+    public async Task OrganizationsController_PostSubscribeSecretsManagerAsync_NullOrg_ThrowsNotFoundException(
+        Guid organizationId,
+        SecretsManagerSubscribeRequestModel model)
+    {
+        _organizationRepository.GetByIdAsync(organizationId).ReturnsNull();
+
+        await Assert.ThrowsAsync<NotFoundException>(() => _sut.PostSubscribeSecretsManagerAsync(organizationId, model));
+    }
+
+    [Theory, AutoData]
+    public async Task OrganizationsController_PostSubscribeSecretsManagerAsync_UserCannotEditSubscription_ThrowsNotFoundException(
+        Guid organizationId,
+        SecretsManagerSubscribeRequestModel model,
+        Organization organization)
+    {
+        _organizationRepository.GetByIdAsync(organizationId).Returns(organization);
+
+        _currentContext.EditSubscription(organizationId).Returns(false);
+
+        await Assert.ThrowsAsync<NotFoundException>(() => _sut.PostSubscribeSecretsManagerAsync(organizationId, model));
+    }
+
+    [Theory, AutoData]
+    public async Task OrganizationsController_PostSubscribeSecretsManagerAsync_ProvidesAccess_ReturnsCorrectResponse(
+        Guid organizationId,
+        SecretsManagerSubscribeRequestModel model,
+        Organization organization,
+        Guid userId,
+        OrganizationUser organizationUser,
+        OrganizationUserOrganizationDetails organizationUserOrganizationDetails)
+    {
+        organizationUser.AccessSecretsManager = false;
+
+        var ssoConfigurationData = new SsoConfigurationData
+        {
+            MemberDecryptionType = MemberDecryptionType.KeyConnector,
+            KeyConnectorUrl = "https://example.com"
+        };
+
+        organizationUserOrganizationDetails.Permissions = string.Empty;
+        organizationUserOrganizationDetails.SsoConfig = ssoConfigurationData.Serialize();
+
+        _organizationRepository.GetByIdAsync(organizationId).Returns(organization);
+
+        _currentContext.EditSubscription(organizationId).Returns(true);
+
+        _userService.GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(userId);
+
+        _organizationUserRepository.GetByOrganizationAsync(organization.Id, userId).Returns(organizationUser);
+
+        _organizationUserRepository.GetDetailsByUserAsync(userId, organization.Id, OrganizationUserStatusType.Confirmed)
+            .Returns(organizationUserOrganizationDetails);
+
+        var response = await _sut.PostSubscribeSecretsManagerAsync(organizationId, model);
+
+        Assert.Equal(response.Id, organizationUserOrganizationDetails.OrganizationId);
+        Assert.Equal(response.Name, organizationUserOrganizationDetails.Name);
+
+        await _addSecretsManagerSubscriptionCommand.Received(1)
+            .SignUpAsync(organization, model.AdditionalSmSeats, model.AdditionalServiceAccounts);
+        await _organizationUserRepository.Received(1).ReplaceAsync(Arg.Is<OrganizationUser>(orgUser =>
+            orgUser.Id == organizationUser.Id && orgUser.AccessSecretsManager == true));
+    }
+
+    [Theory, AutoData]
+    public async Task OrganizationsController_PostSubscribeSecretsManagerAsync_NullOrgUser_ReturnsCorrectResponse(
+        Guid organizationId,
+        SecretsManagerSubscribeRequestModel model,
+        Organization organization,
+        Guid userId,
+        OrganizationUserOrganizationDetails organizationUserOrganizationDetails)
+    {
+        var ssoConfigurationData = new SsoConfigurationData
+        {
+            MemberDecryptionType = MemberDecryptionType.KeyConnector,
+            KeyConnectorUrl = "https://example.com"
+        };
+
+        organizationUserOrganizationDetails.Permissions = string.Empty;
+        organizationUserOrganizationDetails.SsoConfig = ssoConfigurationData.Serialize();
+
+        _organizationRepository.GetByIdAsync(organizationId).Returns(organization);
+
+        _currentContext.EditSubscription(organizationId).Returns(true);
+
+        _userService.GetProperUserId(Arg.Any<ClaimsPrincipal>()).Returns(userId);
+
+        _organizationUserRepository.GetByOrganizationAsync(organization.Id, userId).ReturnsNull();
+
+        _organizationUserRepository.GetDetailsByUserAsync(userId, organization.Id, OrganizationUserStatusType.Confirmed)
+            .Returns(organizationUserOrganizationDetails);
+
+        var response = await _sut.PostSubscribeSecretsManagerAsync(organizationId, model);
+
+        Assert.Equal(response.Id, organizationUserOrganizationDetails.OrganizationId);
+        Assert.Equal(response.Name, organizationUserOrganizationDetails.Name);
+
+        await _addSecretsManagerSubscriptionCommand.Received(1)
+            .SignUpAsync(organization, model.AdditionalSmSeats, model.AdditionalServiceAccounts);
+        await _organizationUserRepository.DidNotReceiveWithAnyArgs().ReplaceAsync(Arg.Any<OrganizationUser>());
+    }
 }
diff --git a/test/Api.Test/Api.Test.csproj b/test/Api.Test/Api.Test.csproj
index b5f6a311c081..d6b31ce9308a 100644
--- a/test/Api.Test/Api.Test.csproj
+++ b/test/Api.Test/Api.Test.csproj
@@ -26,4 +26,8 @@
     <ProjectReference Include="..\Core.Test\Core.Test.csproj" />
   </ItemGroup>
 
+  <ItemGroup>
+    <Folder Include="Auth\" />
+    <Folder Include="Auth\Controllers\" />
+  </ItemGroup>
 </Project>
diff --git a/test/Api.Test/Auth/Controllers/WebAuthnControllerTests.cs b/test/Api.Test/Auth/Controllers/WebAuthnControllerTests.cs
new file mode 100644
index 000000000000..dd5ffb15fb4a
--- /dev/null
+++ b/test/Api.Test/Auth/Controllers/WebAuthnControllerTests.cs
@@ -0,0 +1,185 @@
+using Bit.Api.Auth.Controllers;
+using Bit.Api.Auth.Models.Request.Accounts;
+using Bit.Api.Auth.Models.Request.Webauthn;
+using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.Services;
+using Bit.Core.Tokens;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Fido2NetLib;
+using NSubstitute;
+using NSubstitute.ReturnsExtensions;
+using Xunit;
+
+namespace Bit.Api.Test.Auth.Controllers;
+
+[ControllerCustomize(typeof(WebAuthnController))]
+[SutProviderCustomize]
+public class WebAuthnControllerTests
+{
+    [Theory, BitAutoData]
+    public async Task Get_UserNotFound_ThrowsUnauthorizedAccessException(SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsNullForAnyArgs();
+
+        // Act
+        var result = () => sutProvider.Sut.Get();
+
+        // Assert
+        await Assert.ThrowsAsync<UnauthorizedAccessException>(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task PostOptions_UserNotFound_ThrowsUnauthorizedAccessException(SecretVerificationRequestModel requestModel, SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsNullForAnyArgs();
+
+        // Act
+        var result = () => sutProvider.Sut.PostOptions(requestModel);
+
+        // Assert
+        await Assert.ThrowsAsync<UnauthorizedAccessException>(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task PostOptions_UserVerificationFailed_ThrowsBadRequestException(SecretVerificationRequestModel requestModel, User user, SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsForAnyArgs(user);
+        sutProvider.GetDependency<IUserService>().VerifySecretAsync(user, default).Returns(false);
+
+        // Act
+        var result = () => sutProvider.Sut.PostOptions(requestModel);
+
+        // Assert
+        await Assert.ThrowsAsync<BadRequestException>(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task PostOptions_RequireSsoPolicyApplicable_ThrowsBadRequestException(
+        SecretVerificationRequestModel requestModel, User user, SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsForAnyArgs(user);
+        sutProvider.GetDependency<IUserService>().VerifySecretAsync(user, default).ReturnsForAnyArgs(true);
+        sutProvider.GetDependency<IPolicyService>().AnyPoliciesApplicableToUserAsync(user.Id, PolicyType.RequireSso).ReturnsForAnyArgs(true);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.PostOptions(requestModel));
+        Assert.Contains("Passkeys cannot be created for your account. SSO login is required", exception.Message);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Post_UserNotFound_ThrowsUnauthorizedAccessException(WebAuthnCredentialRequestModel requestModel, SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsNullForAnyArgs();
+
+        // Act
+        var result = () => sutProvider.Sut.Post(requestModel);
+
+        // Assert
+        await Assert.ThrowsAsync<UnauthorizedAccessException>(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Post_ExpiredToken_ThrowsBadRequestException(WebAuthnCredentialRequestModel requestModel, CredentialCreateOptions createOptions, User user, SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        var token = new WebAuthnCredentialCreateOptionsTokenable(user, createOptions);
+        sutProvider.GetDependency<IUserService>()
+            .GetUserByPrincipalAsync(default)
+            .ReturnsForAnyArgs(user);
+        sutProvider.GetDependency<IDataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable>>()
+            .Unprotect(requestModel.Token)
+            .Returns(token);
+
+        // Act
+        var result = () => sutProvider.Sut.Post(requestModel);
+
+        // Assert
+        await Assert.ThrowsAsync<BadRequestException>(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Post_ValidInput_Returns(WebAuthnCredentialRequestModel requestModel, CredentialCreateOptions createOptions, User user, SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        var token = new WebAuthnCredentialCreateOptionsTokenable(user, createOptions);
+        sutProvider.GetDependency<IUserService>()
+            .GetUserByPrincipalAsync(default)
+            .ReturnsForAnyArgs(user);
+        sutProvider.GetDependency<IUserService>()
+            .CompleteWebAuthLoginRegistrationAsync(user, requestModel.Name, createOptions, Arg.Any<AuthenticatorAttestationRawResponse>())
+            .Returns(true);
+        sutProvider.GetDependency<IDataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable>>()
+            .Unprotect(requestModel.Token)
+            .Returns(token);
+
+        // Act
+        await sutProvider.Sut.Post(requestModel);
+
+        // Assert
+        // Nothing to assert since return is void
+    }
+
+    [Theory, BitAutoData]
+    public async Task Post_RequireSsoPolicyApplicable_ThrowsBadRequestException(
+        WebAuthnCredentialRequestModel requestModel,
+        CredentialCreateOptions createOptions,
+        User user,
+        SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        var token = new WebAuthnCredentialCreateOptionsTokenable(user, createOptions);
+        sutProvider.GetDependency<IUserService>()
+            .GetUserByPrincipalAsync(default)
+            .ReturnsForAnyArgs(user);
+        sutProvider.GetDependency<IUserService>()
+            .CompleteWebAuthLoginRegistrationAsync(user, requestModel.Name, createOptions, Arg.Any<AuthenticatorAttestationRawResponse>())
+            .Returns(true);
+        sutProvider.GetDependency<IDataProtectorTokenFactory<WebAuthnCredentialCreateOptionsTokenable>>()
+            .Unprotect(requestModel.Token)
+            .Returns(token);
+        sutProvider.GetDependency<IPolicyService>().AnyPoliciesApplicableToUserAsync(user.Id, PolicyType.RequireSso).ReturnsForAnyArgs(true);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.Post(requestModel));
+        Assert.Contains("Passkeys cannot be created for your account. SSO login is required", exception.Message);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Delete_UserNotFound_ThrowsUnauthorizedAccessException(Guid credentialId, SecretVerificationRequestModel requestModel, SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsNullForAnyArgs();
+
+        // Act
+        var result = () => sutProvider.Sut.Delete(credentialId, requestModel);
+
+        // Assert
+        await Assert.ThrowsAsync<UnauthorizedAccessException>(result);
+    }
+
+    [Theory, BitAutoData]
+    public async Task Delete_UserVerificationFailed_ThrowsBadRequestException(Guid credentialId, SecretVerificationRequestModel requestModel, User user, SutProvider<WebAuthnController> sutProvider)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>().GetUserByPrincipalAsync(default).ReturnsForAnyArgs(user);
+        sutProvider.GetDependency<IUserService>().VerifySecretAsync(user, default).Returns(false);
+
+        // Act
+        var result = () => sutProvider.Sut.Delete(credentialId, requestModel);
+
+        // Assert
+        await Assert.ThrowsAsync<BadRequestException>(result);
+    }
+}
+
diff --git a/test/Api.Test/Controllers/AccountsControllerTests.cs b/test/Api.Test/Controllers/AccountsControllerTests.cs
index 0dff6db93d7a..491f5a9f4973 100644
--- a/test/Api.Test/Controllers/AccountsControllerTests.cs
+++ b/test/Api.Test/Controllers/AccountsControllerTests.cs
@@ -1,8 +1,10 @@
 using System.Security.Claims;
 using Bit.Api.Auth.Models.Request.Accounts;
 using Bit.Api.Controllers;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Auth.Models.Api.Request.Accounts;
 using Bit.Core.Auth.Services;
+using Bit.Core.Auth.UserFeatures.UserMasterPassword.Interfaces;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
@@ -13,6 +15,7 @@
 using Bit.Core.Tools.Repositories;
 using Bit.Core.Tools.Services;
 using Bit.Core.Vault.Repositories;
+using Bit.Test.Common.AutoFixture.Attributes;
 using Microsoft.AspNetCore.Identity;
 using NSubstitute;
 using Xunit;
@@ -36,6 +39,7 @@ public class AccountsControllerTests : IDisposable
     private readonly IProviderUserRepository _providerUserRepository;
     private readonly ICaptchaValidationService _captchaValidationService;
     private readonly IPolicyService _policyService;
+    private readonly ISetInitialMasterPasswordCommand _setInitialMasterPasswordCommand;
 
     public AccountsControllerTests()
     {
@@ -52,6 +56,8 @@ public AccountsControllerTests()
         _sendService = Substitute.For<ISendService>();
         _captchaValidationService = Substitute.For<ICaptchaValidationService>();
         _policyService = Substitute.For<IPolicyService>();
+        _setInitialMasterPasswordCommand = Substitute.For<ISetInitialMasterPasswordCommand>();
+
         _sut = new AccountsController(
             _globalSettings,
             _cipherRepository,
@@ -65,7 +71,8 @@ public AccountsControllerTests()
             _sendRepository,
             _sendService,
             _captchaValidationService,
-            _policyService
+            _policyService,
+            _setInitialMasterPasswordCommand
         );
     }
 
@@ -380,6 +387,124 @@ await Assert.ThrowsAsync<BadRequestException>(
         );
     }
 
