Folks are going to have strong opinions here about things, so I'll try to stick to my personal experience. I adopted 1Password at my current organization. Overall, I've been very satisfied with it. Here are the major points I've noticed:
* Great authenticator support. We have some accounts that our team members have to share, and we want MFA on those accounts. I can add an MFA field to 1Password entry and the people who have access to that entry can use it. Doesn't help when those entries require phone/e-mail based MFA; I'm working on a little Twilio / outlook group setup to take care of that.
* Easy to navigate group membership. Passwords are stored in vaults and individuals or groups can be given access to those vaults. The model for it fits in my head and I like that.
* Easy share ability. There are a few credentials that I occasionally need to share outside of a vault. I can create a link and grant access to specific individuals for a given amount of time.
* The browser extension and integration have been really smooth in my opinion.
* I find tagging and taxonomies of tags to be helpful, and 1Password supports those well.
* We've gotten some great mileage out of 1Password connect. Some of our infrastructure secrets now reside directly in 1Password, and 1PW connect pushes them into our k8s environment as secrets where our apps can refer to them. Makes secret management across environments that much easier.
* SCIM support (which I haven't yet implemented) and SSO support to bring more convenience for end-users.
* Easy ability to recover if an employee forgets their master PW (have done this a handful of times).
* A nice perk: our 1PW business comes with a free 1PW personal subscription for people, completely separate. If the employee leaves they have can convert their personal vault to a paid subscription or export it.
To answer your questions specifically based on my current context:
> What are the recommended ways to store and give access to passwords?
1Password vaults. One vault per style of responsibility. 1+ groups have access to a vault. People get put into 1+ groups.
> How can a new hire be given access to all required passwords day 1?
In our case, day 1 they accept the 1PW invite in their inbox, and then we assign them to groups. Done.
> And when such new hire gets promoted, how can we give access to the additional passwords they will need?
Keep those "tiers" of passwords in separate vaults. Update the groups when someone's role changes.
> And if someone leaves the company, how can we change only the sensible passwords they had access to and preferably notify everyone with access to it that it was changed?
See what groups that person is in and what vaults they had access to. Review "high priority" items which you've tagged in such a way as to surface them. Send an e-mail to the members of the vault telling them you're rotating passwords. Rotate the passwords. Anyone who's a vault member can see the password history too, I believe, so if something goes wrong the old password will still be available.