How to Configure SSO Integration with 1Password Business

Single Sign-On (SSO) integration allows your team members to unlock 1Password using their existing corporate credentials instead of managing a separate 1Password account password. This guide covers configuring Unlock with SSO for 1Password Business with popular identity providers.

Prerequisites

Before you begin, ensure you have:

• 1Password Business subscription (SSO is not available on Teams plans)
• Owner or administrator access to your 1Password Business account
• Administrator access to your identity provider (Okta, Azure AD, etc.)
• Team members using 1Password 8 (SSO doesn't work with 1Password 7)
• Understanding of OIDC (OpenID Connect) protocol basics

Understanding Unlock with SSO

How It Works

1Password's Unlock with SSO uses the OpenID Connect (OIDC) protocol with:

• Authorization Code Flow with PKCE (Proof Key for Code Exchange)
• No client secrets stored in 1Password
• Secure token exchange between identity provider and 1Password

Important Limitations

Limitation	Details
Owners cannot use SSO	Security measure to prevent lockout
Requires internet	Offline access via biometrics only
1Password 8 required	Earlier versions not supported
OIDC only (currently)	SAML support planned
No automated provisioning	Use SCIM separately for user management

Step 1: Prepare Your 1Password Account

Verify Account Requirements

1. Sign in to 1Password.com as an owner
2. Navigate to Settings > Sign-in & Security
3. Verify your subscription includes SSO
4. Note your 1Password sign-in address (e.g., yourcompany.1password.com)

Plan Your Rollout

Before enabling SSO:

1. Identify a pilot group for testing
2. Communicate the change to team members
3. Prepare documentation for the new sign-in process
4. Ensure IT support is ready to help with issues

Step 2: Configure Your Identity Provider

Configure SSO with Okta

Create the Application in Okta

1. Sign in to Okta Admin Console at admin.okta.com
2. Navigate to Applications > Applications
3. Click Create App Integration
4. Select OIDC - OpenID Connect as the sign-in method
5. Select Native Application as the application type
6. Click Next

Configure Application Settings

1. App integration name: Enter "1Password" or similar
2. Grant type: Select Authorization Code
3. Sign-in redirect URIs: Add both:
   • https://YOUR_DOMAIN.1password.com/sso/oidc/redirect
   • onepassword://sso/oidc/redirect
4. Sign-out redirect URIs: Leave empty
5. Controlled access: Select who can access the application
6. Click Save

Configure Client Credentials

1. After creation, go to the General tab
2. Scroll to Client Credentials
3. Change Client authentication to None
4. Check Require PKCE as additional verification
5. Click Save

Note Required Values

Record these values for 1Password configuration:

Setting	Where to Find
Client ID	General tab > Client Credentials
Authorization Server URL	Usually https://your-domain.okta.com

Assign Users

1. Go to the Assignments tab
2. Click Assign > Assign to People or Assign to Groups
3. Select users who should use SSO
4. Click Done

Important: Assign yourself first before configuring 1Password.

Configure SSO with Microsoft Entra ID (Azure AD)

Register the Application

1. Sign in to Azure Portal at portal.azure.com
2. Navigate to Microsoft Entra ID > App registrations
3. Click New registration
4. Configure:
   • Name: "1Password"
   • Supported account types: Accounts in this organizational directory only
   • Redirect URI: Select "Public client/native" and add:
     • https://YOUR_DOMAIN.1password.com/sso/oidc/redirect
5. Click Register

Add Additional Redirect URI

1. Go to Authentication
2. Under Platform configurations, click Add a platform
3. Select Mobile and desktop applications
4. Add: onepassword://sso/oidc/redirect
5. Click Configure

Configure API Permissions

1. Navigate to API permissions
2. Verify Microsoft Graph > User.Read is present
3. Click Grant admin consent if required

Note Required Values

Setting	Where to Find
Application (client) ID	Overview page
Directory (tenant) ID	Overview page
Authorization endpoint	Endpoints > OAuth 2.0 authorization endpoint

Configure SSO with OneLogin

1. Sign in to OneLogin Admin Portal
2. Navigate to Applications > Add App
3. Search for "OpenId Connect" and select OpenId Connect (OIDC)
4. Configure:
   • Display Name: "1Password"
   • Redirect URIs: Add both 1Password URIs
   • Application Type: Native
5. Note the Client ID and Issuer URL
6. Assign users to the application

Configure SSO with Duo

1. Sign in to Duo Admin Panel
2. Navigate to Applications > Protect an Application
3. Search for and select Generic OIDC Relying Party
4. Configure redirect URIs and settings
5. Note Client ID and Issuer URL
6. Assign users via Duo groups