+
+    [Theory]
+    [BitAutoData(true, false)]  // User has PublicKey and PrivateKey, and Keys in request are NOT null
+    [BitAutoData(true, true)]   // User has PublicKey and PrivateKey, and Keys in request are null
+    [BitAutoData(false, false)] // User has neither PublicKey nor PrivateKey, and Keys in request are NOT null
+    [BitAutoData(false, true)]  // User has neither PublicKey nor PrivateKey, and Keys in request are null
+    public async Task PostSetPasswordAsync_WhenUserExistsAndSettingPasswordSucceeds_ShouldHandleKeysCorrectlyAndReturn(
+    bool hasExistingKeys,
+    bool shouldSetKeysToNull,
+    User user,
+    SetPasswordRequestModel setPasswordRequestModel)
+    {
+        // Arrange
+        const string existingPublicKey = "existingPublicKey";
+        const string existingEncryptedPrivateKey = "existingEncryptedPrivateKey";
+
+        const string newPublicKey = "newPublicKey";
+        const string newEncryptedPrivateKey = "newEncryptedPrivateKey";
+
+        if (hasExistingKeys)
+        {
+            user.PublicKey = existingPublicKey;
+            user.PrivateKey = existingEncryptedPrivateKey;
+        }
+        else
+        {
+            user.PublicKey = null;
+            user.PrivateKey = null;
+        }
+
+        if (shouldSetKeysToNull)
+        {
+            setPasswordRequestModel.Keys = null;
+        }
+        else
+        {
+            setPasswordRequestModel.Keys = new KeysRequestModel()
+            {
+                PublicKey = newPublicKey,
+                EncryptedPrivateKey = newEncryptedPrivateKey
+            };
+        }
+
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(Task.FromResult(user));
+        _setInitialMasterPasswordCommand.SetInitialMasterPasswordAsync(
+                user,
+                setPasswordRequestModel.MasterPasswordHash,
+                setPasswordRequestModel.Key,
+                setPasswordRequestModel.OrgIdentifier)
+            .Returns(Task.FromResult(IdentityResult.Success));
+
+        // Act
+        await _sut.PostSetPasswordAsync(setPasswordRequestModel);
+
+        // Assert
+        await _setInitialMasterPasswordCommand.Received(1)
+            .SetInitialMasterPasswordAsync(
+                Arg.Is<User>(u => u == user),
+                Arg.Is<string>(s => s == setPasswordRequestModel.MasterPasswordHash),
+                Arg.Is<string>(s => s == setPasswordRequestModel.Key),
+                Arg.Is<string>(s => s == setPasswordRequestModel.OrgIdentifier));
+
+        // Additional Assertions for User object modifications
+        Assert.Equal(setPasswordRequestModel.MasterPasswordHint, user.MasterPasswordHint);
+        Assert.Equal(setPasswordRequestModel.Kdf, user.Kdf);
+        Assert.Equal(setPasswordRequestModel.KdfIterations, user.KdfIterations);
+        Assert.Equal(setPasswordRequestModel.KdfMemory, user.KdfMemory);
+        Assert.Equal(setPasswordRequestModel.KdfParallelism, user.KdfParallelism);
+        Assert.Equal(setPasswordRequestModel.Key, user.Key);
+
+        if (hasExistingKeys)
+        {
+            // User Keys should not be modified
+            Assert.Equal(existingPublicKey, user.PublicKey);
+            Assert.Equal(existingEncryptedPrivateKey, user.PrivateKey);
+        }
+        else if (!shouldSetKeysToNull)
+        {
+            // User had no keys so they should be set to the request model's keys
+            Assert.Equal(setPasswordRequestModel.Keys.PublicKey, user.PublicKey);
+            Assert.Equal(setPasswordRequestModel.Keys.EncryptedPrivateKey, user.PrivateKey);
+        }
+        else
+        {
+            // User had no keys and the request model's keys were null, so they should be set to null
+            Assert.Null(user.PublicKey);
+            Assert.Null(user.PrivateKey);
+        }
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task PostSetPasswordAsync_WhenUserDoesNotExist_ShouldThrowUnauthorizedAccessException(
+        SetPasswordRequestModel setPasswordRequestModel)
+    {
+        // Arrange
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(Task.FromResult((User)null));
+
+        // Act & Assert
+        await Assert.ThrowsAsync<UnauthorizedAccessException>(() => _sut.PostSetPasswordAsync(setPasswordRequestModel));
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task PostSetPasswordAsync_WhenSettingPasswordFails_ShouldThrowBadRequestException(
+        User user,
+        SetPasswordRequestModel model)
+    {
+        // Arrange
+        _userService.GetUserByPrincipalAsync(Arg.Any<ClaimsPrincipal>()).Returns(Task.FromResult(user));
+        _setInitialMasterPasswordCommand.SetInitialMasterPasswordAsync(Arg.Any<User>(), Arg.Any<string>(), Arg.Any<string>(), Arg.Any<string>())
+            .Returns(Task.FromResult(IdentityResult.Failed(new IdentityError { Description = "Some Error" })));
+
+        // Act & Assert
+        await Assert.ThrowsAsync<BadRequestException>(() => _sut.PostSetPasswordAsync(model));
+    }
+
+
     // Below are helper functions that currently belong to this
     // test class, but ultimately may need to be split out into
     // something greater in order to share common test steps with
diff --git a/test/Api.Test/Controllers/PoliciesControllerTests.cs b/test/Api.Test/Controllers/PoliciesControllerTests.cs
new file mode 100644
index 000000000000..0d2f004b1722
--- /dev/null
+++ b/test/Api.Test/Controllers/PoliciesControllerTests.cs
@@ -0,0 +1,133 @@
+using System.Security.Claims;
+using System.Text.Json;
+using Bit.Api.AdminConsole.Controllers;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.Models.Data.Organizations.Policies;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Api.Test.Controllers;
+
+
+// Note: test names follow MethodName_StateUnderTest_ExpectedBehavior pattern.
+[ControllerCustomize(typeof(PoliciesController))]
+[SutProviderCustomize]
+public class PoliciesControllerTests
+{
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetMasterPasswordPolicy_WhenCalled_ReturnsMasterPasswordPolicy(
+        SutProvider<PoliciesController> sutProvider, Guid orgId, Guid userId, OrganizationUser orgUser,
+        Policy policy, MasterPasswordPolicyData mpPolicyData)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns((Guid?)userId);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(orgId, userId)
+            .Returns(orgUser);
+
+
+        policy.Type = PolicyType.MasterPassword;
+        policy.Enabled = true;
+        // data should be a JSON serialized version of the mpPolicyData object
+        policy.Data = JsonSerializer.Serialize(mpPolicyData);
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(orgId, PolicyType.MasterPassword)
+            .Returns(policy);
+
+        // Act
+        var result = await sutProvider.Sut.GetMasterPasswordPolicy(orgId);
+
+        // Assert
+
+        Assert.NotNull(result);
+        Assert.Equal(policy.Id, result.Id);
+        Assert.Equal(policy.Type, result.Type);
+        Assert.Equal(policy.Enabled, result.Enabled);
+
+        // Assert that the data is deserialized correctly into a Dictionary<string, object>
+        // for all MasterPasswordPolicyData properties
+        Assert.Equal(mpPolicyData.MinComplexity, ((JsonElement)result.Data["MinComplexity"]).GetInt32());
+        Assert.Equal(mpPolicyData.MinLength, ((JsonElement)result.Data["MinLength"]).GetInt32());
+        Assert.Equal(mpPolicyData.RequireLower, ((JsonElement)result.Data["RequireLower"]).GetBoolean());
+        Assert.Equal(mpPolicyData.RequireUpper, ((JsonElement)result.Data["RequireUpper"]).GetBoolean());
+        Assert.Equal(mpPolicyData.RequireNumbers, ((JsonElement)result.Data["RequireNumbers"]).GetBoolean());
+        Assert.Equal(mpPolicyData.RequireSpecial, ((JsonElement)result.Data["RequireSpecial"]).GetBoolean());
+        Assert.Equal(mpPolicyData.EnforceOnLogin, ((JsonElement)result.Data["EnforceOnLogin"]).GetBoolean());
+    }
+
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetMasterPasswordPolicy_OrgUserIsNull_ThrowsNotFoundException(
+        SutProvider<PoliciesController> sutProvider, Guid orgId, Guid userId)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns((Guid?)userId);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(orgId, userId)
+            .Returns((OrganizationUser)null);
+
+        // Act & Assert
+        await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.GetMasterPasswordPolicy(orgId));
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetMasterPasswordPolicy_PolicyIsNull_ThrowsNotFoundException(
+        SutProvider<PoliciesController> sutProvider, Guid orgId, Guid userId, OrganizationUser orgUser)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns((Guid?)userId);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(orgId, userId)
+            .Returns(orgUser);
+
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(orgId, PolicyType.MasterPassword)
+            .Returns((Policy)null);
+
+        // Act & Assert
+        await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.GetMasterPasswordPolicy(orgId));
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task GetMasterPasswordPolicy_PolicyNotEnabled_ThrowsNotFoundException(
+        SutProvider<PoliciesController> sutProvider, Guid orgId, Guid userId, OrganizationUser orgUser, Policy policy)
+    {
+        // Arrange
+        sutProvider.GetDependency<IUserService>()
+            .GetProperUserId(Arg.Any<ClaimsPrincipal>())
+            .Returns((Guid?)userId);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(orgId, userId)
+            .Returns(orgUser);
+
+        policy.Enabled = false; // Ensuring the policy is not enabled
+        sutProvider.GetDependency<IPolicyRepository>()
+            .GetByOrganizationIdTypeAsync(orgId, PolicyType.MasterPassword)
+            .Returns(policy);
+
+        // Act & Assert
+        await Assert.ThrowsAsync<NotFoundException>(() => sutProvider.Sut.GetMasterPasswordPolicy(orgId));
+    }
+}
diff --git a/test/Api.Test/Vault/Controllers/SyncControllerTests.cs b/test/Api.Test/Vault/Controllers/SyncControllerTests.cs
index 0034120b19b1..e1a9c1562978 100644
--- a/test/Api.Test/Vault/Controllers/SyncControllerTests.cs
+++ b/test/Api.Test/Vault/Controllers/SyncControllerTests.cs
@@ -3,9 +3,11 @@
 using AutoFixture;
 using Bit.Api.Vault.Controllers;
 using Bit.Api.Vault.Models.Response;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
diff --git a/test/Api.Test/packages.lock.json b/test/Api.Test/packages.lock.json
index f778ea613b98..a7b619701656 100644
--- a/test/Api.Test/packages.lock.json
+++ b/test/Api.Test/packages.lock.json
@@ -3015,25 +3015,25 @@
           "AspNetCore.HealthChecks.SqlServer": "[6.0.2, )",
           "AspNetCore.HealthChecks.Uris": "[6.0.3, )",
           "Azure.Messaging.EventGrid": "[4.10.0, )",
-          "Commercial.Core": "[2023.9.0, )",
-          "Commercial.Infrastructure.EntityFramework": "[2023.9.0, )",
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )",
+          "Commercial.Core": "[2023.10.1, )",
+          "Commercial.Infrastructure.EntityFramework": "[2023.10.1, )",
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )",
           "Swashbuckle.AspNetCore": "[6.5.0, )"
         }
       },
       "commercial.core": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )"
+          "Core": "[2023.10.1, )"
         }
       },
       "commercial.infrastructure.entityframework": {
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       },
       "common": {
@@ -3041,7 +3041,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -3095,8 +3095,8 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Common": "[2023.9.0, )",
-          "Core": "[2023.9.0, )",
+          "Common": "[2023.10.1, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -3106,7 +3106,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -3114,7 +3114,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -3126,9 +3126,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/test/Billing.Test/packages.lock.json b/test/Billing.Test/packages.lock.json
index 32f0b9630119..9c99d0c5ca27 100644
--- a/test/Billing.Test/packages.lock.json
+++ b/test/Billing.Test/packages.lock.json
@@ -2842,8 +2842,8 @@
       "billing": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )"
         }
       },
       "common": {
@@ -2851,7 +2851,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -2903,7 +2903,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2911,7 +2911,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2923,9 +2923,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/test/Common/Fakes/FakeDataProtectorTokenFactory.cs b/test/Common/Fakes/FakeDataProtectorTokenFactory.cs
new file mode 100644
index 000000000000..fe3af320d69a
--- /dev/null
+++ b/test/Common/Fakes/FakeDataProtectorTokenFactory.cs
@@ -0,0 +1,55 @@
+using Bit.Core.Tokens;
+
+namespace Bit.Test.Common.Fakes;
+
+/// <summary>
+/// Used to fake the IDataProtectorTokenFactory for testing purposes.
+/// Generalized for use with all Tokenables.
+/// </summary>
+public class FakeDataProtectorTokenFactory<T> : IDataProtectorTokenFactory<T> where T : Tokenable, new()
+{
+    // Instead of real encryption, use a simple Dictionary to emulate protection/unprotection
+    private readonly Dictionary<string, T> _tokenDatabase = new Dictionary<string, T>();
+
+    public string Protect(T data)
+    {
+        // Generate a simple token representation
+        var token = Guid.NewGuid().ToString();
+
+        // Store the data against the token
+        _tokenDatabase[token] = data;
+
+        return token;
+    }
+
+    public T Unprotect(string token)
+    {
+        // If the token exists in the dictionary, return the corresponding data
+        if (_tokenDatabase.TryGetValue(token, out var data))
+        {
+            return data;
+        }
+
+        // If the token doesn't exist, throw an exception similar to a decryption failure.
+        throw new Exception("Failed to unprotect token.");
+    }
+
+    public bool TryUnprotect(string token, out T data)
+    {
+        try
+        {
+            data = Unprotect(token);
+            return true;
+        }
+        catch
+        {
+            data = default;
+            return false;
+        }
+    }
+
+    public bool TokenValid(string token)
+    {
+        return _tokenDatabase.ContainsKey(token);
+    }
+}
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommandTest.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommandTest.cs
similarity index 80%
rename from test/Core.Test/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommandTest.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommandTest.cs
index 6b7fb3151a35..9280b904909e 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommandTest.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/CreateOrganizationApiKeyCommandTest.cs
@@ -1,14 +1,13 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
-using NSubstitute.ReceivedExtensions;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationApiKeys;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
 
 [SutProviderCustomize]
 public class CreateOrganizationApiKeyCommandTest
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQueryTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQueryTests.cs
similarity index 94%
rename from test/Core.Test/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQueryTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQueryTests.cs
index d374bf806849..adaa2a42ba8e 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQueryTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/GetOrganizationApiKeyQueryTests.cs
@@ -1,13 +1,13 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationApiKeys;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
 
 [SutProviderCustomize]
 public class GetOrganizationApiKeyQueryTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommandTests.cs
similarity index 79%
rename from test/Core.Test/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommandTests.cs
index dc2ec10c2dbe..e801d89a61ad 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationApiKeys/RotateOrganizationApiKeyCommandTests.cs
@@ -1,11 +1,11 @@
-using Bit.Core.Entities;
-using Bit.Core.OrganizationFeatures.OrganizationApiKeys;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
+using Bit.Core.Entities;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using Bit.Test.Common.Helpers;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationApiKeys;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationApiKeys;
 
 [SutProviderCustomize]
 public class RotateOrganizationApiKeyCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommandTests.cs
similarity index 76%
rename from test/Core.Test/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommandTests.cs
index bfcb532d8c84..7081a222fc3d 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/CreateOrganizationConnectionCommandTests.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Models.Data.Organizations.OrganizationConnections;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
+using Bit.Core.Models.Data.Organizations.OrganizationConnections;
 using Bit.Core.Models.OrganizationConnectionConfigs;
-using Bit.Core.OrganizationFeatures.OrganizationConnections;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
@@ -8,7 +8,7 @@
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationConnections;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationConnections;
 
 [SutProviderCustomize]
 public class CreateOrganizationConnectionCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommandTests.cs
similarity index 76%
rename from test/Core.Test/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommandTests.cs
index 9432968f578e..db71971c6583 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/DeleteOrganizationConnectionCommandTests.cs
@@ -1,12 +1,12 @@
-using Bit.Core.Entities;
-using Bit.Core.OrganizationFeatures.OrganizationConnections;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
+using Bit.Core.Entities;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationConnections;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationConnections;
 
 [SutProviderCustomize]
 public class DeleteOrganizationConnectionCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommandTests.cs
similarity index 91%
rename from test/Core.Test/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommandTests.cs
index f46d799d166e..b0b146881c63 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/UpdateOrganizationConnectionCommandTests.cs
@@ -1,8 +1,8 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
+using Bit.Core.Entities;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Data.Organizations.OrganizationConnections;
 using Bit.Core.Models.OrganizationConnectionConfigs;
-using Bit.Core.OrganizationFeatures.OrganizationConnections;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
@@ -10,7 +10,7 @@
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationConnections;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationConnections;
 
 [SutProviderCustomize]
 public class UpdateOrganizationConnectionCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommandTests.cs
similarity index 91%
rename from test/Core.Test/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommandTests.cs
index 349f0316d784..e3be8ef200e3 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationConnections/ValidateBillingSyncKeyCommandTests.cs
@@ -1,14 +1,14 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationConnections;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationConnections;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationConnections;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationConnections;
 
 [SutProviderCustomize]
 public class ValidateBillingSyncKeyCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommandTests.cs
similarity index 97%
rename from test/Core.Test/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommandTests.cs
index 70773d38e690..a63aadd06c79 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/CreateOrganizationDomainCommandTests.cs
@@ -1,7 +1,7 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationDomains;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
@@ -11,7 +11,7 @@
 using NSubstitute.ReturnsExtensions;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 [SutProviderCustomize]
 public class CreateOrganizationDomainCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommandTests.cs
similarity index 84%
rename from test/Core.Test/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommandTests.cs
index 3a559d5c3d41..94c149c25280 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/DeleteOrganizationDomainCommandTests.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.OrganizationFeatures.OrganizationDomains;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
@@ -8,7 +8,7 @@
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 [SutProviderCustomize]
 public class DeleteOrganizationDomainCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQueryTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQueryTests.cs
similarity index 95%
rename from test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQueryTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQueryTests.cs
index 6480d8be0fad..ba12fde41ae7 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQueryTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByIdOrganizationIdQueryTests.cs
@@ -1,12 +1,12 @@
-using Bit.Core.Entities;
-using Bit.Core.OrganizationFeatures.OrganizationDomains;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
+using Bit.Core.Entities;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 [SutProviderCustomize]
 public class GetOrganizationDomainByIdOrganizationIdQueryTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQueryTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQueryTests.cs
similarity index 81%
rename from test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQueryTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQueryTests.cs
index d87667600487..527a530fedd1 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQueryTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/GetOrganizationDomainByOrganizationIdQueryTests.cs
@@ -1,11 +1,11 @@
-using Bit.Core.OrganizationFeatures.OrganizationDomains;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 [SutProviderCustomize]
 public class GetOrganizationDomainByOrganizationIdQueryTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommandTests.cs
similarity index 96%
rename from test/Core.Test/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommandTests.cs
index 07bc2b14e84f..416d86c5d251 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationDomains/VerifyOrganizationDomainCommandTests.cs
@@ -1,7 +1,7 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationDomains;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationDomains;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
@@ -9,7 +9,7 @@
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationDomains;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationDomains;
 
 [SutProviderCustomize]
 public class VerifyOrganizationDomainCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQueryTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQueryTests.cs
similarity index 95%
rename from test/Core.Test/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQueryTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQueryTests.cs
index 375fcc66a289..14615eb126e2 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQueryTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/CountNewSmSeatsRequiredQueryTests.cs
@@ -1,13 +1,13 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
+using Bit.Core.Entities;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationUsers;
 using Bit.Core.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationUsers;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationUsers;
 
 [SutProviderCustomize]
 public class CountNewSmSeatsRequiredQueryTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommandTests.cs
similarity index 93%
rename from test/Core.Test/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommandTests.cs
index b28ea914dfbe..73302acc22b4 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/DeleteOrganizationUserCommandTests.cs
@@ -1,7 +1,7 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
 using Bit.Core.Exceptions;
-using Bit.Core.OrganizationFeatures.OrganizationUsers;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
@@ -9,7 +9,7 @@
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationUsers;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationUsers;
 
 [SutProviderCustomize]
 public class DeleteOrganizationUserCommandTests
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommandTests.cs b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommandTests.cs
similarity index 92%
rename from test/Core.Test/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommandTests.cs
rename to test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommandTests.cs
index 542220560ca6..a581b463f2fa 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommandTests.cs
+++ b/test/Core.Test/AdminConsole/OrganizationFeatures/OrganizationUsers/UpdateOrganizationUserGroupsCommandTests.cs
@@ -1,6 +1,6 @@
-using Bit.Core.Entities;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.OrganizationFeatures.OrganizationUsers;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Test.Common.AutoFixture;
@@ -8,7 +8,7 @@
 using NSubstitute;
 using Xunit;
 
-namespace Bit.Core.Test.OrganizationFeatures.OrganizationUsers;
+namespace Bit.Core.Test.AdminConsole.OrganizationFeatures.OrganizationUsers;
 
