We want to switch from using the "Database" type of authentication (along with Integrated Security) to the more secure "Custom" type. Is there any way to convert existing users from one to the other? (without losing the private vaults)
There is a possible, non-documented method you could use.
AS-IS-NOT-FULLY-TESTED
BACKUP your database before trying this. You might want to test on a staging environment first.
NOTE: this will not delete the integrated SQL Login for this user, you will need to do that manually via SSMS (SQL Server Management Studio)
USE [master] GO DROP LOGIN [yourdomain\username] GO
and
USE [your-database-name] GO DROP USER [yourdomain\username] GO
Stéfane Lavergne