Enforce biometric sign-in

Question

Hi,

We currently have 1Password deployed to our business, using ADMX in Intune for all our Windows devices.

Our 1Password tenant contains shared vaults and user vaults, and entries that are registered with passkeys and/or OTP tokens.

Overall, it is working as expected and without issues.

However, due to the nature of shared vaults and intrinsic credentials required to be stored in 1Password, the point of access comes down to a password.

If a privileged user has their device and password compromised, a bad actor could potentially gain access to highly sensitive credentials.

To mitigate this, I would like request being able to make biometric login (WHfB) a mandatory sign-in option.

This would not have to remove the inherent need for a password to create/activating a user, as an admin could require setting a specific, strong password that does not have to memorised.

In essence, the feature request would be:

Be able to use the ADMX template to enforce the use of Windows Hello for Business to unlock 1Password.

Thanks for your consideration!

Best regards,

Niklas

1P_Dave · Answer

Hello ​@NiklasL! 👋Thank you for the post. When employees unlock 1Password with an account password, that password is the secret used to decrypt the data in their 1Password account. Biometric unlock is a convenience feature that stores an equivalent secret securely on the device, such as in a Windows PC’s TPM, allowing users to unlock 1Password without entering their account password each time.For accounts unlocked with an account password, biometric unlock cannot be guaranteed to remain available. Windows Hello may become unavailable under certain conditions, leaving the account password as the only way to unlock 1Password: Use Windows Hello to unlock 1Password on your Windows PC.Even if the app required biometric unlock, the 1Password desktop app caches encrypted data locally. An attacker who obtained both that cache and the account password could decrypt the cached data manually without using the app which means that any policies wouldn’t be enforced. Requiring biometric unlock would therefore create the appearance of stronger security without providing a meaningful security benefit.That being said, there are a few different options to consider:Switch your employees over to SSO-unlock for 1Password:Switch to 1Password Unlock with SSOWhen using SSO-unlock, your employees will no longer use a password to unlock 1Password and your identity provider may provide other options to enforce certain conditions when unlocking.Keep an eye on our passkey-unlock beta:Unlock 1Password with a passkey (beta)While this project is currently on hold, it may be possible to unlock 1Password using a passkey in the future (secured with biometrics) rather than using an account password.Let me know if you have any questions.-Dave

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO