1Password at work

I am using 1password for work. I have multi vaults in multiple accounts.I work across many businesses and have user, admin accounts to manage across ad, m365, aws etc (yes sso would be better).   for locating the right account quickly it might be nice to be able to select tag for <company name> AND <type e.g. admin> AND then vendor like AWS or just company as required.I could create lots of tag pairs but that would be really messy.   e.g. companyA_admin_aws.   Views or multi select would be really useful!I know it might be a corner case for the user base though.ty

I am using 1password for work. I have multi vaults in multiple accounts.The sorting order appears to stay consistent between vaults/accounts. I'd like an option to have a per view (for the lack of a better term) sorting options. For example: I want my favorites sorted in title order as it's a select set and easy for me to locate what I need.  However when I go to a vault used by users I need to find most recent additions to take some actions, then I need to change sorting... then change it back when I return to favorites.Is there any way to improve this?thank you!

Hi everyone,I created a 1Password test account to try out the recovery process and make sure it would work reliably in a worst-case scenario.In this test account, I set up two-factor authentication and created a recovery code. After waiting a few days, I wanted to test whether the recovery process works as expected.I went to the 1Password login page in my browser and clicked the link indicating that I was having trouble signing in. I then entered my email address.In the email I received (“We’ve received your request for help with 1Password”) I clicked the “View my account” button. On the next page, my 1Password account was shown, and after selecting the account, I was able to enter my recovery code.However, the recovery process does not seem to work as expected. After entering the recovery code, I repeatedly receive the error message: “Something went wrong.”My recovery code is correct, and I have already waited a few days before testing it again, but I still keep getting the same error

── Environment ──- 1Password account: skedulo.1password.com- SCIM Bridge: self-hosted on AWS (us-west-2), v2.9.14, domain 1pass.itops.skl.io- Identity provider: Okta (Group Push)- Bridge Status page: all components "Connected"── Primary issue: GET /Groups pagination is broken (ongoing) ──The bridge appears to return a hugely inflated totalResults on GET /Groups, so Oktapaginates into absurd offsets continuously. From the bridge's own logs: - 2026-06-22: 32,172 GET /Groups requests, paginating startIndex=1 → 999,901(27,478 requests beyond startIndex 100,000).- 2026-06-23 (first ~7 hours): 11,638 GET /Groups requests, again paginatingstartIndex=1 → 999,901 (10,250 beyond 100,000).We have only a small number of groups, so the totalResults being reported is clearly wrong.On deep pages the backend errors out:- 2026-06-22T06:07:08Z — GET /Groups?startIndex=465001 → HTTP 500upstream: "GetAllSCIMGroupsFiltered failed to Account.GetProvisioningAccountDetails,Unknown: (502), An unknown erro

 I've tested many similar products, and 1Password's Hide Pages feature is by far the worst. Currently, it only allows specifying a single URL per entry. The most ridiculous part is that until today's update, there wasn't even a delete function—and even now, you can only delete all entries at once, with no option to remove individual ones. Why can't users exclude pages freely based on patterns, such as by domain or wildcard matching? I've noticed that users have been raising issues about this feature in the community every year. Why, after so many years, has 1Password managed to make such a fundamental feature so incredibly poor? Why?

Hi everyone,I'm looking for advice on automating the Business Watchtower report export, and if there's no current solution, I'd like this to serve as a feature request for the 1Password team.The use case: We run a recurring internal security awareness campaign where each employee receives a personalised report of their vault's Watchtower score. The data source is the Business Watchtower CSV export (the one available under Reports for owners/Security group members), which contains per-vault metrics:Vault · Vault Type · Total Items · Issues · Compromised Websites · Vulnerable Passwords · Reused Passwords · Weak Passwords · Unsecured Websites · Two-Factor Authentication · Expiring Items · Items In Wrong AccountThe problem: Right now the only way to get this file is a manual click in the web UI. We need this automated on a schedule.What I've already ruled out:Browser automation (Playwright/Puppeteer): Fragile — any UI change silently breaks the pipeline, and storing admin credent

When I click on the extension icon in the toolbar, it takes several seconds, and sometimes even minutes, for the extension panel to open. See here small clip where the panel takes 30 seconds to open: https://drive.google.com/file/d/1H7opDLsXEolSc5YNzUdBeYB-tLDLSE_W/view?usp=sharingThe delay is inconsistent: Sometimes the panel opens after about 10 seconds, other times it takes 30 seconds, and occasionally it can take more than a minute!I tried switching to a different Chrome profile and reinstalling Chrome. I also tested Chrome Beta channel, and the issue occurs there as well. It works fine on Firefox, Arc and Zen browsers. This only happens in Google Chrome. I'm using Mac OS. 

It would be nice to have a private section within an item record when sharing it with others.Currently, I share passwords via vaults within my company. For each server, I need to create two separate records:A private record — containing my own personal password, which is not meant to be seen by others.A shared record — containing credentials for other admins, such as service account passwords, keys, and database passwords.In my opinion, having to create two records for the same server is not ideal. It adds unnecessary overhead and makes things harder to manage.