 [SutProviderCustomize]
 public class UpdateOrganizationUserGroupsCommandTests
diff --git a/test/Core.Test/Auth/Models/Business/Tokenables/OrgUserInviteTokenableTests.cs b/test/Core.Test/Auth/Models/Business/Tokenables/OrgUserInviteTokenableTests.cs
new file mode 100644
index 000000000000..aeeda206fa95
--- /dev/null
+++ b/test/Core.Test/Auth/Models/Business/Tokenables/OrgUserInviteTokenableTests.cs
@@ -0,0 +1,264 @@
+using AutoFixture.Xunit2;
+using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Entities;
+using Bit.Core.Tokens;
+using Xunit;
+
+
+namespace Bit.Core.Test.Auth.Models.Business.Tokenables;
+
+// Note: test names follow MethodName_StateUnderTest_ExpectedBehavior pattern.
+public class OrgUserInviteTokenableTests
+{
+    // Allow a small tolerance for possible execution delays or clock precision.
+    private readonly TimeSpan _timeTolerance = TimeSpan.FromMilliseconds(10);
+
+    /// <summary>
+    /// Tests that the default constructor sets the expiration date to the expected duration.
+    /// </summary>
+    [Fact]
+    public void Constructor_DefaultInitialization_ExpirationSetToExpectedDuration()
+    {
+        var token = new OrgUserInviteTokenable();
+        var expectedExpiration = DateTime.UtcNow + OrgUserInviteTokenable.GetTokenLifetime();
+
+        Assert.True(TimesAreCloseEnough(expectedExpiration, token.ExpirationDate, _timeTolerance));
+    }
+
+    /// <summary>
+    /// Tests that the constructor sets the properties correctly from a valid OrganizationUser object.
+    /// </summary>
+    [Theory, AutoData]
+    public void Constructor_ValidOrgUser_PropertiesSetFromOrgUser(OrganizationUser orgUser)
+    {
+        var token = new OrgUserInviteTokenable(orgUser);
+
+        Assert.Equal(orgUser.Id, token.OrgUserId);
+        Assert.Equal(orgUser.Email, token.OrgUserEmail);
+    }
+
+    /// <summary>
+    /// Tests that the constructor sets the properties to default values when given a null OrganizationUser object.
+    /// </summary>
+    [Fact]
+    public void Constructor_NullOrgUser_PropertiesSetToDefault()
+    {
+        var token = new OrgUserInviteTokenable(null);
+
+        Assert.Equal(default, token.OrgUserId);
+        Assert.Equal(default, token.OrgUserEmail);
+    }
+
+    /// <summary>
+    /// Tests that a custom expiration date is preserved after token initialization.
+    /// </summary>
+    [Fact]
+    public void Constructor_CustomExpirationDate_ExpirationMatchesProvidedValue()
+    {
+        var customExpiration = DateTime.UtcNow.AddHours(3);
+        var token = new OrgUserInviteTokenable
+        {
+            ExpirationDate = customExpiration
+        };
+
+        Assert.True(TimesAreCloseEnough(customExpiration, token.ExpirationDate, _timeTolerance));
+    }
+
+    /// <summary>
+    ///  Tests the validity of a token initialized with a null org user.
+    /// </summary>
+    [Fact]
+    public void Valid_NullOrgUser_ReturnsFalse()
+    {
+        var token = new OrgUserInviteTokenable(null);
+
+        Assert.False(token.Valid);
+    }
+
+    /// <summary>
+    /// Tests the validity of a token with a non-matching identifier.
+    /// </summary>
+    [Fact]
+    public void Valid_WrongIdentifier_ReturnsFalse()
+    {
+        var token = new OrgUserInviteTokenable
+        {
+            Identifier = "IncorrectIdentifier"
+        };
+
+        Assert.False(token.Valid);
+    }
+
+    /// <summary>
+    /// Tests the validity of the token when the OrgUserId is set to default.
+    /// </summary>
+    [Fact]
+    public void Valid_DefaultOrgUserId_ReturnsFalse()
+    {
+        var token = new OrgUserInviteTokenable
+        {
+            OrgUserId = default // Guid.Empty
+        };
+
+        Assert.False(token.Valid);
+    }
+
+    /// <summary>
+    /// Tests the validity of the token when the OrgUserEmail is null or empty.
+    /// </summary>
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    public void Valid_NullOrEmptyOrgUserEmail_ReturnsFalse(string email)
+    {
+        var token = new OrgUserInviteTokenable
+        {
+            OrgUserEmail = email
+        };
+
+        Assert.False(token.Valid);
+    }
+
+
+    /// <summary>
+    /// Tests the validity of the token when the token is expired.
+    /// </summary>
+    [Fact]
+    public void Valid_ExpiredToken_ReturnsFalse()
+    {
+        var expiredDate = DateTime.UtcNow.AddHours(-3);
+        var token = new OrgUserInviteTokenable
+        {
+            ExpirationDate = expiredDate
+        };
+
+        Assert.False(token.Valid);
+    }
+
+
+    /// <summary>
+    /// Tests the TokenIsValid method when given a null OrganizationUser object.
+    /// </summary>
+    [Fact]
+    public void TokenIsValid_NullOrgUser_ReturnsFalse()
+    {
+        var token = new OrgUserInviteTokenable(null);
+
+        Assert.False(token.TokenIsValid(null));
+    }
+
+    /// <summary>
+    /// Tests the TokenIsValid method when the OrgUserId does not match.
+    /// </summary>
+    [Theory, AutoData]
+    public void TokenIsValid_WrongUserId_ReturnsFalse(OrganizationUser orgUser)
+    {
+        var token = new OrgUserInviteTokenable(orgUser)
+        {
+            OrgUserId = Guid.NewGuid() // Force a different ID
+        };
+
+        Assert.False(token.TokenIsValid(orgUser));
+    }
+
+    /// <summary>
+    /// Tests the TokenIsValid method when the OrgUserEmail does not match.
+    /// </summary>
+    [Theory, AutoData]
+    public void TokenIsValid_WrongEmail_ReturnsFalse(OrganizationUser orgUser)
+    {
+        var token = new OrgUserInviteTokenable(orgUser)
+        {
+            OrgUserEmail = "wrongemail@example.com" // Force a different email
+        };
+
+        Assert.False(token.TokenIsValid(orgUser));
+    }
+
+    /// <summary>
+    /// Tests the TokenIsValid method when both OrgUserId and OrgUserEmail match.
+    /// </summary>
+    [Theory, AutoData]
+    public void TokenIsValid_MatchingUserIdAndEmail_ReturnsTrue(OrganizationUser orgUser)
+    {
+        var token = new OrgUserInviteTokenable(orgUser);
+
+        Assert.True(token.TokenIsValid(orgUser));
+    }
+
+    /// <summary>
+    /// Tests the TokenIsValid method to ensure email comparison is case-insensitive.
+    /// </summary>
+    [Theory, AutoData]
+    public void TokenIsValid_EmailCaseInsensitiveComparison_ReturnsTrue(OrganizationUser orgUser)
+    {
+        var token = new OrgUserInviteTokenable(orgUser);
+
+        // Modify the orgUser's email case
+        orgUser.Email = orgUser.Email.ToUpperInvariant();
+
+        Assert.True(token.TokenIsValid(orgUser));
+    }
+
+
+    /// <summary>
+    /// Tests the TokenIsValid method when the token is expired.
+    /// Should return true as TokenIsValid only validates token data -- not token expiration.
+    /// </summary>
+    [Theory, AutoData]
+    public void TokenIsValid_ExpiredToken_ReturnsTrue(OrganizationUser orgUser)
+    {
+        var expiredDate = DateTime.UtcNow.AddHours(-3);
+        var token = new OrgUserInviteTokenable(orgUser)
+        {
+            ExpirationDate = expiredDate
+        };
+
+        Assert.True(token.TokenIsValid(orgUser));
+    }
+
+    /// <summary>
+    /// Tests the deserialization of a token to ensure that the ExpirationDate is preserved.
+    /// </summary>
+    [Theory, AutoData]
+    public void FromToken_SerializedToken_PreservesExpirationDate(OrganizationUser orgUser)
+    {
+        // Arbitrary time for testing
+        var expectedDateTime = DateTime.UtcNow.AddHours(-3);
+        var token = new OrgUserInviteTokenable(orgUser)
+        {
+            ExpirationDate = expectedDateTime
+        };
+
+        var result = Tokenable.FromToken<OrgUserInviteTokenable>(token.ToToken());
+
+        Assert.True(TimesAreCloseEnough(expectedDateTime, result.ExpirationDate, _timeTolerance));
+    }
+
+    /// <summary>
+    /// Tests the deserialization of a token to ensure that the OrgUserId property is preserved.
+    /// </summary>
+    [Theory, AutoData]
+    public void FromToken_SerializedToken_PreservesOrgUserId(OrganizationUser orgUser)
+    {
+        var token = new OrgUserInviteTokenable(orgUser);
+        var result = Tokenable.FromToken<OrgUserInviteTokenable>(token.ToToken());
+        Assert.Equal(orgUser.Id, result.OrgUserId);
+    }
+
+    /// <summary>
+    /// Tests the deserialization of a token to ensure that the OrgUserEmail property is preserved.
+    /// </summary>
+    [Theory, AutoData]
+    public void FromToken_SerializedToken_PreservesOrgUserEmail(OrganizationUser orgUser)
+    {
+        var token = new OrgUserInviteTokenable(orgUser);
+        var result = Tokenable.FromToken<OrgUserInviteTokenable>(token.ToToken());
+        Assert.Equal(orgUser.Email, result.OrgUserEmail);
+    }
+
+    private bool TimesAreCloseEnough(DateTime time1, DateTime time2, TimeSpan tolerance)
+    {
+        return (time1 - time2).Duration() < tolerance;
+    }
+}
diff --git a/test/Core.Test/Auth/Models/Business/Tokenables/WebAuthnCredentialCreateOptionsTokenableTests.cs b/test/Core.Test/Auth/Models/Business/Tokenables/WebAuthnCredentialCreateOptionsTokenableTests.cs
new file mode 100644
index 000000000000..c16f5c910013
--- /dev/null
+++ b/test/Core.Test/Auth/Models/Business/Tokenables/WebAuthnCredentialCreateOptionsTokenableTests.cs
@@ -0,0 +1,81 @@
+using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Entities;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Fido2NetLib;
+using Xunit;
+
+namespace Bit.Core.Test.Auth.Models.Business.Tokenables;
+
+public class WebAuthnCredentialCreateOptionsTokenableTests
+{
+    [Theory, BitAutoData]
+    public void Valid_TokenWithoutUser_ReturnsFalse(CredentialCreateOptions createOptions)
+    {
+        var token = new WebAuthnCredentialCreateOptionsTokenable(null, createOptions);
+
+        var isValid = token.Valid;
+
+        Assert.False(isValid);
+    }
+
+    [Theory, BitAutoData]
+    public void Valid_TokenWithoutOptions_ReturnsFalse(User user)
+    {
+        var token = new WebAuthnCredentialCreateOptionsTokenable(user, null);
+
+        var isValid = token.Valid;
+
+        Assert.False(isValid);
+    }
+
+    [Theory, BitAutoData]
+    public void Valid_NewlyCreatedToken_ReturnsTrue(User user, CredentialCreateOptions createOptions)
+    {
+        var token = new WebAuthnCredentialCreateOptionsTokenable(user, createOptions);
+
+        var isValid = token.Valid;
+
+        Assert.True(isValid);
+    }
+
+    [Theory, BitAutoData]
+    public void ValidIsValid_TokenWithoutUser_ReturnsFalse(User user, CredentialCreateOptions createOptions)
+    {
+        var token = new WebAuthnCredentialCreateOptionsTokenable(null, createOptions);
+
+        var isValid = token.TokenIsValid(user);
+
+        Assert.False(isValid);
+    }
+
+    [Theory, BitAutoData]
+    public void ValidIsValid_TokenWithoutOptions_ReturnsFalse(User user)
+    {
+        var token = new WebAuthnCredentialCreateOptionsTokenable(user, null);
+
+        var isValid = token.TokenIsValid(user);
+
+        Assert.False(isValid);
+    }
+
+    [Theory, BitAutoData]
+    public void ValidIsValid_NonMatchingUsers_ReturnsFalse(User user1, User user2, CredentialCreateOptions createOptions)
+    {
+        var token = new WebAuthnCredentialCreateOptionsTokenable(user1, createOptions);
+
+        var isValid = token.TokenIsValid(user2);
+
+        Assert.False(isValid);
+    }
+
+    [Theory, BitAutoData]
+    public void ValidIsValid_SameUser_ReturnsTrue(User user, CredentialCreateOptions createOptions)
+    {
+        var token = new WebAuthnCredentialCreateOptionsTokenable(user, createOptions);
+
+        var isValid = token.TokenIsValid(user);
+
+        Assert.True(isValid);
+    }
+}
+
diff --git a/test/Core.Test/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommandTests.cs b/test/Core.Test/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommandTests.cs
new file mode 100644
index 000000000000..a352976438f0
--- /dev/null
+++ b/test/Core.Test/Auth/UserFeatures/UserMasterPassword/SetInitialMasterPasswordCommandTests.cs
@@ -0,0 +1,193 @@
+using Bit.Core.Auth.UserFeatures.UserMasterPassword;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Microsoft.AspNetCore.Identity;
+using NSubstitute;
+using NSubstitute.ReturnsExtensions;
+using Xunit;
+
+namespace Bit.Core.Test.Auth.UserFeatures.UserMasterPassword;
+
+[SutProviderCustomize]
+public class SetInitialMasterPasswordCommandTests
+{
+    [Theory]
+    [BitAutoData]
+    public async Task SetInitialMasterPassword_Success(SutProvider<SetInitialMasterPasswordCommand> sutProvider,
+        User user, string masterPassword, string key, string orgIdentifier,
+        Organization org, OrganizationUser orgUser)
+    {
+        // Arrange
+        user.MasterPassword = null;
+
+        sutProvider.GetDependency<IUserService>()
+            .UpdatePasswordHash(Arg.Any<User>(), Arg.Any<string>(), true, false)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdentifierAsync(orgIdentifier)
+            .Returns(org);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(org.Id, user.Id)
+            .Returns(orgUser);
+
+        // Act
+        var result = await sutProvider.Sut.SetInitialMasterPasswordAsync(user, masterPassword, key, orgIdentifier);
+
+        // Assert
+        Assert.Equal(IdentityResult.Success, result);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SetInitialMasterPassword_UserIsNull_ThrowsArgumentNullException(SutProvider<SetInitialMasterPasswordCommand> sutProvider, string masterPassword, string key, string orgIdentifier)
+    {
+        // Act & Assert
+        await Assert.ThrowsAsync<ArgumentNullException>(async () => await sutProvider.Sut.SetInitialMasterPasswordAsync(null, masterPassword, key, orgIdentifier));
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SetInitialMasterPassword_AlreadyHasPassword_ReturnsFalse(SutProvider<SetInitialMasterPasswordCommand> sutProvider, User user, string masterPassword, string key, string orgIdentifier)
+    {
+        // Arrange
+        user.MasterPassword = "ExistingPassword";
+
+        // Act
+        var result = await sutProvider.Sut.SetInitialMasterPasswordAsync(user, masterPassword, key, orgIdentifier);
+
+        // Assert
+        Assert.False(result.Succeeded);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SetInitialMasterPassword_NullOrgSsoIdentifier_ThrowsBadRequestException(
+        SutProvider<SetInitialMasterPasswordCommand> sutProvider, User user, string masterPassword, string key)
+    {
+        // Arrange
+        user.MasterPassword = null;
+        string orgSsoIdentifier = null;
+
+        sutProvider.GetDependency<IUserService>()
+            .UpdatePasswordHash(Arg.Any<User>(), Arg.Any<string>(), true, false)
+            .Returns(IdentityResult.Success);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            async () => await sutProvider.Sut.SetInitialMasterPasswordAsync(user, masterPassword, key, orgSsoIdentifier));
+        Assert.Equal("Organization SSO Identifier required.", exception.Message);
+    }
+
+
+    [Theory]
+    [BitAutoData]
+    public async Task SetInitialMasterPassword_InvalidOrganization_Throws(SutProvider<SetInitialMasterPasswordCommand> sutProvider, User user, string masterPassword, string key, string orgIdentifier)
+    {
+        // Arrange
+        user.MasterPassword = null;
+
+        sutProvider.GetDependency<IUserService>()
+            .UpdatePasswordHash(Arg.Any<User>(), Arg.Any<string>(), true, false)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdentifierAsync(orgIdentifier)
+            .ReturnsNull();
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(async () => await sutProvider.Sut.SetInitialMasterPasswordAsync(user, masterPassword, key, orgIdentifier));
+        Assert.Equal("Organization invalid.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SetInitialMasterPassword_UserNotFoundInOrganization_Throws(SutProvider<SetInitialMasterPasswordCommand> sutProvider, User user, string masterPassword, string key, Organization org)
+    {
+        // Arrange
+        user.MasterPassword = null;
+
+        sutProvider.GetDependency<IUserService>()
+            .UpdatePasswordHash(Arg.Any<User>(), Arg.Any<string>(), true, false)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdentifierAsync(Arg.Any<string>())
+            .Returns(org);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(org.Id, user.Id)
+            .ReturnsNull();
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(async () => await sutProvider.Sut.SetInitialMasterPasswordAsync(user, masterPassword, key, org.Identifier));
+        Assert.Equal("User not found within organization.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SetInitialMasterPassword_ConfirmedOrgUser_DoesNotCallAcceptOrgUser(SutProvider<SetInitialMasterPasswordCommand> sutProvider,
+        User user, string masterPassword, string key, string orgIdentifier, Organization org, OrganizationUser orgUser)
+    {
+        // Arrange
+        user.MasterPassword = null;
+
+        sutProvider.GetDependency<IUserService>()
+            .UpdatePasswordHash(Arg.Any<User>(), Arg.Any<string>(), true, false)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdentifierAsync(orgIdentifier)
+            .Returns(org);
+
+        orgUser.Status = OrganizationUserStatusType.Confirmed;
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(org.Id, user.Id)
+            .Returns(orgUser);
+
+
+        // Act
+        var result = await sutProvider.Sut.SetInitialMasterPasswordAsync(user, masterPassword, key, orgIdentifier);
+
+        // Assert
+        Assert.Equal(IdentityResult.Success, result);
+        await sutProvider.GetDependency<IAcceptOrgUserCommand>().DidNotReceive().AcceptOrgUserAsync(Arg.Any<OrganizationUser>(), Arg.Any<User>(), Arg.Any<IUserService>());
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task SetInitialMasterPassword_InvitedOrgUser_CallsAcceptOrgUser(SutProvider<SetInitialMasterPasswordCommand> sutProvider,
+        User user, string masterPassword, string key, string orgIdentifier, Organization org, OrganizationUser orgUser)
+    {
+        // Arrange
+        user.MasterPassword = null;
+
+        sutProvider.GetDependency<IUserService>()
+            .UpdatePasswordHash(Arg.Any<User>(), Arg.Any<string>(), true, false)
+            .Returns(IdentityResult.Success);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdentifierAsync(orgIdentifier)
+            .Returns(org);
+
+        orgUser.Status = OrganizationUserStatusType.Invited;
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(org.Id, user.Id)
+            .Returns(orgUser);
+
+        // Act
+        var result = await sutProvider.Sut.SetInitialMasterPasswordAsync(user, masterPassword, key, orgIdentifier);
+
+        // Assert
+        Assert.Equal(IdentityResult.Success, result);
+        await sutProvider.GetDependency<IAcceptOrgUserCommand>().Received(1).AcceptOrgUserAsync(orgUser, user, sutProvider.GetDependency<IUserService>());
+    }
+
+}
diff --git a/test/Core.Test/AutoFixture/OrganizationFixtures.cs b/test/Core.Test/AutoFixture/OrganizationFixtures.cs
index 658964b73d1e..297dbe893324 100644
--- a/test/Core.Test/AutoFixture/OrganizationFixtures.cs
+++ b/test/Core.Test/AutoFixture/OrganizationFixtures.cs
@@ -133,8 +133,8 @@ public class SecretsManagerOrganizationCustomization : ICustomization
 {
     public void Customize(IFixture fixture)
     {
+        const PlanType planType = PlanType.EnterpriseAnnually;
         var organizationId = Guid.NewGuid();
-        var planType = PlanType.EnterpriseAnnually;
 