Step 3: Configure 1Password for SSO

Enable Unlock with SSO

1. Sign in to 1Password.com as an owner
2. Navigate to Settings > Sign-in & Security
3. Find Unlock with SSO and click Set Up
4. Click Get Started

Enter Identity Provider Details

1. Display name: How SSO appears to users (e.g., "Sign in with Okta")
2. Authorization endpoint: From your identity provider
   • Okta: https://your-domain.okta.com/oauth2/v1/authorize
   • Azure: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize
3. Token endpoint: From your identity provider
   • Okta: https://your-domain.okta.com/oauth2/v1/token
   • Azure: https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token
4. Client ID: From your identity provider application
5. Click Continue

Verify Configuration

1. Click Sign in with [Your IDP] to test
2. Complete authentication with your identity provider
3. Verify you return to 1Password successfully
4. Click Enable Unlock with SSO

Step 4: Configure Biometric Unlock for Offline Access

Since SSO requires internet, enable biometrics for offline scenarios:

1. Navigate to Settings > Sign-in & Security
2. Find Biometric unlock
3. Enable Allow biometric unlock
4. Set the re-authentication frequency:
   • Every 14 days (recommended)
   • Every 7 days
   • Every day

Users will need to authenticate with SSO periodically, but can use biometrics between sessions.

Step 5: Roll Out to Team Members

Phase 1: Pilot Group

1. Create a test group of 5-10 users
2. Assign them to the identity provider application
3. Have them test signing in with SSO
4. Gather feedback and address issues

Phase 2: Department Rollout

1. Roll out to one department at a time
2. Provide training materials
3. Monitor for issues
4. Adjust configuration as needed

Phase 3: Organization-Wide

1. Enable for all remaining users
2. Send communication about the change
3. Provide support resources
4. Monitor adoption metrics

User Experience

After SSO is configured, team members will:

1. Open 1Password app
2. Click Sign in with [Your Identity Provider]
3. Authenticate with their corporate credentials
4. Be redirected back to 1Password, unlocked

Step 6: Configure SSO Policies (Optional)

Require SSO for All Members

To ensure everyone uses SSO:

1. Navigate to Settings > Sign-in & Security
2. Enable Require Unlock with SSO
3. Users will no longer be able to use account passwords

Warning: Ensure all users are assigned in your identity provider before requiring SSO.

Configure Session Duration

Control how long SSO sessions remain valid:

1. In your identity provider, adjust session policies
2. Consider security vs. convenience trade-offs
3. Typical settings: 8-12 hours for active sessions

Troubleshooting Common Issues

SSO Sign-In Fails

Solutions:

1. Verify the user is assigned to the application in your IDP
2. Check redirect URIs are correct (including onepassword://)
3. Confirm PKCE is enabled (for Okta)
4. Review identity provider logs for errors

User Locked Out

Solutions:

1. Owners can still sign in with account password
2. Check if user was removed from IDP application
3. Use account recovery if needed
4. Verify identity provider is operational

"Invalid Client" Error

Solutions:

1. Verify Client ID is correct
2. Check client authentication is set to "None" (public client)
3. Confirm PKCE is required/enabled
4. Regenerate client credentials if needed

Users Can't Access Offline

Solutions:

1. Enable biometric unlock in 1Password settings
2. Have users authenticate with SSO while online first
3. Verify biometric unlock is enabled on user devices

Best Practices for SSO Security

Identity Provider Security

• Enable MFA in your identity provider
• Use conditional access policies where available
• Monitor for suspicious sign-in attempts
• Regularly review application assignments

1Password Configuration

• Keep account owners on password-based auth (required)
• Set appropriate session timeouts
• Enable biometric unlock for convenience
• Monitor sign-in activity in 1Password reports

Incident Response

Prepare for identity provider outages:

1. Document the fallback process (account recovery)
2. Ensure owners can still access the account
3. Have identity provider support contacts ready
4. Consider geographic redundancy for your IDP

Combining SSO with SCIM

For full identity provider integration:

Feature	SSO	SCIM
User authentication	Yes	No
User provisioning	No	Yes
User suspension	No	Yes
Group sync	No	Yes
Requires separately	-	-

Configure both for the best experience:

1. SCIM handles user lifecycle (join/leave)
2. SSO handles daily authentication

Next Steps

After configuring SSO:

1. Set up SCIM: Automate user provisioning
2. Configure policies: Establish password and access policies
3. Enable Watchtower: Monitor credential security
4. Create reports: Track SSO adoption and usage
5. Document procedures: Update IT runbooks

Additional Resources

• 1Password SSO Documentation
• Okta Configuration Guide
• SSO Best Practices

---

Need help with your SSO integration? Inventive HQ specializes in identity and access management, including 1Password SSO configuration, identity provider integration, and security policy implementation. Contact us for a free consultation.