Automated provisioning and Unlock with SSO

You can integrate 1Password with an identity provider (IdP) to automate user provisioning through SCIM and let team members unlock 1Password with single sign-on (SSO).

Before you deploy 1Password, understand how these integrations work so you can decide whether they suit your organization and explain to team members how they’ll access 1Password each day.

How automated provisioning and Unlock with SSO differ

Unlock with SSO and automated provisioning are related but distinct capabilities in 1Password Enterprise Password Manager. You can use either one, both, or neither.

Here’s the difference:

• Unlock with SSO handles authentication. It checks that a team member has an account in your IdP, then lets them unlock 1Password with their SSO credentials.
• Automated provisioning syncs 1Password with your IdP, so you can invite team members and manage their accounts and groups from there.

Unlock with SSO

Many organizations use SSO to secure access to their applications. SSO simplifies sign-in for employees and can strengthen your organization’s overall security. 

Unlock with SSO brings the same benefits to 1Password. Team members unlock 1Password with their IdP credentials, which simplifies account access for them and security administration for you.

Because team members will use their IdP accounts to access 1Password, their IdP password is the only work password they need to remember. Ask them to make it strong, randomly generated, and memorable.

They can create one with our online password generator by choosing the memorable password option, even before they have a 1Password account. After they set up 1Password, they can also generate one in the app by selecting Memorable in the password generator options.

Automated provisioning

Automated provisioning mirrors your existing organizational structure from your IdP to 1Password. It provides several benefits:

• Invite and manage people from your IdP: Assign someone to 1Password in your IdP to invite them. After that, any changes to their account sync to 1Password automatically. That saves time when you onboard new hires, handle role changes, or offboard team members.
• Consistent organization: If your IdP has a group called Engineering, automated provisioning can create the same group in 1Password. That makes it easier to keep track of groups and give each one the vault access its members need.
• Fewer configuration errors and security gaps: You avoid the errors and security gaps that come with configuring accounts by hand, such as a former team member who keeps access because no one removed their account.