         fixture.Customize<Organization>(composer => composer
             .With(o => o.Id, organizationId)
@@ -143,8 +143,7 @@ public void Customize(IFixture fixture)
             .With(o => o.PlanType, planType)
             .With(o => o.Plan, StaticStore.GetPlan(planType).Name)
             .With(o => o.MaxAutoscaleSmSeats, (int?)null)
-            .With(o => o.MaxAutoscaleSmServiceAccounts, (int?)null)
-        );
+            .With(o => o.MaxAutoscaleSmServiceAccounts, (int?)null));
     }
 }
 
diff --git a/test/Core.Test/Models/Business/SecretsManagerSubscriptionUpdateTests.cs b/test/Core.Test/Models/Business/SecretsManagerSubscriptionUpdateTests.cs
index 0adef6b473ca..88e21862b59c 100644
--- a/test/Core.Test/Models/Business/SecretsManagerSubscriptionUpdateTests.cs
+++ b/test/Core.Test/Models/Business/SecretsManagerSubscriptionUpdateTests.cs
@@ -15,17 +15,45 @@ public class SecretsManagerSubscriptionUpdateTests
     [BitAutoData(PlanType.Custom)]
     [BitAutoData(PlanType.FamiliesAnnually)]
     [BitAutoData(PlanType.FamiliesAnnually2019)]
+    public Task UpdateSubscriptionAsync_WithNonSecretsManagerPlanType_ThrowsBadRequestException(
+        PlanType planType,
+        Organization organization)
+    {
+        // Arrange
+        organization.PlanType = planType;
+
+        // Act
+        var exception = Assert.Throws<NotFoundException>(() => new SecretsManagerSubscriptionUpdate(organization, false));
+
+        // Assert
+        Assert.Contains("Invalid Secrets Manager plan", exception.Message, StringComparison.InvariantCultureIgnoreCase);
+        return Task.CompletedTask;
+    }
+
+    [Theory]
     [BitAutoData(PlanType.EnterpriseMonthly2019)]
+    [BitAutoData(PlanType.EnterpriseMonthly2020)]
+    [BitAutoData(PlanType.EnterpriseMonthly)]
     [BitAutoData(PlanType.EnterpriseAnnually2019)]
+    [BitAutoData(PlanType.EnterpriseAnnually2020)]
+    [BitAutoData(PlanType.EnterpriseAnnually)]
     [BitAutoData(PlanType.TeamsMonthly2019)]
+    [BitAutoData(PlanType.TeamsMonthly2020)]
+    [BitAutoData(PlanType.TeamsMonthly)]
     [BitAutoData(PlanType.TeamsAnnually2019)]
-    public async Task UpdateSubscriptionAsync_WithNonSecretsManagerPlanType_ThrowsBadRequestException(
+    [BitAutoData(PlanType.TeamsAnnually2020)]
+    [BitAutoData(PlanType.TeamsAnnually)]
+    public void UpdateSubscription_WithNonSecretsManagerPlanType_DoesNotThrowException(
         PlanType planType,
         Organization organization)
     {
+        // Arrange
         organization.PlanType = planType;
 
