Pre-deployment checklist

Before you deploy 1Password Enterprise Password Manager, use this checklist to plan your organization’s account configuration, user invitations, and 1Password app deployment.

Identify who can help recover accounts

By default, account owners and administrators can recover accounts when someone loses their Emergency Kit or forgets their account password. Make sure that at least two people can recover accounts so someone can always help if you or another team member loses access.

Add more owners or administrators, or give selected team members administrator privileges through the Recover Accounts custom group permission.

Confirm your region and sign-in address before you invite anyone

Your account’s region sets your billing currency and where your data is stored: the United States, Canada, or the European Union. Changing regions later is a manual process, so confirm that your account is in the right region before you invite your team.

Make sure your sign-in address (e.g. blue-mountains-it.1password.com) is one you plan to keep. You can change it later, but the change can disrupt sign-in for your team, especially if team members use Unlock with SSO.

Choose how to invite your team members

You can invite your team to use 1Password Enterprise Password Manager through automated provisioning or manual invitations.

Automated provisioning requires an identity provider (IdP), such as Microsoft Entra ID or Okta. After you connect 1Password to your IdP, automated provisioning keeps user accounts and groups in sync, so you don’t have to recreate them by hand. When you add team members to the appropriate group in your IdP, 1Password creates their accounts and sends email invitations.

Alternatively, send manual invitations from the 1Password admin dashboard. You can also share a sign-up link or invite people from your Slack workspace.

Decide how your team will unlock 1Password

Choose how team members will unlock 1Password Enterprise Password Manager: with an account password and Secret Key, or with Unlock with SSO.

With an account password and Secret Key, each team member secures their account with an account password they create and a 34-character Secret Key. Make sure team members know where to find their sign-in details, such as their Emergency Kit.

With Unlock with SSO, team members use their familiar single sign-on (SSO) credentials to unlock 1Password. When they sign in on a new device, they must enter a code sent to a device where they’re already signed in. Ask team members to sign in to 1Password on at least two devices to reduce the need for account recovery.

Optional: Set an account password policy

If team members secure their accounts with an account password and Secret Key, you can set an account password policy to enforce your organization’s length and complexity requirements.

Changing the policy later doesn’t prompt team members to update their account passwords, so set your requirements before you deploy.

Optional: Secure 1Password accounts with two-factor authentication

You can require team members to use two-factor authentication when they unlock 1Password with an account password and Secret Key. You can also choose which methods they can use, such as authenticator apps or hardware security keys.

Set policies for how your team saves, accesses, and shares data

Manage and review your policies for authentication, app usage, and more. You can also control whether team members can share information outside 1Password and how long shared item links remain active.

Decide how to install the 1Password apps

We recommend automatically deploying the 1Password desktop app and browser extension, for example via mobile device management (MDM). Alternatively, direct team members to download the 1Password desktop app and browser extension during setup.

Optional: Import existing data

Import data from previous password managers into 1Password. Then, customize your groups and shared vaults to match your organization’s sharing needs. Follow the principle of least privilege: give each person access to only what they need.