1Password Business Enterprise Implementation Guide

Overview

1Password Business is an enterprise credential and secrets management platform designed to reduce password reuse, improve secure sharing, and centralize access governance for employees, contractors, and technical teams. Enterprises use it to manage user vaults, shared vaults, developer secrets, and administrative policies while integrating with identity providers such as Microsoft Entra ID, Okta, and Google Workspace.

Its core purpose is to protect credentials and sensitive data with end-to-end encryption while giving security teams centralized visibility and lifecycle control. In practice, organizations adopt 1Password Business to support least privilege, streamline onboarding and offboarding, reduce shadow IT credential storage, and improve audit readiness.

Architecture

1Password Business uses a SaaS control plane with clients on desktop, mobile, browser, and CLI. The main components are:

• Business account: top-level tenant for policies, billing, reporting, and integrations
• Vaults: logical containers for credentials, notes, API keys, and documents
• Groups: role-based access assignments to vaults and administrative capabilities
• 1Password apps and browser extension: end-user access and autofill
• 1Password CLI (op): automation, secrets retrieval, and scripting
• SCIM/SSO integration: identity lifecycle and federated authentication

Data flow is straightforward: a user authenticates to the 1Password account, decrypts vault metadata and items locally, and accesses only the vaults permitted by group membership. For automation, the CLI authenticates with a service account or user session, retrieves secrets from a vault, and injects them into local environment variables or CI jobs.

Deployment is SaaS-only for the management plane, but operational use spans endpoints, browsers, mobile devices, and CI/CD runners. Enterprises typically combine SSO for workforce access, SCIM for provisioning, and the CLI for developer workflows.

Implementation Guide

1. Create the 1Password Business tenant and verify the company domain.
2. Configure SSO with your identity provider and enforce MFA in the IdP.
3. Create groups such as IT-Admins, Developers, Finance, and Contractors.
4. Create vaults aligned to data sensitivity and ownership, for example Shared-IT, Prod-Secrets, and Finance-Restricted.
5. Assign vault permissions by group, avoiding direct user-to-vault grants where possible.
6. Install the CLI on admin and automation hosts.

brew install 1password-cli
op --version
op account add --address mycompany.1password.com --email admin@mycompany.com
op signin mycompany.1password.com

1. Create a service account for automation and scope it to a dedicated vault.

export OP_SERVICE_ACCOUNT_TOKEN="ops_xxxxxxxxxxxxxxxxx"
op whoami
op vault list

1. Store secrets and retrieve them securely.

op item create --category=password --title="prod-db" --vault="Prod-Secrets" username=appuser password='S3cure!Passw0rd' host=db01.internal
op item get "prod-db" --vault="Prod-Secrets" --format json

1. Use op run to inject secrets into processes.

export OP_SERVICE_ACCOUNT_TOKEN="ops_xxxxxxxxxxxxxxxxx"
op run --env-file=.env.tpl -- python app.py

Example .env.tpl:

DB_USER=op://Prod-Secrets/prod-db/username
DB_PASS=op://Prod-Secrets/prod-db/password
DB_HOST=op://Prod-Secrets/prod-db/host

1. Enable provisioning and deprovisioning through SCIM from Entra ID or Okta, then validate that suspended users lose access quickly.

Code Examples

Example 1: Bash secret injection for a deployment script

#!/usr/bin/env bash
set -euo pipefail
export OP_SERVICE_ACCOUNT_TOKEN="${OP_SERVICE_ACCOUNT_TOKEN}"
DB_URL=$(op read "op://Prod-Secrets/postgres/url")
API_KEY=$(op read "op://Prod-Secrets/payments/api_key")
./deploy --db-url "$DB_URL" --payments-key "$API_KEY"

Example 2: Kubernetes External Secrets style mapping with 1Password Connect-compatible workflow

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: onepassword-store
    kind: ClusterSecretStore
  target:
    name: app-secrets
  data:
    - secretKey: db-password
      remoteRef:
        key: Prod-Secrets
        property: prod-db.password

Example 3: Python retrieval using CLI subprocess isolation

import json
import subprocess
result = subprocess.run(["op", "item", "get", "prod-db", "--vault", "Prod-Secrets", "--format", "json"], capture_output=True, text=True, check=True)
item = json.loads(result.stdout)
fields = {f.get("label"): f.get("value") for f in item.get("fields", [])}
print(fields.get("username"))

Security Hardening

• Enforce SSO + MFA at the identity provider and disable unmanaged recovery paths where policy allows.
• Use group-based vault access and review permissions quarterly.
• Separate human and machine access; use service accounts only for automation.
• Restrict highly sensitive vaults to small groups and require device compliance for access.
• Rotate credentials stored in shared vaults and replace static secrets with short-lived credentials when possible.
• Monitor sign-in activity, vault access patterns, and provisioning changes through audit logs.
• Do not export vault contents to unmanaged endpoints; prefer op read and op run over local plaintext files.

Comparison

Troubleshooting

Error 1: CLI not signed in

Log sample:

[ERROR] 2025/02/18 09:14:22 not signed in
[ERROR] op: You are not currently signed in. Run 'op signin'.

Fix: authenticate with op signin for user sessions or set OP_SERVICE_ACCOUNT_TOKEN for automation.

Error 2: Vault permission denied

Log sample:

[ERROR] 2025/02/18 10:02:11 item get failed
[ERROR] op: You aren't authorized to access vault Prod-Secrets

Fix: verify group membership, vault ACLs, and service account scope. Avoid assuming admin users inherit vault read permissions automatically.

Error 3: Secret reference not resolved

Log sample:

[ERROR] failed to load env file .env.tpl
[ERROR] could not resolve secret reference: op://Prod-Secrets/prod-db/password

Fix: confirm item title, field label, and vault name exactly match the reference. Test with op read 'op://Prod-Secrets/prod-db/password'.

Best Practices

Do

• Use separate vaults for production, non-production, and business functions.
• Map groups to job roles, for example DBA-Prod with access only to production database credentials.
• Use service accounts for CI/CD and store tokens in the platform secret store with rotation procedures.
• Review suspended users and SCIM deprovisioning events weekly.

Don't

• Do not place all company secrets in a single shared vault.
• Do not hardcode OP_SERVICE_ACCOUNT_TOKEN in scripts or repositories.
• Do not grant broad vault access directly to individuals except for break-glass cases.
• Do not use 1Password as the only control for privileged access; pair it with PAM, logging, and approval workflows for high-risk systems.