-        var exception = Assert.Throws<NotFoundException>(() => new SecretsManagerSubscriptionUpdate(organization, false));
-        Assert.Contains("Invalid Secrets Manager plan", exception.Message, StringComparison.InvariantCultureIgnoreCase);
+        // Act
+        var ex = Record.Exception(() => new SecretsManagerSubscriptionUpdate(organization, false));
+
+        // Assert
+        Assert.Null(ex);
     }
 }
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationSubscriptionUpdate/AddSecretsManagerSubscriptionCommandTests.cs b/test/Core.Test/OrganizationFeatures/OrganizationSubscriptionUpdate/AddSecretsManagerSubscriptionCommandTests.cs
index 810561c4b53d..e3b948719734 100644
--- a/test/Core.Test/OrganizationFeatures/OrganizationSubscriptionUpdate/AddSecretsManagerSubscriptionCommandTests.cs
+++ b/test/Core.Test/OrganizationFeatures/OrganizationSubscriptionUpdate/AddSecretsManagerSubscriptionCommandTests.cs
@@ -1,12 +1,12 @@
-using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.StaticStore;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions;
-using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Utilities;
 using Bit.Test.Common.AutoFixture;
diff --git a/test/Core.Test/OrganizationFeatures/OrganizationUsers/AcceptOrgUserCommandTests.cs b/test/Core.Test/OrganizationFeatures/OrganizationUsers/AcceptOrgUserCommandTests.cs
new file mode 100644
index 000000000000..33ad63d02e0c
--- /dev/null
+++ b/test/Core.Test/OrganizationFeatures/OrganizationUsers/AcceptOrgUserCommandTests.cs
@@ -0,0 +1,664 @@
+using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Entities;
+using Bit.Core.Enums;
+using Bit.Core.Exceptions;
+using Bit.Core.Models.Data.Organizations.OrganizationUsers;
+using Bit.Core.OrganizationFeatures.OrganizationUsers;
+using Bit.Core.Repositories;
+using Bit.Core.Services;
+using Bit.Core.Settings;
+using Bit.Core.Test.AutoFixture.OrganizationFixtures;
+using Bit.Core.Tokens;
+using Bit.Core.Utilities;
+using Bit.Test.Common.AutoFixture;
+using Bit.Test.Common.AutoFixture.Attributes;
+using Bit.Test.Common.Fakes;
+using Microsoft.AspNetCore.DataProtection;
+using NSubstitute;
+using Xunit;
+
+namespace Bit.Core.Test.OrganizationFeatures.OrganizationUsers;
+
+// Note: test names follow MethodName_StateUnderTest_ExpectedBehavior pattern.
+[SutProviderCustomize]
+public class AcceptOrgUserCommandTests
+{
+    private readonly IUserService _userService = Substitute.For<IUserService>();
+    private readonly IOrgUserInviteTokenableFactory _orgUserInviteTokenableFactory = Substitute.For<IOrgUserInviteTokenableFactory>();
+    private readonly IDataProtectorTokenFactory<OrgUserInviteTokenable> _orgUserInviteTokenDataFactory = new FakeDataProtectorTokenFactory<OrgUserInviteTokenable>();
+
+    // Base AcceptOrgUserAsync method tests ----------------------------------------------------------------------------
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUser_InvitedUserToSingleOrg_AcceptsOrgUser(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+
+        // Act
+        var resultOrgUser = await sutProvider.Sut.AcceptOrgUserAsync(orgUser, user, _userService);
+
+        // Assert
+        // Verify returned org user details
+        AssertValidAcceptedOrgUser(resultOrgUser, orgUser, user);
+
+        // Verify org repository called with updated orgUser
+        await sutProvider.GetDependency<IOrganizationUserRepository>().Received(1).ReplaceAsync(
+            Arg.Is<OrganizationUser>(ou => ou.Id == orgUser.Id && ou.Status == OrganizationUserStatusType.Accepted));
+
+        // Verify emails sent to admin
+        await sutProvider.GetDependency<IMailService>().Received(1).SendOrganizationAcceptedEmailAsync(
+            Arg.Is<Organization>(o => o.Id == org.Id),
+            Arg.Is<string>(e => e == user.Email),
+            Arg.Is<IEnumerable<string>>(a => a.Contains(adminUserDetails.Email))
+        );
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUser_OrgUserStatusIsRevoked_ReturnsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Common setup
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+
+        // Revoke user status
+        orgUser.Status = OrganizationUserStatusType.Revoked;
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.AcceptOrgUserAsync(orgUser, user, _userService));
+
+        Assert.Equal("Your organization access has been revoked.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData(OrganizationUserStatusType.Accepted)]
+    [BitAutoData(OrganizationUserStatusType.Confirmed)]
+    public async Task AcceptOrgUser_OrgUserStatusIsNotInvited_ThrowsBadRequest(
+        OrganizationUserStatusType orgUserStatus,
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+
+        // Set status to something other than invited
+        orgUser.Status = orgUserStatus;
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.AcceptOrgUserAsync(orgUser, user, _userService));
+
+        Assert.Equal("Already accepted.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUser_UserJoiningOrgWithSingleOrgPolicyWhileInAnotherOrg_ThrowsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+
+        //  Make user part of another org
+        var otherOrgUser = new OrganizationUser { UserId = user.Id, OrganizationId = Guid.NewGuid() }; // random org ID
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(user.Id)
+            .Returns(Task.FromResult<ICollection<OrganizationUser>>(new List<OrganizationUser> { otherOrgUser }));
+
+        // Make organization they are trying to join have the single org policy
+        var singleOrgPolicy = new OrganizationUserPolicyDetails { OrganizationId = orgUser.OrganizationId };
+        sutProvider.GetDependency<IPolicyService>()
+            .GetPoliciesApplicableToUserAsync(user.Id, PolicyType.SingleOrg, OrganizationUserStatusType.Invited)
+            .Returns(Task.FromResult<ICollection<OrganizationUserPolicyDetails>>(
+                new List<OrganizationUserPolicyDetails> { singleOrgPolicy }));
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.AcceptOrgUserAsync(orgUser, user, _userService));
+
+        Assert.Equal("You may not join this organization until you leave or remove all other organizations.",
+            exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserAsync_UserInOrgWithSingleOrgPolicyAlready_ThrowsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+
+        // Mock that user is part of an org that has the single org policy
+        sutProvider.GetDependency<IPolicyService>()
+            .AnyPoliciesApplicableToUserAsync(user.Id, PolicyType.SingleOrg)
+            .Returns(true);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.AcceptOrgUserAsync(orgUser, user, _userService));
+
+        Assert.Equal(
+            "You cannot join this organization because you are a member of another organization which forbids it",
+            exception.Message);
+    }
+
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserAsync_UserWithout2FAJoining2FARequiredOrg_ThrowsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+
+        // User doesn't have 2FA enabled
+        _userService.TwoFactorIsEnabledAsync(user).Returns(false);
+
+        // Organization they are trying to join requires 2FA
+        var twoFactorPolicy = new OrganizationUserPolicyDetails { OrganizationId = orgUser.OrganizationId };
+        sutProvider.GetDependency<IPolicyService>()
+            .GetPoliciesApplicableToUserAsync(user.Id, PolicyType.TwoFactorAuthentication,
+                OrganizationUserStatusType.Invited)
+            .Returns(Task.FromResult<ICollection<OrganizationUserPolicyDetails>>(
+                new List<OrganizationUserPolicyDetails> { twoFactorPolicy }));
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(() =>
+            sutProvider.Sut.AcceptOrgUserAsync(orgUser, user, _userService));
+
+        Assert.Equal("You cannot join this organization until you enable two-step login on your user account.",
+            exception.Message);
+    }
+
+
+    // AcceptOrgUserByOrgIdAsync tests --------------------------------------------------------------------------------
+
+    [Theory]
+    [EphemeralDataProtectionAutoData]
+    public async Task AcceptOrgUserByToken_OldToken_AcceptsUserAndVerifiesEmail(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+        SetupCommonAcceptOrgUserByTokenMocks(sutProvider, user, orgUser);
+
+        var oldToken = CreateOldToken(sutProvider, orgUser);
+
+        // Act
+        var resultOrgUser = await sutProvider.Sut.AcceptOrgUserByEmailTokenAsync(orgUser.Id, user, oldToken, _userService);
+
+        // Assert
+        AssertValidAcceptedOrgUser(resultOrgUser, orgUser, user);
+
+        // Verify user email verified logic
+        Assert.True(user.EmailVerified);
+        await sutProvider.GetDependency<IUserRepository>().Received(1).ReplaceAsync(
+            Arg.Is<User>(u => u.Id == user.Id && u.Email == user.Email && user.EmailVerified == true));
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByToken_NewToken_AcceptsUserAndVerifiesEmail(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order
+        // to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+        SetupCommonAcceptOrgUserByTokenMocks(sutProvider, user, orgUser);
+
+        // Must come after common mocks as they mutate the org user.
+        // Mock tokenable factory to return a token that expires in 5 days
+        _orgUserInviteTokenableFactory.CreateToken(orgUser).Returns(new OrgUserInviteTokenable(orgUser)
+        {
+            ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(5))
+        });
+
+        var newToken = CreateNewToken(orgUser);
+
+        // Act
+        var resultOrgUser = await sutProvider.Sut.AcceptOrgUserByEmailTokenAsync(orgUser.Id, user, newToken, _userService);
+
+        // Assert
+        AssertValidAcceptedOrgUser(resultOrgUser, orgUser, user);
+
+        // Verify user email verified logic
+        Assert.True(user.EmailVerified);
+        await sutProvider.GetDependency<IUserRepository>().Received(1).ReplaceAsync(
+            Arg.Is<User>(u => u.Id == user.Id && u.Email == user.Email && user.EmailVerified == true));
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByToken_NullOrgUser_ThrowsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Guid orgUserId)
+    {
+        // Arrange
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUserId).Returns((OrganizationUser)null);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByEmailTokenAsync(orgUserId, user, "token", _userService));
+
+        Assert.Equal("User invalid.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByToken_GenericInvalidToken_ThrowsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, OrganizationUser orgUser)
+    {
+        // Arrange
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUser.Id)
+            .Returns(Task.FromResult(orgUser));
+
+        var invalidToken = "invalidToken";
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByEmailTokenAsync(orgUser.Id, user, invalidToken, _userService));
+
+        Assert.Equal("Invalid token.", exception.Message);
+    }
+
+    [Theory]
+    [EphemeralDataProtectionAutoData]
+    public async Task AcceptOrgUserByToken_ExpiredOldToken_ThrowsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+        SetupCommonAcceptOrgUserByTokenMocks(sutProvider, user, orgUser);
+
+        // As the old token simply set a timestamp which was later compared against the
+        // OrganizationInviteExpirationHours global setting to determine if it was expired or not,
+        // we can simply set the expiration to 24 hours ago to simulate an expired token.
+        sutProvider.GetDependency<IGlobalSettings>().OrganizationInviteExpirationHours.Returns(-24);
+
+        var oldToken = CreateOldToken(sutProvider, orgUser);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByEmailTokenAsync(orgUser.Id, user, oldToken, _userService));
+
+        Assert.Equal("Invalid token.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByToken_ExpiredNewToken_ThrowsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, OrganizationUser orgUser)
+    {
+        // Arrange
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order
+        // to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUser.Id)
+            .Returns(Task.FromResult(orgUser));
+
+        // Must come after common mocks as they mutate the org user.
+        // Mock tokenable factory to return a token that expired yesterday
+        _orgUserInviteTokenableFactory.CreateToken(orgUser).Returns(new OrgUserInviteTokenable(orgUser)
+        {
+            ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(-1))
+        });
+
+        var newToken = CreateNewToken(orgUser);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByEmailTokenAsync(orgUser.Id, user, newToken, _userService));
+
+        Assert.Equal("Invalid token.", exception.Message);
+
+    }
+
+    [Theory]
+    [BitAutoData(OrganizationUserStatusType.Accepted,
+        "Invitation already accepted. You will receive an email when your organization membership is confirmed.")]
+    [BitAutoData(OrganizationUserStatusType.Confirmed,
+        "You are already part of this organization.")]
+    public async Task AcceptOrgUserByToken_UserAlreadyInOrg_ThrowsBadRequest(
+        OrganizationUserStatusType statusType,
+        string expectedErrorMessage,
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, OrganizationUser orgUser)
+    {
+        // Arrange
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order
+        // to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUser.Id)
+            .Returns(Task.FromResult(orgUser));
+
+        // Indicate that a user with the given email already exists in the organization
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetCountByOrganizationAsync(orgUser.OrganizationId, user.Email, true)
+            .Returns(1);
+
+        orgUser.Status = statusType;
+
+        // Must come after common mocks as they mutate the org user.
+        // Mock tokenable factory to return valid, new token that expires in 5 days
+        _orgUserInviteTokenableFactory.CreateToken(orgUser).Returns(new OrgUserInviteTokenable(orgUser)
+        {
+            ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(5))
+        });
+
+        var newToken = CreateNewToken(orgUser);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByEmailTokenAsync(orgUser.Id, user, newToken, _userService));
+
+        Assert.Equal(expectedErrorMessage, exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByToken_EmailMismatch_ThrowsBadRequest(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, OrganizationUser orgUser)
+    {
+        // Arrange
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order
+        // to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
+        SetupCommonAcceptOrgUserByTokenMocks(sutProvider, user, orgUser);
+
+        // Modify the orgUser's email to be different from the user's email to simulate the mismatch
+        orgUser.Email = "mismatchedEmail@example.com";
+
+        // Must come after common mocks as they mutate the org user.
+        // Mock tokenable factory to return a token that expires in 5 days
+        _orgUserInviteTokenableFactory.CreateToken(orgUser).Returns(new OrgUserInviteTokenable(orgUser)
+        {
+            ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(5))
+        });
+
+        var newToken = CreateNewToken(orgUser);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByEmailTokenAsync(orgUser.Id, user, newToken, _userService));
+
+        Assert.Equal("User email does not match invite.", exception.Message);
+    }
+
+
+    // AcceptOrgUserByOrgSsoIdAsync -----------------------------------------------------------------------------------
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByOrgSsoIdAsync_ValidData_AcceptsOrgUser(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdentifierAsync(org.Identifier)
+            .Returns(org);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(org.Id, user.Id)
+            .Returns(orgUser);
+
+        // Act
+        var resultOrgUser = await sutProvider.Sut.AcceptOrgUserByOrgSsoIdAsync(org.Identifier, user, _userService);
+
+        // Assert
+        AssertValidAcceptedOrgUser(resultOrgUser, orgUser, user);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByOrgSsoIdAsync_InvalidOrg_ThrowsBadRequest(SutProvider<AcceptOrgUserCommand> sutProvider,
+        string orgSsoIdentifier, User user)
+    {
+        // Arrange
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdentifierAsync(orgSsoIdentifier)
+            .Returns((Organization)null);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByOrgSsoIdAsync(orgSsoIdentifier, user, _userService));
+
+        Assert.Equal("Organization invalid.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByOrgSsoIdAsync_UserNotInOrg_ThrowsBadRequest(SutProvider<AcceptOrgUserCommand> sutProvider,
+        Organization org, User user)
+    {
+        // Arrange
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdentifierAsync(org.Identifier)
+            .Returns(org);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(org.Id, user.Id)
+            .Returns((OrganizationUser)null);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByOrgSsoIdAsync(org.Identifier, user, _userService));
+
+        Assert.Equal("User not found within organization.", exception.Message);
+    }
+
+    // AcceptOrgUserByOrgIdAsync ---------------------------------------------------------------------------------------
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByOrgId_ValidData_AcceptsOrgUser(
+        SutProvider<AcceptOrgUserCommand> sutProvider,
+        User user, Organization org, OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        SetupCommonAcceptOrgUserMocks(sutProvider, user, org, orgUser, adminUserDetails);
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(org.Id)
+            .Returns(org);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(org.Id, user.Id)
+            .Returns(orgUser);
+
+        // Act
+        var resultOrgUser = await sutProvider.Sut.AcceptOrgUserByOrgIdAsync(org.Id, user, _userService);
+
+        // Assert
+        AssertValidAcceptedOrgUser(resultOrgUser, orgUser, user);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByOrgId_InvalidOrg_ThrowsBadRequest(SutProvider<AcceptOrgUserCommand> sutProvider,
+        Guid orgId, User user)
+    {
+        // Arrange
+
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(orgId)
+            .Returns((Organization)null);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByOrgIdAsync(orgId, user, _userService));
+
+        Assert.Equal("Organization invalid.", exception.Message);
+    }
+
+    [Theory]
+    [BitAutoData]
+    public async Task AcceptOrgUserByOrgId_UserNotInOrg_ThrowsBadRequest(SutProvider<AcceptOrgUserCommand> sutProvider,
+        Organization org, User user)
+    {
+        // Arrange
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(org.Id)
+            .Returns(org);
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByOrganizationAsync(org.Id, user.Id)
+            .Returns((OrganizationUser)null);
+
+        // Act & Assert
+        var exception = await Assert.ThrowsAsync<BadRequestException>(
+            () => sutProvider.Sut.AcceptOrgUserByOrgIdAsync(org.Id, user, _userService));
+
+        Assert.Equal("User not found within organization.", exception.Message);
+    }
+
+    // Private helpers -------------------------------------------------------------------------------------------------
+
+    /// <summary>
+    ///  Asserts that the given org user is in the expected state after a successful AcceptOrgUserAsync call.
+    ///  For use in happy path tests.
+    /// </summary>
+    private void AssertValidAcceptedOrgUser(OrganizationUser resultOrgUser, OrganizationUser expectedOrgUser, User user)
+    {
+        Assert.NotNull(resultOrgUser);
+        Assert.Equal(OrganizationUserStatusType.Accepted, resultOrgUser.Status);
+        Assert.Equal(expectedOrgUser, resultOrgUser);
+        Assert.Equal(expectedOrgUser.Id, resultOrgUser.Id);
+        Assert.Null(resultOrgUser.Email);
+        Assert.Equal(user.Id, resultOrgUser.UserId);
+
+
+    }
+
+    private void SetupCommonAcceptOrgUserByTokenMocks(SutProvider<AcceptOrgUserCommand> sutProvider, User user, OrganizationUser orgUser)
+    {
+        sutProvider.GetDependency<IGlobalSettings>().OrganizationInviteExpirationHours.Returns(24);
+        user.EmailVerified = false;
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetByIdAsync(orgUser.Id)
+            .Returns(Task.FromResult(orgUser));
+
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetCountByOrganizationAsync(orgUser.OrganizationId, user.Email, true)
+            .Returns(0);
+    }
+
+    /// <summary>
+    /// Sets up common mock behavior for the AcceptOrgUserAsync tests.
+    /// This method initializes:
+    /// - The invited user's email, status, type, and organization ID.
+    /// - Ensures the user is not part of any other organizations.
+    /// - Confirms the target organization doesn't have a single org policy.
+    /// - Ensures the user doesn't belong to an organization with a single org policy.
+    /// - Assumes the user doesn't have 2FA enabled and the organization doesn't require it.
+    /// - Provides mock data for an admin to validate email functionality.
+    /// - Returns the corresponding organization for the given org ID.
+    /// </summary>
+    private void SetupCommonAcceptOrgUserMocks(SutProvider<AcceptOrgUserCommand> sutProvider, User user,
+        Organization org,
+        OrganizationUser orgUser, OrganizationUserUserDetails adminUserDetails)
+    {
+        // Arrange
+        orgUser.Email = user.Email;
+        orgUser.Status = OrganizationUserStatusType.Invited;
+        orgUser.Type = OrganizationUserType.User;
+        orgUser.OrganizationId = org.Id;
+
+        // User is not part of any other orgs
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByUserAsync(user.Id)
+            .Returns(
+                Task.FromResult<ICollection<OrganizationUser>>(new List<OrganizationUser>())
+            );
+
+        // Org they are trying to join does not have single org policy
+        sutProvider.GetDependency<IPolicyService>()
+            .GetPoliciesApplicableToUserAsync(user.Id, PolicyType.SingleOrg, OrganizationUserStatusType.Invited)
+            .Returns(
+                Task.FromResult<ICollection<OrganizationUserPolicyDetails>>(
+                    new List<OrganizationUserPolicyDetails>()
+                )
+            );
+
+        // User is not part of any organization that applies the single org policy
+        sutProvider.GetDependency<IPolicyService>()
+            .AnyPoliciesApplicableToUserAsync(user.Id, PolicyType.SingleOrg)
+            .Returns(false);
+
+        // User doesn't have 2FA enabled
+        _userService.TwoFactorIsEnabledAsync(user).Returns(false);
+
+        // Org does not require 2FA
+        sutProvider.GetDependency<IPolicyService>().GetPoliciesApplicableToUserAsync(user.Id,
+                PolicyType.TwoFactorAuthentication, OrganizationUserStatusType.Invited)
+            .Returns(Task.FromResult<ICollection<OrganizationUserPolicyDetails>>(
+                new List<OrganizationUserPolicyDetails>()));
+
+        // Provide at least 1 admin to test email functionality
+        sutProvider.GetDependency<IOrganizationUserRepository>()
+            .GetManyByMinimumRoleAsync(orgUser.OrganizationId, OrganizationUserType.Admin)
+            .Returns(Task.FromResult<IEnumerable<OrganizationUserUserDetails>>(
+                new List<OrganizationUserUserDetails>() { adminUserDetails }
+            ));
+
+        // Return org
+        sutProvider.GetDependency<IOrganizationRepository>()
+            .GetByIdAsync(org.Id)
+            .Returns(Task.FromResult(org));
+    }
+
+
+    private string CreateOldToken(SutProvider<AcceptOrgUserCommand> sutProvider,
+        OrganizationUser organizationUser)
+    {
+        var dataProtector = sutProvider.GetDependency<IDataProtectionProvider>()
+            .CreateProtector("OrganizationServiceDataProtector");
+
+        // Token matching the format used in OrganizationService.InviteUserAsync
+        var oldToken = dataProtector.Protect(
+            $"OrganizationUserInvite {organizationUser.Id} {organizationUser.Email} {CoreHelpers.ToEpocMilliseconds(DateTime.UtcNow)}");
+
+        return oldToken;
+    }
+
+    private string CreateNewToken(OrganizationUser orgUser)
+    {
+        var orgUserInviteTokenable = _orgUserInviteTokenableFactory.CreateToken(orgUser);
+        var protectedToken = _orgUserInviteTokenDataFactory.Protect(orgUserInviteTokenable);
+
+        return protectedToken;
+    }
+}
diff --git a/test/Core.Test/Services/EventServiceTests.cs b/test/Core.Test/Services/EventServiceTests.cs
index ad73541d143a..18f5371b4943 100644
--- a/test/Core.Test/Services/EventServiceTests.cs
+++ b/test/Core.Test/Services/EventServiceTests.cs
@@ -1,7 +1,8 @@
 using Bit.Core.AdminConsole.Entities;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Models.Data.Provider;
 using Bit.Core.Context;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations;
diff --git a/test/Core.Test/Services/HandlebarsMailServiceTests.cs b/test/Core.Test/Services/HandlebarsMailServiceTests.cs
index a29e884367f9..266fbc0159e0 100644
--- a/test/Core.Test/Services/HandlebarsMailServiceTests.cs
+++ b/test/Core.Test/Services/HandlebarsMailServiceTests.cs
@@ -1,8 +1,8 @@
 using System.Reflection;
+using Bit.Core.AdminConsole.Entities.Provider;
 using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Models.Business;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Services;
 using Bit.Core.Settings;
 using Microsoft.Extensions.Logging;
diff --git a/test/Core.Test/Services/InMemoryApplicationCacheServiceTests.cs b/test/Core.Test/Services/InMemoryApplicationCacheServiceTests.cs
index ff8e734b3224..37e91c001cc6 100644
--- a/test/Core.Test/Services/InMemoryApplicationCacheServiceTests.cs
+++ b/test/Core.Test/Services/InMemoryApplicationCacheServiceTests.cs
@@ -1,4 +1,5 @@
-using Bit.Core.Repositories;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Repositories;
 using Bit.Core.Services;
 using NSubstitute;
 using Xunit;
diff --git a/test/Core.Test/Services/InMemoryServiceBusApplicationCacheServiceTests.cs b/test/Core.Test/Services/InMemoryServiceBusApplicationCacheServiceTests.cs
index f74aa6f505c4..fcc6a63e501b 100644
--- a/test/Core.Test/Services/InMemoryServiceBusApplicationCacheServiceTests.cs
+++ b/test/Core.Test/Services/InMemoryServiceBusApplicationCacheServiceTests.cs
@@ -1,4 +1,5 @@
-using Bit.Core.Repositories;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
 using NSubstitute;
diff --git a/test/Core.Test/Services/OrganizationServiceTests.cs b/test/Core.Test/Services/OrganizationServiceTests.cs
index e31989f37e41..a7428697f6fe 100644
--- a/test/Core.Test/Services/OrganizationServiceTests.cs
+++ b/test/Core.Test/Services/OrganizationServiceTests.cs
@@ -1,34 +1,37 @@
 using System.Text.Json;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Enums.Provider;
+using Bit.Core.AdminConsole.OrganizationFeatures.OrganizationUsers.Interfaces;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models.Business;
+using Bit.Core.Auth.Models.Business.Tokenables;
 using Bit.Core.Auth.Models.Data;
 using Bit.Core.Auth.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Exceptions;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
 using Bit.Core.Models.StaticStore;
 using Bit.Core.OrganizationFeatures.OrganizationSubscriptions.Interface;
-using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
 using Bit.Core.Test.AutoFixture.OrganizationFixtures;
 using Bit.Core.Test.AutoFixture.OrganizationUserFixtures;
 using Bit.Core.Test.AutoFixture.PolicyFixtures;
+using Bit.Core.Tokens;
 using Bit.Core.Tools.Enums;
 using Bit.Core.Tools.Models.Business;
 using Bit.Core.Tools.Services;
 using Bit.Core.Utilities;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
-using Microsoft.AspNetCore.DataProtection;
+using Bit.Test.Common.Fakes;
 using NSubstitute;
 using NSubstitute.ExceptionExtensions;
 using Xunit;
@@ -41,10 +44,16 @@ namespace Bit.Core.Test.Services;
 [SutProviderCustomize]
 public class OrganizationServiceTests
 {
+    private readonly IDataProtectorTokenFactory<OrgUserInviteTokenable> _orgUserInviteTokenDataFactory = new FakeDataProtectorTokenFactory<OrgUserInviteTokenable>();
+
     [Theory, PaidOrganizationCustomize, BitAutoData]
     public async Task OrgImportCreateNewUsers(SutProvider<OrganizationService> sutProvider, Guid userId,
         Organization org, List<OrganizationUserUserDetails> existingUsers, List<ImportedOrganizationUser> newUsers)
     {
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
         org.UseDirectory = true;
         org.Seats = 10;
         newUsers.Add(new ImportedOrganizationUser
@@ -65,6 +74,16 @@ public async Task OrgImportCreateNewUsers(SutProvider<OrganizationService> sutPr
             .Returns(existingUsers.Select(u => new OrganizationUser { Status = OrganizationUserStatusType.Confirmed, Type = OrganizationUserType.Owner, Id = u.Id }).ToList());
         sutProvider.GetDependency<ICurrentContext>().ManageUsers(org.Id).Returns(true);
 
+        // Mock tokenable factory to return a token that expires in 5 days
+        sutProvider.GetDependency<IOrgUserInviteTokenableFactory>()
+            .CreateToken(Arg.Any<OrganizationUser>())
+            .Returns(
+                info => new OrgUserInviteTokenable(info.Arg<OrganizationUser>())
+                {
+                    ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(5))
+                }
+            );
+
         await sutProvider.Sut.ImportAsync(org.Id, userId, null, newUsers, null, false);
 
         await sutProvider.GetDependency<IOrganizationUserRepository>().DidNotReceiveWithAnyArgs()
@@ -96,6 +115,10 @@ public async Task OrgImportCreateNewUsersAndMarryExistingUser(SutProvider<Organi
         Guid userId, Organization org, List<OrganizationUserUserDetails> existingUsers,
         List<ImportedOrganizationUser> newUsers)
     {
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
         org.UseDirectory = true;
         org.Seats = newUsers.Count + existingUsers.Count + 1;
         var reInvitedUser = existingUsers.First();
@@ -119,6 +142,16 @@ public async Task OrgImportCreateNewUsersAndMarryExistingUser(SutProvider<Organi
         var currentContext = sutProvider.GetDependency<ICurrentContext>();
         currentContext.ManageUsers(org.Id).Returns(true);
 
+        // Mock tokenable factory to return a token that expires in 5 days
+        sutProvider.GetDependency<IOrgUserInviteTokenableFactory>()
+            .CreateToken(Arg.Any<OrganizationUser>())
+            .Returns(
+                info => new OrgUserInviteTokenable(info.Arg<OrganizationUser>())
+                {
+                    ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(5))
+                }
+            );
+
         await sutProvider.Sut.ImportAsync(org.Id, userId, null, newUsers, null, false);
 
         await sutProvider.GetDependency<IOrganizationUserRepository>().DidNotReceiveWithAnyArgs()
@@ -348,6 +381,10 @@ public async Task InviteUser_DuplicateEmails_PassesWithoutDuplicates(Organizatio
                 [OrganizationUser(OrganizationUserStatusType.Confirmed, OrganizationUserType.Owner)] OrganizationUser owner,
         OrganizationUserInvite invite, SutProvider<OrganizationService> sutProvider)
     {
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
         invite.Emails = invite.Emails.Append(invite.Emails.First());
 
         sutProvider.GetDependency<IOrganizationRepository>().GetByIdAsync(organization.Id).Returns(organization);
@@ -357,6 +394,16 @@ public async Task InviteUser_DuplicateEmails_PassesWithoutDuplicates(Organizatio
         organizationUserRepository.GetManyByOrganizationAsync(organization.Id, OrganizationUserType.Owner)
             .Returns(new[] { owner });
 
+        // Mock tokenable factory to return a token that expires in 5 days
+        sutProvider.GetDependency<IOrgUserInviteTokenableFactory>()
+            .CreateToken(Arg.Any<OrganizationUser>())
+            .Returns(
+                info => new OrgUserInviteTokenable(info.Arg<OrganizationUser>())
+                {
+                    ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(5))
+                }
+                );
+
         await sutProvider.Sut.InviteUsersAsync(organization.Id, invitor.UserId, new (OrganizationUserInvite, string)[] { (invite, null) });
 
         await sutProvider.GetDependency<IMailService>().Received(1)
@@ -585,6 +632,10 @@ public async Task InviteUser_Passes(Organization organization, IEnumerable<(Orga
         [OrganizationUser(OrganizationUserStatusType.Confirmed, OrganizationUserType.Owner)] OrganizationUser owner,
         SutProvider<OrganizationService> sutProvider)
     {
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
         invitor.Permissions = JsonSerializer.Serialize(new Permissions() { ManageUsers = true },
             new JsonSerializerOptions
             {
@@ -620,6 +671,16 @@ public async Task InviteUser_Passes(Organization organization, IEnumerable<(Orga
                 }
             });
 
