Prepare your team for Unlock with SSO
Before you set up Unlock with SSO, learn how team members sign in to 1Password on a new device, because it works differently from their first device. Keep this in mind as you plan your deployment, especially if your organization limits which devices team members can use 1Password on.
How team members sign in on a new device
Your identity provider (IdP) confirms who a team member is. But to decrypt their 1Password data, an app or browser also needs a credential bundle, which only their linked apps and browsers hold.
The app or browser a team member uses to set up their account becomes their first linked one. To sign in anywhere new, they enter a verification code from one that's already linked. 1Password then securely transfers the credential bundle to the new app or browser, which encrypts it with its own device key.
So every team member needs two things to sign in on a new device: their IdP credentials and an existing linked app or browser. Linking is how Unlock with SSO keeps 1Password end-to-end encrypted. It isn't a form of multi-factor authentication, and it doesn't replace your device management tools.
Read more about linking in Unlock with SSO: under the hood.
Plan for new and replacement devices
A team member who loses access to every linked app and browser can't link a new one, and needs account recovery instead. The most common cause is a team member who uses 1Password on a single device and then replaces it.
To avoid that, ask team members to link 1Password on at least two devices, if your policies allow it. If your organization doesn't allow 1Password on mobile devices, decide now what each team member's second device will be.
Virtual desktop infrastructure (VDI) needs the same planning. Team members need a linked app or browser to approve 1Password in a virtual desktop, so confirm how this works in your environment before rollout.
Other things to know
- Unlock with SSO needs an internet connection to sign in. If team members turn on biometric unlock, they get a period of offline access on a compatible device.
- Members of the Owners group don't unlock with SSO, so they keep access to 1Password if the integration needs maintenance.
- To roll out SSO to everyone, select Everyone except guests. You can still set up groups, and new team members get an SSO invitation instead of an Emergency Kit invitation.
- Review the full list of considerations for Unlock with SSO.
If your team already signs in with an account password and Secret Key:
For step-by-step instructions, read how to set up Unlock with SSO.
| You're almost ready to deploy! The next chapter recaps the key decisions to make before you onboard your team. |