Hi there,I am using https://play.google.com/store/apps/details?id=net.quetta.browser, which is also a Chromium browser. Autofill function works well, but passkeys are failed. "For security reasons, 1Password can not use this passkey. The associated URL for this passkey does not match the selected app".Version info:Quetta: 1.8.5(2815)1passwd: 8.12.8-23.BETA(81208023) 

Hello,We are evaluating 1Password Business for a large enterprise deployment and have a question regarding employees who may already be using personal 1Password accounts with their corporate email addresses.For example:An employee independently signs up for a personal 1Password account using their corporate email address (user@company.com)The company later deploys 1Password Business with SSO and SCIM provisioningOur primary concern is understanding what happens to the employee's personal account in this situation.Specifically:Can the employee keep their personal account?Can the employee change the email address on the personal account (for example, from user@company.com to a personal Gmail address) and continue using it independently?What happens when the same corporate email address is invited to a Business account?What happens if SCIM provisioning creates the same user?Does SSO enforcement affect the existing personal account?Are any personal vaults, items, or data automatically tran

Hello everyone,We are evaluating 1Password Business for a large enterprise deployment and would like to better understand recommended approaches for delegated administration and permission management.Our goal is to allow departments to manage their own credentials and membership without requiring central IT involvement for every change.Example:Finance System VaultFinance Manager Group = Full controlFinance Lead Group = Edit permissionsFinance Staff Group = Edit permissionsFinance Assistant Group = View-only permissionsQuestions:Is this a recommended design pattern in 1Password Business?Can department managers be delegated authority to manage group membership without granting broader administrative permissions?How do large organizations typically handle role-based access such as:Department ManagerTeam LeadStaffAssistantIf Microsoft Entra ID or Okta is used with SCIM, do most organizations manage these role memberships in the IdP and synchronize them to 1Password?Can permissions be diffe

I have a paid 1Password subscription on another computer other than this forum account.I have a feature request to fix a 1Password user-experience inconsistency:1. The Good Part first:First, let me introduce how I use 1password.  Sometimes I enter the master password, but I also have let it use my biometric (Touch ID).  Compare the bottom-right corner of these two screenshots:When using with MacBook open, Touch ID logo button shows:When using with MacBook closed (External Monitor), Touch ID logo button disappears:If I open/close MacBook, the bottom-right-corner button changes correctly when I open/close/open/close MacBook.  Good, you did it properly in use case #1. This is great, because I can often open MacBook, do the TouchID thing, and close MacBook.  I can even initiate by external keyboard (<TAB><TAB><ENTER> to select the TouchID dialog-button, before reaching my thumb over).  This is without needing to use a mouse or touchscreen, if

We're excited to share that 1Password Credential Broker is now in private beta! Credential Broker helps teams give CI/CD pipelines, machine workloads, and eventually AI agents access to the credentials they need, only when they need them. Instead of storing long-lived tokens in config files, environment variables, or pipelines, workloads can prove their identity at runtime, get the specific credential they’re approved to use, and lose that access when the job is done. The private beta starts with GitHub Actions. When a workflow runs, GitHub issues a signed identity token that confirms which repo, branch, and workflow is executing. 1Password Credential Broker checks that identity against a policy configured in 1Password, then delivers only the approved vault item for that job. That means teams can: Avoid storing long-lived service account tokens in pipelines Scope machine workload access to specific vault items Remove standing vault access from CI/CD jobs See audit events with att

I requested support about sharing vault items with my managed companies.  Support advised me it is not possible.  I would like to suggest it as a new enhancement to the MSP product.As an MSP, I have vault for each of my clients with all of their technical information.Many items in my MSP client vaults have passwords the client end users need day-to-day (WiFi, Printer Access, Door Codes, etc.).I would like to have the ability to SHARE specific Items in my MSP Vaults with specific users in my Managed Companies (or at least to a "shared Vault" in the Managed Company so the users can have access).This would eliminated the burdensome and error-prone process of updating 2 complete separate company vaults - and eliminate the high probability the overlapping data will be not maintained properly.  Manual duplication/sync is never a good idea.Specific items would have to have the ability to share (without expiration) to the client end user to specific end users in my "Managed

I come upon this more and more often...I have a shared vault where users A, B and C have access and I am the administrator/owner. I have another shared vault where users X, Y and Z have access and I am the administrator/owner.I have an item that I need to share with all 6 of these users. I currently have 2 choices and I don't like either of them:1/ Create a new shared folder where users A, B, C, X, Y and Z have access. This is fine in the cases of small teams. My situation however is a medium-sized business account with all of my clients in my umbrella/envelope account. Users A, B and C are not even aware of the existence of users X, Y and Z and may be uncomfortable sharing items with unknown users.2/ Duplicate my item and store one copy in each of the shared folders. I dislike this option even more as maintaining the integrity of both copies is risky; there is always the possibility that one copy gets modified and the other does not.Feature Request:I would like to be able to assign/as