+        // Mock tokenable factory to return a token that expires in 5 days
+        sutProvider.GetDependency<IOrgUserInviteTokenableFactory>()
+            .CreateToken(Arg.Any<OrganizationUser>())
+            .Returns(
+                info => new OrgUserInviteTokenable(info.Arg<OrganizationUser>())
+                {
+                    ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(5))
+                }
+            );
+
         await sutProvider.Sut.InviteUsersAsync(organization.Id, invitor.UserId, invites);
 
         await sutProvider.GetDependency<IMailService>().Received(1)
@@ -639,6 +700,10 @@ public async Task InviteUser_WithEventSystemUser_Passes(Organization organizatio
         [OrganizationUser(OrganizationUserStatusType.Confirmed, OrganizationUserType.Owner)] OrganizationUser owner,
         SutProvider<OrganizationService> sutProvider)
     {
+        // Setup FakeDataProtectorTokenFactory for creating new tokens - this must come first in order to avoid resetting mocks
+        sutProvider.SetDependency(_orgUserInviteTokenDataFactory, "orgUserInviteTokenDataFactory");
+        sutProvider.Create();
+
         invitor.Permissions = JsonSerializer.Serialize(new Permissions() { ManageUsers = true },
             new JsonSerializerOptions
             {
@@ -654,6 +719,16 @@ public async Task InviteUser_WithEventSystemUser_Passes(Organization organizatio
             .Returns(new[] { owner });
         currentContext.ManageUsers(organization.Id).Returns(true);
 
+        // Mock tokenable factory to return a token that expires in 5 days
+        sutProvider.GetDependency<IOrgUserInviteTokenableFactory>()
+            .CreateToken(Arg.Any<OrganizationUser>())
+            .Returns(
+                info => new OrgUserInviteTokenable(info.Arg<OrganizationUser>())
+                {
+                    ExpirationDate = DateTime.UtcNow.Add(TimeSpan.FromDays(5))
+                }
+            );
+
         await sutProvider.Sut.InviteUsersAsync(organization.Id, eventSystemUser, invites);
 
         await sutProvider.GetDependency<IMailService>().Received(1)
@@ -1864,42 +1939,6 @@ public void ValidateSecretsManagerPlan_ValidPlan_NoExceptionThrown(
         sutProvider.Sut.ValidateSecretsManagerPlan(plan, signup);
     }
 
-    [Theory]
-    [EphemeralDataProtectionAutoData]
-    public async Task AcceptUserAsync_Success([OrganizationUser(OrganizationUserStatusType.Invited)] OrganizationUser organizationUser,
-        User user, SutProvider<OrganizationService> sutProvider)
-    {
-        var token = SetupAcceptUserAsyncTest(sutProvider, user, organizationUser);
-        var userService = Substitute.For<IUserService>();
-
-        await sutProvider.Sut.AcceptUserAsync(organizationUser.Id, user, token, userService);
-
-        await sutProvider.GetDependency<IOrganizationUserRepository>().Received(1).ReplaceAsync(
-            Arg.Is<OrganizationUser>(ou => ou.Id == organizationUser.Id && ou.Status == OrganizationUserStatusType.Accepted));
-        await sutProvider.GetDependency<IUserRepository>().Received(1).ReplaceAsync(
-            Arg.Is<User>(u => u.Id == user.Id && u.Email == user.Email && user.EmailVerified == true));
-    }
-
-    private string SetupAcceptUserAsyncTest(SutProvider<OrganizationService> sutProvider, User user,
-        OrganizationUser organizationUser)
-    {
-        user.Email = organizationUser.Email;
-        user.EmailVerified = false;
-
-        var dataProtector = sutProvider.GetDependency<IDataProtectionProvider>()
-            .CreateProtector("OrganizationServiceDataProtector");
-        // Token matching the format used in OrganizationService.InviteUserAsync
-        var token = dataProtector.Protect(
-            $"OrganizationUserInvite {organizationUser.Id} {organizationUser.Email} {CoreHelpers.ToEpocMilliseconds(DateTime.UtcNow)}");
-
-        sutProvider.GetDependency<IGlobalSettings>().OrganizationInviteExpirationHours.Returns(24);
-
-        sutProvider.GetDependency<IOrganizationUserRepository>().GetByIdAsync(organizationUser.Id)
-            .Returns(organizationUser);
-
-        return token;
-    }
-
     [Theory]
     [OrganizationInviteCustomize(
          InviteeUserType = OrganizationUserType.Owner,
diff --git a/test/Core.Test/Services/StripePaymentServiceTests.cs b/test/Core.Test/Services/StripePaymentServiceTests.cs
index 2133a14a9735..9ef4b0233c0d 100644
--- a/test/Core.Test/Services/StripePaymentServiceTests.cs
+++ b/test/Core.Test/Services/StripePaymentServiceTests.cs
@@ -739,4 +739,300 @@ public async void UpgradeFreeOrganizationAsync_SM_Success(SutProvider<StripePaym
 
         Assert.Null(result);
     }
+
+    [Theory, BitAutoData]
+    public async Task PreviewUpcomingInvoiceAndPayAsync_WithInAppPaymentMethod_ThrowsBadRequestException(SutProvider<StripePaymentService> sutProvider,
+        Organization subscriber, List<Stripe.InvoiceSubscriptionItemOptions> subItemOptions)
+    {
+        var stripeAdapter = sutProvider.GetDependency<IStripeAdapter>();
+        stripeAdapter.CustomerGetAsync(Arg.Any<string>(), Arg.Any<Stripe.CustomerGetOptions>())
+            .Returns(new Stripe.Customer { Metadata = new Dictionary<string, string> { { "appleReceipt", "dummyData" } } });
+
+        var ex = await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.PreviewUpcomingInvoiceAndPayAsync(subscriber, subItemOptions));
+        Assert.Equal("Cannot perform this action with in-app purchase payment method. Contact support.", ex.Message);
+    }
+
+    [Theory, BitAutoData]
+    public async void PreviewUpcomingInvoiceAndPayAsync_UpcomingInvoiceBelowThreshold_DoesNotInvoiceNow(SutProvider<StripePaymentService> sutProvider,
+        Organization subscriber, List<Stripe.InvoiceSubscriptionItemOptions> subItemOptions)
+    {
+        var prorateThreshold = 50000;
+        var invoiceAmountBelowThreshold = prorateThreshold - 100;
+        var customer = MockStripeCustomer(subscriber);
+        sutProvider.GetDependency<IStripeAdapter>().CustomerGetAsync(default, default).ReturnsForAnyArgs(customer);
+        var invoiceItem = MockInoviceItemList(subscriber, "planId", invoiceAmountBelowThreshold, customer);
+        sutProvider.GetDependency<IStripeAdapter>().InvoiceItemListAsync(new Stripe.InvoiceItemListOptions
+        {
+            Customer = subscriber.GatewayCustomerId
+        }).ReturnsForAnyArgs(invoiceItem);
+
+        var invoiceLineItem = CreateInvoiceLineTime(subscriber, "planId", invoiceAmountBelowThreshold);
+        sutProvider.GetDependency<IStripeAdapter>().InvoiceUpcomingAsync(new Stripe.UpcomingInvoiceOptions
+        {
+            Customer = subscriber.GatewayCustomerId,
+            Subscription = subscriber.GatewaySubscriptionId,
+            SubscriptionItems = subItemOptions
+        }).ReturnsForAnyArgs(invoiceLineItem);
+
+        sutProvider.GetDependency<IStripeAdapter>().InvoiceCreateAsync(Arg.Is<Stripe.InvoiceCreateOptions>(options =>
+            options.CollectionMethod == "send_invoice" &&
+            options.DaysUntilDue == 1 &&
+            options.Customer == subscriber.GatewayCustomerId &&
+            options.Subscription == subscriber.GatewaySubscriptionId &&
+            options.DefaultPaymentMethod == customer.InvoiceSettings.DefaultPaymentMethod.Id
+        )).ReturnsForAnyArgs(new Stripe.Invoice
+        {
+            Id = "mockInvoiceId",
+            CollectionMethod = "send_invoice",
+            DueDate = DateTime.Now.AddDays(1),
+            Customer = customer,
+            Subscription = new Stripe.Subscription
+            {
+                Id = "mockSubscriptionId",
+                Customer = customer,
+                Status = "active",
+                CurrentPeriodStart = DateTime.UtcNow,
+                CurrentPeriodEnd = DateTime.UtcNow.AddMonths(1),
+                CollectionMethod = "charge_automatically",
+            },
+            DefaultPaymentMethod = customer.InvoiceSettings.DefaultPaymentMethod,
+            AmountDue = invoiceAmountBelowThreshold,
+            Currency = "usd",
+            Status = "draft",
+        });
+
+        var result = await sutProvider.Sut.PreviewUpcomingInvoiceAndPayAsync(subscriber, new List<Stripe.InvoiceSubscriptionItemOptions>(), prorateThreshold);
+
+        Assert.False(result.IsInvoicedNow);
+        Assert.Null(result.PaymentIntentClientSecret);
+    }
+
+    [Theory, BitAutoData]
+    public async void PreviewUpcomingInvoiceAndPayAsync_NoPaymentMethod_ThrowsBadRequestException(SutProvider<StripePaymentService> sutProvider,
+       Organization subscriber, List<Stripe.InvoiceSubscriptionItemOptions> subItemOptions, string planId)
+    {
+        var prorateThreshold = 120000;
+        var invoiceAmountBelowThreshold = prorateThreshold;
+        var customer = new Stripe.Customer
+        {
+            Metadata = new Dictionary<string, string>(),
+            Id = subscriber.GatewayCustomerId,
+            DefaultSource = null,
+            InvoiceSettings = new Stripe.CustomerInvoiceSettings
+            {
+                DefaultPaymentMethod = null
+            }
+        };
+        sutProvider.GetDependency<IStripeAdapter>().CustomerGetAsync(default, default).ReturnsForAnyArgs(customer);
+        var invoiceItem = MockInoviceItemList(subscriber, planId, invoiceAmountBelowThreshold, customer);
+        sutProvider.GetDependency<IStripeAdapter>().InvoiceItemListAsync(new Stripe.InvoiceItemListOptions
+        {
+            Customer = subscriber.GatewayCustomerId
+        }).ReturnsForAnyArgs(invoiceItem);
+
+        var invoiceLineItem = CreateInvoiceLineTime(subscriber, planId, invoiceAmountBelowThreshold);
+        sutProvider.GetDependency<IStripeAdapter>().InvoiceUpcomingAsync(new Stripe.UpcomingInvoiceOptions
+        {
+            Customer = subscriber.GatewayCustomerId,
+            Subscription = subscriber.GatewaySubscriptionId,
+            SubscriptionItems = subItemOptions
+        }).ReturnsForAnyArgs(invoiceLineItem);
+
+        var ex = await Assert.ThrowsAsync<BadRequestException>(() => sutProvider.Sut.PreviewUpcomingInvoiceAndPayAsync(subscriber, subItemOptions));
+        Assert.Equal("No payment method is available.", ex.Message);
+    }
+
+    [Theory, BitAutoData]
+    public async void PreviewUpcomingInvoiceAndPayAsync_UpcomingInvoiceAboveThreshold_DoesInvoiceNow(SutProvider<StripePaymentService> sutProvider,
+        Organization subscriber, List<Stripe.InvoiceSubscriptionItemOptions> subItemOptions, string planId)
+    {
+        var prorateThreshold = 50000;
+        var invoiceAmountBelowThreshold = 100000;
+        var customer = MockStripeCustomer(subscriber);
+        sutProvider.GetDependency<IStripeAdapter>().CustomerGetAsync(default, default).ReturnsForAnyArgs(customer);
+        var invoiceItem = MockInoviceItemList(subscriber, planId, invoiceAmountBelowThreshold, customer);
+        sutProvider.GetDependency<IStripeAdapter>().InvoiceItemListAsync(new Stripe.InvoiceItemListOptions
+        {
+            Customer = subscriber.GatewayCustomerId
+        }).ReturnsForAnyArgs(invoiceItem);
+
+        var invoiceLineItem = CreateInvoiceLineTime(subscriber, planId, invoiceAmountBelowThreshold);
+        sutProvider.GetDependency<IStripeAdapter>().InvoiceUpcomingAsync(new Stripe.UpcomingInvoiceOptions
+        {
+            Customer = subscriber.GatewayCustomerId,
+            Subscription = subscriber.GatewaySubscriptionId,
+            SubscriptionItems = subItemOptions
+        }).ReturnsForAnyArgs(invoiceLineItem);
+
+        var invoice = MockInVoice(customer, invoiceAmountBelowThreshold);
+        sutProvider.GetDependency<IStripeAdapter>().InvoiceCreateAsync(Arg.Is<Stripe.InvoiceCreateOptions>(options =>
+            options.CollectionMethod == "send_invoice" &&
+            options.DaysUntilDue == 1 &&
+            options.Customer == subscriber.GatewayCustomerId &&
+            options.Subscription == subscriber.GatewaySubscriptionId &&
+            options.DefaultPaymentMethod == customer.InvoiceSettings.DefaultPaymentMethod.Id
+        )).ReturnsForAnyArgs(invoice);
+
+        var result = await sutProvider.Sut.PreviewUpcomingInvoiceAndPayAsync(subscriber, new List<Stripe.InvoiceSubscriptionItemOptions>(), prorateThreshold);
+
+        await sutProvider.GetDependency<IStripeAdapter>().Received(1).InvoicePayAsync(invoice.Id,
+            Arg.Is<Stripe.InvoicePayOptions>((options =>
+                options.OffSession == true
+                )));
+
+
+        Assert.True(result.IsInvoicedNow);
+        Assert.Null(result.PaymentIntentClientSecret);
+    }
+
+    private static Stripe.Invoice MockInVoice(Stripe.Customer customer, int invoiceAmountBelowThreshold) =>
+        new()
+        {
+            Id = "mockInvoiceId",
+            CollectionMethod = "send_invoice",
+            DueDate = DateTime.Now.AddDays(1),
+            Customer = customer,
+            Subscription = new Stripe.Subscription
+            {
+                Id = "mockSubscriptionId",
+                Customer = customer,
+                Status = "active",
+                CurrentPeriodStart = DateTime.UtcNow,
+                CurrentPeriodEnd = DateTime.UtcNow.AddMonths(1),
+                CollectionMethod = "charge_automatically",
+            },
+            DefaultPaymentMethod = customer.InvoiceSettings.DefaultPaymentMethod,
+            AmountDue = invoiceAmountBelowThreshold,
+            Currency = "usd",
+            Status = "draft",
+        };
+
+    private static List<Stripe.InvoiceItem> MockInoviceItemList(Organization subscriber, string planId, int invoiceAmountBelowThreshold, Stripe.Customer customer) =>
+        new()
+        {
+            new Stripe.InvoiceItem
+            {
+                Id = "ii_1234567890",
+                Amount = invoiceAmountBelowThreshold,
+                Currency = "usd",
+                CustomerId = subscriber.GatewayCustomerId,
+                Description = "Sample invoice item 1",
+                Date = DateTime.UtcNow,
+                Discountable = true,
+                InvoiceId = "548458365"
+            },
+            new Stripe.InvoiceItem
+            {
+                Id = "ii_0987654321",
+                Amount = invoiceAmountBelowThreshold,
+                Currency = "usd",
+                CustomerId =  customer.Id,
+                Description = "Sample invoice item 2",
+                Date = DateTime.UtcNow.AddDays(-5),
+                Discountable = false,
+                InvoiceId = null,
+                Proration = true,
+                Plan = new Stripe.Plan
+                {
+                    Id = planId,
+                    Amount = invoiceAmountBelowThreshold,
+                    Currency = "usd",
+                    Interval = "month",
+                    IntervalCount = 1,
+                },
+            }
+        };
+
+    private static Stripe.Customer MockStripeCustomer(Organization subscriber)
+    {
+        var customer = new Stripe.Customer
+        {
+            Metadata = new Dictionary<string, string>(),
+            Id = subscriber.GatewayCustomerId,
+            DefaultSource = new Stripe.Card
+            {
+                Id = "card_12345",
+                Last4 = "1234",
+                Brand = "Visa",
+                ExpYear = 2025,
+                ExpMonth = 12
+            },
+            InvoiceSettings = new Stripe.CustomerInvoiceSettings
+            {
+                DefaultPaymentMethod = new Stripe.PaymentMethod
+                {
+                    Id = "pm_12345",
+                    Type = "card",
+                    Card = new Stripe.PaymentMethodCard
+                    {
+                        Last4 = "1234",
+                        Brand = "Visa",
+                        ExpYear = 2025,
+                        ExpMonth = 12
+                    }
+                }
+            }
+        };
+        return customer;
+    }
+
+    private static Stripe.Invoice CreateInvoiceLineTime(Organization subscriber, string planId, int invoiceAmountBelowThreshold) =>
+        new()
+        {
+            AmountDue = invoiceAmountBelowThreshold,
+            AmountPaid = 0,
+            AmountRemaining = invoiceAmountBelowThreshold,
+            CustomerId = subscriber.GatewayCustomerId,
+            SubscriptionId = subscriber.GatewaySubscriptionId,
+            ApplicationFeeAmount = 0,
+            Currency = "usd",
+            Description = "Upcoming Invoice",
+            Discount = null,
+            DueDate = DateTime.UtcNow.AddDays(1),
+            EndingBalance = 0,
+            Number = "INV12345",
+            Paid = false,
+            PeriodStart = DateTime.UtcNow,
+            PeriodEnd = DateTime.UtcNow.AddMonths(1),
+            ReceiptNumber = null,
+            StartingBalance = 0,
+            Status = "draft",
+            Id = "ii_0987654321",
+            Total = invoiceAmountBelowThreshold,
+            Lines = new Stripe.StripeList<Stripe.InvoiceLineItem>
+            {
+                Data = new List<Stripe.InvoiceLineItem>
+                {
+                    new Stripe.InvoiceLineItem
+                    {
+                        Amount = invoiceAmountBelowThreshold,
+                        Currency = "usd",
+                        Description = "Sample line item",
+                        Id = "ii_0987654321",
+                        Livemode = false,
+                        Object = "line_item",
+                        Discountable = false,
+                        Period = new Stripe.InvoiceLineItemPeriod()
+                        {
+                            Start = DateTime.UtcNow,
+                            End = DateTime.UtcNow.AddMonths(1)
+                        },
+                        Plan = new Stripe.Plan
+                        {
+                            Id = planId,
+                            Amount = invoiceAmountBelowThreshold,
+                            Currency = "usd",
+                            Interval = "month",
+                            IntervalCount = 1,
+                        },
+                        Proration = true,
+                        Quantity = 1,
+                        Subscription = subscriber.GatewaySubscriptionId,
+                        SubscriptionItem = "si_12345",
+                        Type = "subscription",
+                        UnitAmountExcludingTax = invoiceAmountBelowThreshold,
+                    }
+                }
+            }
+        };
 }
diff --git a/test/Core.Test/Services/UserServiceTests.cs b/test/Core.Test/Services/UserServiceTests.cs
index 92de67a4e62e..cbedea4a7a71 100644
--- a/test/Core.Test/Services/UserServiceTests.cs
+++ b/test/Core.Test/Services/UserServiceTests.cs
@@ -1,17 +1,25 @@
 using System.Text.Json;
+using AutoFixture;
+using Bit.Core.AdminConsole.Repositories;
+using Bit.Core.Auth.Entities;
 using Bit.Core.Auth.Enums;
 using Bit.Core.Auth.Models;
+using Bit.Core.Auth.Models.Business.Tokenables;
+using Bit.Core.Auth.Repositories;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Models.Business;
 using Bit.Core.Models.Data.Organizations;
+using Bit.Core.OrganizationFeatures.OrganizationUsers.Interfaces;
 using Bit.Core.Repositories;
 using Bit.Core.Services;
 using Bit.Core.Settings;
+using Bit.Core.Tokens;
 using Bit.Core.Tools.Services;
 using Bit.Core.Vault.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
+using Bit.Test.Common.Fakes;
 using Bit.Test.Common.Helpers;
 using Fido2NetLib;
 using Microsoft.AspNetCore.DataProtection;
@@ -179,6 +187,21 @@ public async Task HasPremiumFromOrganization_Returns_True_If_Org_Eligible(SutPro
         Assert.True(await sutProvider.Sut.HasPremiumFromOrganization(user));
     }
 
+    [Theory, BitAutoData]
+    public async void CompleteWebAuthLoginRegistrationAsync_ExceedsExistingCredentialsLimit_ReturnsFalse(SutProvider<UserService> sutProvider, User user, CredentialCreateOptions options, AuthenticatorAttestationRawResponse response, Generator<WebAuthnCredential> credentialGenerator)
+    {
+        // Arrange
+        var existingCredentials = credentialGenerator.Take(5).ToList();
+        sutProvider.GetDependency<IWebAuthnCredentialRepository>().GetManyByUserIdAsync(user.Id).Returns(existingCredentials);
+
+        // Act
+        var result = await sutProvider.Sut.CompleteWebAuthLoginRegistrationAsync(user, "name", options, response);
+
+        // Assert
+        Assert.False(result);
+        sutProvider.GetDependency<IWebAuthnCredentialRepository>().DidNotReceive();
+    }
+
     [Flags]
     public enum ShouldCheck
     {
@@ -251,9 +274,13 @@ public async Task VerifySecretAsync_Works(
             sutProvider.GetDependency<IFido2>(),
             sutProvider.GetDependency<ICurrentContext>(),
             sutProvider.GetDependency<IGlobalSettings>(),
-            sutProvider.GetDependency<IOrganizationService>(),
+            sutProvider.GetDependency<IAcceptOrgUserCommand>(),
             sutProvider.GetDependency<IProviderUserRepository>(),
-            sutProvider.GetDependency<IStripeSyncService>());
+            sutProvider.GetDependency<IStripeSyncService>(),
+            new FakeDataProtectorTokenFactory<OrgUserInviteTokenable>(),
+            sutProvider.GetDependency<IWebAuthnCredentialRepository>(),
+            sutProvider.GetDependency<IDataProtectorTokenFactory<WebAuthnLoginTokenable>>()
+            );
 
         var actualIsVerified = await sut.VerifySecretAsync(user, secret);
 
diff --git a/test/Core.Test/Utilities/CoreHelpersTests.cs b/test/Core.Test/Utilities/CoreHelpersTests.cs
index 4def69404259..6534feef5519 100644
--- a/test/Core.Test/Utilities/CoreHelpersTests.cs
+++ b/test/Core.Test/Utilities/CoreHelpersTests.cs
@@ -1,9 +1,10 @@
 using System.Text;
 using AutoFixture;
+using Bit.Core.AdminConsole.Context;
+using Bit.Core.AdminConsole.Enums.Provider;
 using Bit.Core.Context;
 using Bit.Core.Entities;
 using Bit.Core.Enums;
-using Bit.Core.Enums.Provider;
 using Bit.Core.Test.AutoFixture.UserFixtures;
 using Bit.Core.Utilities;
 using Bit.Test.Common.AutoFixture;
diff --git a/test/Core.Test/Utilities/StaticStoreTests.cs b/test/Core.Test/Utilities/StaticStoreTests.cs
index 4e85928cc7d9..9abd31c8f832 100644
--- a/test/Core.Test/Utilities/StaticStoreTests.cs
+++ b/test/Core.Test/Utilities/StaticStoreTests.cs
@@ -10,10 +10,10 @@ public class StaticStoreTests
     [Fact]
     public void StaticStore_Initialization_Success()
     {
-        var plans = StaticStore.Plans;
+        var plans = StaticStore.Plans.ToList();
         Assert.NotNull(plans);
         Assert.NotEmpty(plans);
-        Assert.Equal(12, plans.Count());
+        Assert.Equal(16, plans.Count);
     }
 
     [Theory]
diff --git a/test/Core.Test/packages.lock.json b/test/Core.Test/packages.lock.json
index c814703a9188..e7ab5a43b60f 100644
--- a/test/Core.Test/packages.lock.json
+++ b/test/Core.Test/packages.lock.json
@@ -2673,7 +2673,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
diff --git a/test/Icons.Test/packages.lock.json b/test/Icons.Test/packages.lock.json
index 58a29e615a4c..ad10e6ecfd68 100644
--- a/test/Icons.Test/packages.lock.json
+++ b/test/Icons.Test/packages.lock.json
@@ -2842,7 +2842,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -2895,14 +2895,14 @@
         "type": "Project",
         "dependencies": {
           "AngleSharp": "[1.0.4, )",
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )"
         }
       },
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2910,7 +2910,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2922,9 +2922,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/test/Identity.IntegrationTest/packages.lock.json b/test/Identity.IntegrationTest/packages.lock.json
index 49e914b2d0f0..1a4247ec18bd 100644
--- a/test/Identity.IntegrationTest/packages.lock.json
+++ b/test/Identity.IntegrationTest/packages.lock.json
@@ -655,14 +655,6 @@
         "resolved": "7.0.5",
         "contentHash": "yMLM/aK1MikVqpjxd7PJ1Pjgztd3VAd26ZHxyjxG3RPeM9cHjvS5tCg9kAAayR6eHmBg0ffZsHdT28WfA5tTlA=="
       },
-      "Microsoft.EntityFrameworkCore.InMemory": {
-        "type": "Transitive",
-        "resolved": "7.0.5",
-        "contentHash": "y3S/A/0uJX7KOhppC3xqyta6Z0PRz0qPLngH5GFu4GZ7/+Sw2u/amf7MavvR5GfZjGabGcohMpsRSahMmpF9gA==",
-        "dependencies": {
-          "Microsoft.EntityFrameworkCore": "7.0.5"
-        }
-      },
       "Microsoft.EntityFrameworkCore.Relational": {
         "type": "Transitive",
         "resolved": "7.0.5",
@@ -2989,7 +2981,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -3041,15 +3033,15 @@
       "identity": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )",
           "Swashbuckle.AspNetCore.SwaggerGen": "[6.5.0, )"
         }
       },
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -3057,7 +3049,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -3069,19 +3061,18 @@
       "integrationtestcommon": {
         "type": "Project",
         "dependencies": {
-          "Common": "[2023.9.0, )",
-          "Identity": "[2023.9.0, )",
+          "Common": "[2023.10.1, )",
+          "Identity": "[2023.10.1, )",
           "Microsoft.AspNetCore.Mvc.Testing": "[6.0.5, )",
-          "Microsoft.EntityFrameworkCore.InMemory": "[7.0.5, )",
           "Microsoft.Extensions.Configuration": "[6.0.1, )"
         }
       },
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/test/Identity.Test/packages.lock.json b/test/Identity.Test/packages.lock.json
index 4d501fa090ab..2b2820ea74d7 100644
--- a/test/Identity.Test/packages.lock.json
+++ b/test/Identity.Test/packages.lock.json
@@ -2856,7 +2856,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -2908,15 +2908,15 @@
       "identity": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )",
           "Swashbuckle.AspNetCore.SwaggerGen": "[6.5.0, )"
         }
       },
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2924,7 +2924,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2936,9 +2936,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/test/Infrastructure.EFIntegration.Test/AutoFixture/EntityFrameworkRepositoryFixtures.cs b/test/Infrastructure.EFIntegration.Test/AutoFixture/EntityFrameworkRepositoryFixtures.cs
index fd14cde65bea..b610f51da2e6 100644
--- a/test/Infrastructure.EFIntegration.Test/AutoFixture/EntityFrameworkRepositoryFixtures.cs
+++ b/test/Infrastructure.EFIntegration.Test/AutoFixture/EntityFrameworkRepositoryFixtures.cs
@@ -4,6 +4,7 @@
 using AutoMapper;
 using Bit.Core.Settings;
 using Bit.Infrastructure.EFIntegration.Test.Helpers;
+using Bit.Infrastructure.EntityFramework.AdminConsole.Models.Provider;
 using Bit.Infrastructure.EntityFramework.Auth.Models;
 using Bit.Infrastructure.EntityFramework.Models;
 using Bit.Infrastructure.EntityFramework.Repositories;
diff --git a/test/Infrastructure.EFIntegration.Test/AutoFixture/PolicyFixtures.cs b/test/Infrastructure.EFIntegration.Test/AutoFixture/PolicyFixtures.cs
index 70cea3e01189..5ecd31f9c68c 100644
--- a/test/Infrastructure.EFIntegration.Test/AutoFixture/PolicyFixtures.cs
+++ b/test/Infrastructure.EFIntegration.Test/AutoFixture/PolicyFixtures.cs
@@ -1,6 +1,7 @@
 using AutoFixture;
 using AutoFixture.Kernel;
 using Bit.Core.Entities;
+using Bit.Infrastructure.EntityFramework.AdminConsole.Repositories;
 using Bit.Infrastructure.EntityFramework.Repositories;
 using Bit.Test.Common.AutoFixture;
 using Bit.Test.Common.AutoFixture.Attributes;
diff --git a/test/Infrastructure.EFIntegration.Test/Repositories/OrganizationUserRepositoryTests.cs b/test/Infrastructure.EFIntegration.Test/Repositories/OrganizationUserRepositoryTests.cs
index 4f3b912b6ec0..67b199b35ae3 100644
--- a/test/Infrastructure.EFIntegration.Test/Repositories/OrganizationUserRepositoryTests.cs
+++ b/test/Infrastructure.EFIntegration.Test/Repositories/OrganizationUserRepositoryTests.cs
@@ -1,6 +1,7 @@
 using System.Text.Json;
+using Bit.Core.AdminConsole.Entities.Provider;
+using Bit.Core.AdminConsole.Repositories;
 using Bit.Core.Entities;
-using Bit.Core.Entities.Provider;
 using Bit.Core.Enums;
 using Bit.Core.Models.Data;
 using Bit.Core.Models.Data.Organizations.OrganizationUsers;
@@ -9,6 +10,7 @@
 using Bit.Infrastructure.EFIntegration.Test.AutoFixture;
 using Bit.Infrastructure.EFIntegration.Test.Repositories.EqualityComparers;
 using Xunit;
+using EfAdminConsoleRepo = Bit.Infrastructure.EntityFramework.AdminConsole.Repositories;
 using EfRepo = Bit.Infrastructure.EntityFramework.Repositories;
 using OrganizationUser = Bit.Core.Entities.OrganizationUser;
 using SqlRepo = Bit.Infrastructure.Dapper.Repositories;
@@ -184,18 +186,18 @@ public async void GetByUserIdWithPolicyDetailsAsync_Works_DataMatches(
         List<EfRepo.UserRepository> efUserRepository,
         List<EfRepo.OrganizationRepository> efOrganizationRepository,
         List<EfRepo.OrganizationUserRepository> suts,
-        List<EfRepo.ProviderRepository> efProviderRepository,
-        List<EfRepo.ProviderOrganizationRepository> efProviderOrganizationRepository,
-        List<EfRepo.ProviderUserRepository> efProviderUserRepository,
+        List<EfAdminConsoleRepo.ProviderRepository> efProviderRepository,
+        List<EfAdminConsoleRepo.ProviderOrganizationRepository> efProviderOrganizationRepository,
+        List<EfAdminConsoleRepo.ProviderUserRepository> efProviderUserRepository,
 
         // Auto data - SQL repos
         SqlRepo.PolicyRepository sqlPolicyRepo,
         SqlRepo.UserRepository sqlUserRepo,
         SqlRepo.OrganizationRepository sqlOrganizationRepo,
-        SqlRepo.ProviderRepository sqlProviderRepo,
+        EfAdminConsoleRepo.ProviderRepository sqlProviderRepo,
         SqlRepo.OrganizationUserRepository sqlOrganizationUserRepo,
-        SqlRepo.ProviderOrganizationRepository sqlProviderOrganizationRepo,
-        SqlRepo.ProviderUserRepository sqlProviderUserRepo
+        EfAdminConsoleRepo.ProviderOrganizationRepository sqlProviderOrganizationRepo,
+        EfAdminConsoleRepo.ProviderUserRepository sqlProviderUserRepo
         )
     {
         // Combine EF and SQL repos into one list per type
diff --git a/test/Infrastructure.EFIntegration.Test/packages.lock.json b/test/Infrastructure.EFIntegration.Test/packages.lock.json
index ef30b1cb1a55..858754eb8f40 100644
--- a/test/Infrastructure.EFIntegration.Test/packages.lock.json
+++ b/test/Infrastructure.EFIntegration.Test/packages.lock.json
@@ -2836,7 +2836,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -2890,8 +2890,8 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Common": "[2023.9.0, )",
-          "Core": "[2023.9.0, )",
+          "Common": "[2023.10.1, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -2901,7 +2901,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2909,7 +2909,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
diff --git a/test/Infrastructure.IntegrationTest/packages.lock.json b/test/Infrastructure.IntegrationTest/packages.lock.json
index 9c69a541c8a3..ec0e0a499691 100644
--- a/test/Infrastructure.IntegrationTest/packages.lock.json
+++ b/test/Infrastructure.IntegrationTest/packages.lock.json
@@ -2746,7 +2746,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2754,7 +2754,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
diff --git a/test/IntegrationTestCommon/Factories/WebApplicationFactoryBase.cs b/test/IntegrationTestCommon/Factories/WebApplicationFactoryBase.cs
index 89a6041c3229..fe8e9c2f140b 100644
--- a/test/IntegrationTestCommon/Factories/WebApplicationFactoryBase.cs
+++ b/test/IntegrationTestCommon/Factories/WebApplicationFactoryBase.cs
@@ -7,6 +7,7 @@
 using Microsoft.AspNetCore.Hosting;
 using Microsoft.AspNetCore.Mvc.Testing;
 using Microsoft.AspNetCore.TestHost;
+using Microsoft.Data.Sqlite;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Configuration;
 using Microsoft.Extensions.DependencyInjection;
@@ -19,7 +20,6 @@ namespace Bit.IntegrationTestCommon.Factories;
 
 public static class FactoryConstants
 {
-    public const string DefaultDatabaseName = "test_database";
     public const string WhitelistedIp = "1.1.1.1";
 }
 
@@ -27,14 +27,16 @@ public abstract class WebApplicationFactoryBase<T> : WebApplicationFactory<T>
     where T : class
 {
     /// <summary>
-    /// The database name to use for this instance of the factory. By default it will use a shared database name so all instances will connect to the same database during it's lifetime.
+    /// The database to use for this instance of the factory. By default it will use a shared database so all instances will connect to the same database during it's lifetime.
     /// </summary>
     /// <remarks>
     /// This will need to be set BEFORE using the <c>Server</c> property
     /// </remarks>
-    public string DatabaseName { get; set; } = Guid.NewGuid().ToString();
+    public SqliteConnection SqliteConnection { get; set; }
 
     private readonly List<Action<IServiceCollection>> _configureTestServices = new();
+    private bool _handleSqliteDisposal { get; set; }
+
 
     public void SubstitueService<TService>(Action<TService> mockService)
         where TService : class
@@ -52,10 +54,17 @@ public void SubstitueService<TService>(Action<TService> mockService)
     }
 
     /// <summary>
-    /// Configure the web host to use an EF in memory database
+    /// Configure the web host to use a SQLite in memory database
     /// </summary>
     protected override void ConfigureWebHost(IWebHostBuilder builder)
     {
+        if (SqliteConnection == null)
+        {
+            SqliteConnection = new SqliteConnection("DataSource=:memory:");
+            SqliteConnection.Open();
+            _handleSqliteDisposal = true;
+        }
+
         builder.ConfigureAppConfiguration(c =>
         {
             c.SetBasePath(AppContext.BaseDirectory)
@@ -89,11 +98,13 @@ protected override void ConfigureWebHost(IWebHostBuilder builder)
             services.AddScoped(services =>
             {
                 return new DbContextOptionsBuilder<DatabaseContext>()
-                    .UseInMemoryDatabase(DatabaseName)
+                    .UseSqlite(SqliteConnection)
                     .UseApplicationServiceProvider(services)
                     .Options;
             });
 