Hey all,We've been using 1Password Business for a while now and generally love it, but we're running into a real pain point with how vaults work when you need to share credentials across different groups.Some context on our setup - we're a boutique digital agency, so we deal with:Internal team members (some stuff shared with everyone, some only within departments)Contractors who should only see specific items they needClients whom we invite as guests to collaborate on their project credentialsThe problem is that 1Password doesn't let you share a single item across multiple vaults. So if a hosting login needs to be accessible to the internal dev team, a contractor working on that project, AND the client - we end up duplicating that item into 3 separate vaults. Now multiply that across a bunch of clients and credentials and it gets messy fast.The worst part is when someone logs in and gets prompted to change a password. They update it in their vault, but the copies in the

1 Password for EnterpriseSSO Method EntraHosted SCIMManaged GroupWhen I add a new user to a group to automatically onboard them now, when the user gets to the email verification step, that user gets "An Unknown Error Occurred" "Contact your account administrator for help.".  below that in the response is "Error(SecureChannelCreateSession(Fetch)) \r\n at /builds/dev/cc/confidential-computing/crates/internal/cc-secure-channel-client/src/lib.rs:445"This did not happen with the first user to onboard through this group, but it has happened with all others. After 48 hours I was able to re-invite one of the users and push them through, but I want to know how to avoid this in the future. 

There are situations where paste is unavailable. I run into it often with virtual consoles and remote keyboard/monitor/mouse adapters. The interface doesn't support copy/paste into or out of the UI.  I understand the lack of copy, often the UI is a graphical representation of a screen and not actual text.  But the lack of paste causes issues, especially with complex passwords and short timeouts.Would it be possible for 1Password to pretend to be a human interface device, or just perform an text entry on behalf of the user? Something like "type the password for me in 10 seconds" or "in 5 second types the username, enter, the password, and enter" long enough so I can change windows and then let 1Password type for me? 

Now that the interface to edit/set keyboard shortcuts has been removed from 1Password running under Wayland, It would be preferable if the installation package made the shortcuts available to configure by default, rather than https://support.1password.com/keyboard-shortcuts/?linux#wayland. I wrote about this before under a blog of post yours, but it was ignored.It's trivial to add Desktop Action sections to your existing launcher file, and reference them in an Actions= directive:[Desktop Entry] Name=1Password Exec=/opt/1Password/1password %U Terminal=false Type=Application Icon=1password StartupWMClass=1Password Comment=Password manager and secure wallet MimeType=x-scheme-handler/onepassword;x-scheme-handler/onepassword8; Categories=Office; Actions=Show;QuickAccess;Lock;Fill; [Desktop Action Show] Name=Show 1Password Icon=window-symbolic Exec=1password --show [Desktop Action QuickAccess] Name=Show Quick Access Icon=search-symbolic Exec=1password --quick-access [Desktop Action Lock]

I still cannot figure out how 1Password determines which login to show in the login fields.I have quite a number of similar websites I need to login to which all have a little distinction. When I want to login to a site I see a number of possible logins, but often the’re not close to what should represent the actual login.

I'm using the date field (new) and the alert expiration. But there is no view or report to list by this fields. and no pop up or something to have visibility of alerts. That means I have to go one by one entry to see that field. My question is if there is a expiration or alert report and how to access this?

Why does 1Password ask me to save or update a login when it just filled in that login?

I understand the Employee vault is private by design. However, when onboarding new employees it would be extremely convenient for a 1Password admin to create entries in the new employee's private vault.  This would be used to provide initial login/password information for the employee's various accounts.  Being able to create such entries would make the process much simpler and eliminate the need to use other out-of-band methods to communicate login info securely.

Hi All,We are sharing 1Password items using department vaults, together with a lot of different colleagues in our corporate environment. We would like to see who has added (or modified) a specific record. Currently, the Added on and Last edited date are shown, but this does not reveal the user that has performed this action. Preferred feature in red below: This would help a lot tracing the items owners in our corporate vaults, thanks! 

I opened a support case for this and was told to disable auto sign in to fix this, but that is kind of a "make everything sub-optimal to fix one issue" sort of thing.The site sync.com recently "improved" their website, in that they now have a deep captcha check that takes several seconds to complete, however they put it on both their main login page and their MFA page.  So I can wait for the captcha to come ready, check it, then use 1Password to fill my user name and password. On the next page it asks for the MFA code, the browser extension properly recognizes it, fills in the MFA code and tries to sign in, but there's another captcha on that page which doesn't get completed so, in another great "improvement" kicks me completely out of the login flow back to the inital page with a "blocked by CloudFlare" error.The only way to use 1Password with sync.com right now is to either drag and drop the credentials in and not use autofill at all or disable auto sign in globally to allow thi