+            MigrateDbContext<DatabaseContext>(services);
+
             // QUESTION: The normal licensing service should run fine on developer machines but not in CI
             // should we have a fork here to leave the normal service for developers?
             // TODO: Eventually add the license file to CI
@@ -182,4 +193,23 @@ public TS GetService<TS>()
         var scope = Services.CreateScope();
         return scope.ServiceProvider.GetRequiredService<TS>();
     }
+
+    protected override void Dispose(bool disposing)
+    {
+        base.Dispose(disposing);
+        if (_handleSqliteDisposal)
+        {
+            SqliteConnection.Dispose();
+        }
+    }
+
+    private static void MigrateDbContext<TContext>(IServiceCollection serviceCollection) where TContext : DbContext
+    {
+        var serviceProvider = serviceCollection.BuildServiceProvider();
+        using var scope = serviceProvider.CreateScope();
+        var services = scope.ServiceProvider;
+        var context = services.GetService<TContext>();
+        context.Database.EnsureDeleted();
+        context.Database.EnsureCreated();
+    }
 }
diff --git a/test/IntegrationTestCommon/IntegrationTestCommon.csproj b/test/IntegrationTestCommon/IntegrationTestCommon.csproj
index f8a2b236ad83..b4c12368201e 100644
--- a/test/IntegrationTestCommon/IntegrationTestCommon.csproj
+++ b/test/IntegrationTestCommon/IntegrationTestCommon.csproj
@@ -6,7 +6,6 @@
   
   <ItemGroup>
     <PackageReference Include="Microsoft.AspNetCore.Mvc.Testing" Version="6.0.5" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="7.0.5" />
     <PackageReference Include="Microsoft.Extensions.Configuration" Version="6.0.1" />
   </ItemGroup>
     
diff --git a/test/IntegrationTestCommon/packages.lock.json b/test/IntegrationTestCommon/packages.lock.json
index 6e1296d5c627..53320be61482 100644
--- a/test/IntegrationTestCommon/packages.lock.json
+++ b/test/IntegrationTestCommon/packages.lock.json
@@ -13,15 +13,6 @@
           "Microsoft.Extensions.Hosting": "6.0.1"
         }
       },
-      "Microsoft.EntityFrameworkCore.InMemory": {
-        "type": "Direct",
-        "requested": "[7.0.5, )",
-        "resolved": "7.0.5",
-        "contentHash": "y3S/A/0uJX7KOhppC3xqyta6Z0PRz0qPLngH5GFu4GZ7/+Sw2u/amf7MavvR5GfZjGabGcohMpsRSahMmpF9gA==",
-        "dependencies": {
-          "Microsoft.EntityFrameworkCore": "7.0.5"
-        }
-      },
       "Microsoft.Extensions.Configuration": {
         "type": "Direct",
         "requested": "[6.0.1, )",
@@ -2975,7 +2966,7 @@
         "dependencies": {
           "AutoFixture.AutoNSubstitute": "[4.17.0, )",
           "AutoFixture.Xunit2": "[4.17.0, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Kralizek.AutoFixture.Extensions.MockHttp": "[1.2.0, )",
           "Microsoft.NET.Test.Sdk": "[17.1.0, )",
           "NSubstitute": "[4.3.0, )",
@@ -3027,15 +3018,15 @@
       "identity": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )",
           "Swashbuckle.AspNetCore.SwaggerGen": "[6.5.0, )"
         }
       },
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -3043,7 +3034,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -3055,9 +3046,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/util/Migrator/DbScripts/2023-05-08-00_WebAuthnLoginCredentials.sql b/util/Migrator/DbScripts/2023-05-08-00_WebAuthnLoginCredentials.sql
new file mode 100644
index 000000000000..a88e085dc3db
--- /dev/null
+++ b/util/Migrator/DbScripts/2023-05-08-00_WebAuthnLoginCredentials.sql
@@ -0,0 +1,188 @@
+CREATE TABLE [dbo].[WebAuthnCredential] (
+    [Id]                    UNIQUEIDENTIFIER NOT NULL,
+    [UserId]                UNIQUEIDENTIFIER NOT NULL,
+    [Name]                  NVARCHAR (50)    NOT NULL,
+    [PublicKey]             VARCHAR (256)    NOT NULL,
+    [CredentialId]          VARCHAR (256)    NOT NULL,
+    [Counter]               INT              NOT NULL,
+    [Type]                  VARCHAR (20)     NULL,
+    [AaGuid]                UNIQUEIDENTIFIER NOT NULL,
+    [EncryptedUserKey]      VARCHAR (MAX)    NULL,
+    [EncryptedPrivateKey]   VARCHAR (MAX)    NULL,
+    [EncryptedPublicKey]    VARCHAR (MAX)    NULL,
+    [SupportsPrf]           BIT              NOT NULL,
+    [CreationDate]          DATETIME2 (7)    NOT NULL,
+    [RevisionDate]          DATETIME2 (7)    NOT NULL,
+    CONSTRAINT [PK_WebAuthnCredential] PRIMARY KEY CLUSTERED ([Id] ASC),
+    CONSTRAINT [FK_WebAuthnCredential_User] FOREIGN KEY ([UserId]) REFERENCES [dbo].[User] ([Id])
+);
+
+GO
+CREATE NONCLUSTERED INDEX [IX_WebAuthnCredential_UserId]
+    ON [dbo].[WebAuthnCredential]([UserId] ASC);
+
+GO
+CREATE VIEW [dbo].[WebAuthnCredentialView]
+AS
+SELECT
+    *
+FROM
+    [dbo].[WebAuthnCredential]
+
+GO
+CREATE PROCEDURE [dbo].[WebAuthnCredential_Create]
+    @Id UNIQUEIDENTIFIER OUTPUT,
+    @UserId UNIQUEIDENTIFIER,
+    @Name NVARCHAR(50),
+    @PublicKey VARCHAR (256),
+    @CredentialId VARCHAR(256),
+    @Counter INT,
+    @Type VARCHAR(20),
+    @AaGuid UNIQUEIDENTIFIER,
+    @EncryptedUserKey VARCHAR (MAX),
+    @EncryptedPrivateKey VARCHAR (MAX),
+    @EncryptedPublicKey VARCHAR (MAX),
+    @SupportsPrf BIT,
+    @CreationDate DATETIME2(7),
+    @RevisionDate DATETIME2(7)
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    INSERT INTO [dbo].[WebAuthnCredential]
+    (
+        [Id],
+        [UserId],
+        [Name],
+        [PublicKey],
+        [CredentialId],
+        [Counter],
+        [Type],
+        [AaGuid],
+        [EncryptedUserKey],
+        [EncryptedPrivateKey],
+        [EncryptedPublicKey],
+        [SupportsPrf],
+        [CreationDate],
+        [RevisionDate]
+    )
+    VALUES
+    (
+        @Id,
+        @UserId,
+        @Name,
+        @PublicKey,
+        @CredentialId,
+        @Counter,
+        @Type,
+        @AaGuid,
+        @EncryptedUserKey,
+        @EncryptedPrivateKey,
+        @EncryptedPublicKey,
+        @SupportsPrf,
+        @CreationDate,
+        @RevisionDate
+    )
+END
+
+GO
+CREATE PROCEDURE [dbo].[WebAuthnCredential_DeleteById]
+    @Id UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    DELETE
+    FROM
+        [dbo].[WebAuthnCredential]
+    WHERE
+        [Id] = @Id
+END
+
+GO
+CREATE PROCEDURE [dbo].[WebAuthnCredential_ReadById]
+    @Id UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        *
+    FROM
+        [dbo].[WebAuthnCredentialView]
+    WHERE
+        [Id] = @Id
+END
+
+GO
+CREATE PROCEDURE [dbo].[WebAuthnCredential_ReadByUserId]
+    @UserId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        *
+    FROM
+        [dbo].[WebAuthnCredentialView]
+    WHERE
+        [UserId] = @UserId
+END
+
+GO
+CREATE PROCEDURE [dbo].[WebAuthnCredential_Update]
+    @Id UNIQUEIDENTIFIER,
+    @UserId UNIQUEIDENTIFIER,
+    @Name NVARCHAR(50),
+    @PublicKey VARCHAR (256),
+    @CredentialId VARCHAR(256),
+    @Counter INT,
+    @Type VARCHAR(20),
+    @AaGuid UNIQUEIDENTIFIER,
+    @EncryptedUserKey VARCHAR (MAX),
+    @EncryptedPrivateKey VARCHAR (MAX),
+    @EncryptedPublicKey VARCHAR (MAX),
+    @SupportsPrf BIT,
+    @CreationDate DATETIME2(7),
+    @RevisionDate DATETIME2(7)
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    UPDATE
+        [dbo].[WebAuthnCredential]
+    SET
+        [UserId] = @UserId,
+        [Name] = @Name,
+        [PublicKey] = @PublicKey,
+        [CredentialId] = @CredentialId,
+        [Counter] = @Counter,
+        [Type] = @Type,
+        [AaGuid] = @AaGuid,
+        [EncryptedUserKey] = @EncryptedUserKey,
+        [EncryptedPrivateKey] = @EncryptedPrivateKey,
+        [EncryptedPublicKey] = @EncryptedPublicKey,
+        [SupportsPrf] = @SupportsPrf,
+        [CreationDate] = @CreationDate,
+        [RevisionDate] = @RevisionDate
+    WHERE
+        [Id] = @Id
+END
+
+GO
+CREATE PROCEDURE [dbo].[WebAuthnCredential_ReadByIdUserId]
+    @Id UNIQUEIDENTIFIER,
+    @UserId UNIQUEIDENTIFIER
+AS
+BEGIN
+    SET NOCOUNT ON
+
+    SELECT
+        *
+    FROM
+        [dbo].[WebAuthnCredentialView]
+    WHERE
+        [Id] = @Id
+    AND
+        [UserId] = @UserId
+END
diff --git a/util/Migrator/DbScripts/2023-09-11_01_2023-02-FutureMigration.sql b/util/Migrator/DbScripts/2023-09-11_01_2023-02-FutureMigration.sql
index e7336b555360..8af4087709f6 100644
--- a/util/Migrator/DbScripts/2023-09-11_01_2023-02-FutureMigration.sql
+++ b/util/Migrator/DbScripts/2023-09-11_01_2023-02-FutureMigration.sql
@@ -1,9 +1,3 @@
-IF TYPE_ID(N'[dbo].[OrganizationUserType]') IS NOT NULL
-BEGIN
-    DROP TYPE [dbo].[OrganizationUserType];
-END
-GO
-
 IF OBJECT_ID('[dbo].[OrganizationUser_CreateMany]') IS NOT NULL
 BEGIN
     DROP PROCEDURE [dbo].[OrganizationUser_CreateMany];
@@ -15,3 +9,9 @@ BEGIN
     DROP PROCEDURE [dbo].[OrganizationUser_UpdateMany];
 END
 GO
+
+IF TYPE_ID(N'[dbo].[OrganizationUserType]') IS NOT NULL
+BEGIN
+    DROP TYPE [dbo].[OrganizationUserType];
+END
+GO
diff --git a/util/Migrator/DbScripts/2023-10-13_00_2019TeamsPlanFeatureUpgrade.sql b/util/Migrator/DbScripts/2023-10-13_00_2019TeamsPlanFeatureUpgrade.sql
new file mode 100644
index 000000000000..683e7be531e3
--- /dev/null
+++ b/util/Migrator/DbScripts/2023-10-13_00_2019TeamsPlanFeatureUpgrade.sql
@@ -0,0 +1,21 @@
+BEGIN TRY
+    BEGIN TRANSACTION;
+
+    UPDATE
+        [dbo].[Organization]
+    SET
+        [Use2fa] = 1,
+        [UseApi] = 1,
+        [UseDirectory] = 1,
+        [UseEvents] = 1,
+        [UseGroups] = 1,
+        [UsersGetPremium] = 1
+    WHERE
+        [PlanType] IN (2, 3); -- Teams 2019
+
+    COMMIT TRANSACTION;
+END TRY
+BEGIN CATCH
+    ROLLBACK TRANSACTION;
+    THROW;
+END CATCH
diff --git a/util/Migrator/DbScripts/2023-10-13_01_2019EnterprisePlanFeatureUpgrade.sql b/util/Migrator/DbScripts/2023-10-13_01_2019EnterprisePlanFeatureUpgrade.sql
new file mode 100644
index 000000000000..94e58e89fa33
--- /dev/null
+++ b/util/Migrator/DbScripts/2023-10-13_01_2019EnterprisePlanFeatureUpgrade.sql
@@ -0,0 +1,19 @@
+BEGIN TRY
+    BEGIN TRANSACTION;
+
+    UPDATE
+        [dbo].[Organization]
+    SET
+        [UseSso] = 1,
+        [UseKeyConnector] = 1,
+        [UseScim] = 1,
+        [UseResetPassword] = 1
+    WHERE
+        [PlanType] IN (4, 5) -- Enterprise 2019
+
+    COMMIT TRANSACTION;
+END TRY
+BEGIN CATCH
+    ROLLBACK TRANSACTION;
+    THROW;
+END CATCH
diff --git a/util/Migrator/DbScripts/2023-10-13_02_2019FamilyPlanFeatureUpgrade.sql b/util/Migrator/DbScripts/2023-10-13_02_2019FamilyPlanFeatureUpgrade.sql
new file mode 100644
index 000000000000..357486acff78
--- /dev/null
+++ b/util/Migrator/DbScripts/2023-10-13_02_2019FamilyPlanFeatureUpgrade.sql
@@ -0,0 +1,16 @@
+BEGIN TRY
+    BEGIN TRANSACTION;
+
+    UPDATE
+        [dbo].[Organization]
+    SET
+        [UsersGetPremium] = 1
+    WHERE
+        [PlanType] = 1 -- Families 2019 Annual
+
+    COMMIT TRANSACTION;
+END TRY
+BEGIN CATCH
+    ROLLBACK TRANSACTION;
+    THROW;
+END CATCH
diff --git a/util/MsSqlMigratorUtility/packages.lock.json b/util/MsSqlMigratorUtility/packages.lock.json
index 7a1316c0f7fd..ed07358b3522 100644
--- a/util/MsSqlMigratorUtility/packages.lock.json
+++ b/util/MsSqlMigratorUtility/packages.lock.json
@@ -2709,7 +2709,7 @@
       "migrator": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.Extensions.Logging": "[6.0.0, )",
           "dbup-sqlserver": "[5.0.8, )"
         }
diff --git a/util/MySqlMigrations/packages.lock.json b/util/MySqlMigrations/packages.lock.json
index 8a6ee7dbd015..f57e95b2b7c9 100644
--- a/util/MySqlMigrations/packages.lock.json
+++ b/util/MySqlMigrations/packages.lock.json
@@ -2657,7 +2657,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
diff --git a/util/PostgresMigrations/packages.lock.json b/util/PostgresMigrations/packages.lock.json
index 8a6ee7dbd015..f57e95b2b7c9 100644
--- a/util/PostgresMigrations/packages.lock.json
+++ b/util/PostgresMigrations/packages.lock.json
@@ -2657,7 +2657,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
diff --git a/util/Setup/packages.lock.json b/util/Setup/packages.lock.json
index 75193a0ccfc4..fb1aeb0aab10 100644
--- a/util/Setup/packages.lock.json
+++ b/util/Setup/packages.lock.json
@@ -2677,7 +2677,7 @@
       "migrator": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.Extensions.Logging": "[6.0.0, )",
           "dbup-sqlserver": "[5.0.8, )"
         }
diff --git a/util/SqlServerEFScaffold/packages.lock.json b/util/SqlServerEFScaffold/packages.lock.json
index b3c52196cc4d..5a154ded3838 100644
--- a/util/SqlServerEFScaffold/packages.lock.json
+++ b/util/SqlServerEFScaffold/packages.lock.json
@@ -2801,25 +2801,25 @@
           "AspNetCore.HealthChecks.SqlServer": "[6.0.2, )",
           "AspNetCore.HealthChecks.Uris": "[6.0.3, )",
           "Azure.Messaging.EventGrid": "[4.10.0, )",
-          "Commercial.Core": "[2023.9.0, )",
-          "Commercial.Infrastructure.EntityFramework": "[2023.9.0, )",
-          "Core": "[2023.9.0, )",
-          "SharedWeb": "[2023.9.0, )",
+          "Commercial.Core": "[2023.10.1, )",
+          "Commercial.Infrastructure.EntityFramework": "[2023.10.1, )",
+          "Core": "[2023.10.1, )",
+          "SharedWeb": "[2023.10.1, )",
           "Swashbuckle.AspNetCore": "[6.5.0, )"
         }
       },
       "commercial.core": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )"
+          "Core": "[2023.10.1, )"
         }
       },
       "commercial.infrastructure.entityframework": {
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       },
       "core": {
@@ -2867,7 +2867,7 @@
       "infrastructure.dapper": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Dapper": "[2.0.123, )"
         }
       },
@@ -2875,7 +2875,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",
@@ -2887,9 +2887,9 @@
       "sharedweb": {
         "type": "Project",
         "dependencies": {
-          "Core": "[2023.9.0, )",
-          "Infrastructure.Dapper": "[2023.9.0, )",
-          "Infrastructure.EntityFramework": "[2023.9.0, )"
+          "Core": "[2023.10.1, )",
+          "Infrastructure.Dapper": "[2023.10.1, )",
+          "Infrastructure.EntityFramework": "[2023.10.1, )"
         }
       }
     }
diff --git a/util/SqliteMigrations/packages.lock.json b/util/SqliteMigrations/packages.lock.json
index 8a6ee7dbd015..f57e95b2b7c9 100644
--- a/util/SqliteMigrations/packages.lock.json
+++ b/util/SqliteMigrations/packages.lock.json
@@ -2657,7 +2657,7 @@
         "type": "Project",
         "dependencies": {
           "AutoMapper.Extensions.Microsoft.DependencyInjection": "[12.0.1, )",
-          "Core": "[2023.9.0, )",
+          "Core": "[2023.10.1, )",
           "Microsoft.EntityFrameworkCore.Relational": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.SqlServer": "[7.0.5, )",
           "Microsoft.EntityFrameworkCore.Sqlite": "[7.0.5, )",