How to Create and Manage Shared Vaults in 1Password Business

Shared vaults are the foundation of collaborative password management in 1Password Business. By organizing credentials into vaults with appropriate access controls, you can ensure team members have access to what they need while maintaining security. This guide covers creating, organizing, and managing shared vaults effectively.

Prerequisites

Before you begin, ensure you have:

• 1Password Business account with admin or owner access
• Team members added to your 1Password account
• Groups configured (recommended for easier management)
• Clear organizational structure for how credentials should be organized

Understanding Vault Types

1Password Business includes several vault types:

Vault Type	Description	Visibility
Personal/Employee	Private vault for each user	Only the user
Shared	Team vaults with customizable access	Based on permissions
Private Shared	Admin-created vaults	Only specified users

Step 1: Plan Your Vault Structure

Before creating vaults, plan your organization strategy:

Common Organizational Patterns

By Department

• Marketing Vault
• Engineering Vault
• Finance Vault
• HR Vault

By Function

• Social Media Accounts
• Cloud Services
• Development Tools
• Vendor Portals

By Project

• Project Alpha Credentials
• Client XYZ Access
• Product Launch Accounts

By Security Level

• General Business
• Sensitive Data
• Executive Access

Best Practice Recommendations

1. Create vaults with specific purposes rather than overly broad access
2. Name vaults clearly to indicate their contents and intended audience
3. Limit the number of vaults to what's manageable
4. Document your vault structure for reference

Step 2: Create a Shared Vault

From 1Password.com

1. Sign in to your account on 1Password.com
2. On your Home page, click New Vault
3. Choose a vault type:
   • Suggestions - Select from common vault templates
   • Custom - Create a vault with your own name and settings
4. Enter the vault details:
   • Name: Clear, descriptive name
   • Description: Purpose and intended contents
   • Icon: Visual identifier (optional)
5. Configure owner access:
   • Team owners: Owners can manage the vault
   • Administrators: Allow admins same level of access (optional)
6. Click Create Vault

From 1Password Apps

1. Open the 1Password app
2. Right-click in the vault sidebar
3. Select New Vault
4. Enter the vault name and description
5. Click Create
6. Manage access through 1Password.com

Step 3: Configure Vault Permissions

1Password Teams Permissions

With 1Password Teams, you can set three permission levels:

Permission	Capabilities
Allow Viewing	View items, copy passwords
Allow Editing	View + create, edit, delete items
Allow Managing	All above + manage access, delete vault

1Password Business Granular Permissions

1Password Business offers five additional granular permissions:

Permission	Description
View Items	See item details
Create Items	Add new items to the vault
Edit Items	Modify existing items
Archive Items	Move items to archive
Delete Items	Permanently remove items

Additional Control Permissions

Permission	Description
View and Copy Passwords	See concealed passwords, copy to clipboard
View Item History	Access and restore previous versions
Import Items	Move or copy items into the vault
Export Items	Save items to unencrypted files
Copy and Share Items	Share items outside 1Password
Move Items	Transfer items to other vaults
Print Items	Print item contents

Step 4: Grant Access to Users and Groups

Add Individual User Access

1. Navigate to Vaults in the sidebar
2. Select the vault to configure
3. Click Manage Access
4. Click Add People
5. Search for and select the user
6. Set their permissions:
   • Choose from preset levels (View, Edit, Manage)
   • Or configure granular permissions individually
7. Click Save

Add Group Access

1. From the vault's Manage Access page
2. Click Add Groups
3. Select the group(s) to grant access
4. Configure permissions for the group
5. Click Save

Tip: Using groups makes permission management much easier, especially when team members join or leave.

Configure Group Vault Permissions

1. Navigate to Groups in the sidebar
2. Select the group to configure
3. Click Vaults
4. Click Manage next to the group
5. Select vaults to grant access
6. Click the gear icon next to each vault to set permissions
7. Click Update Vaults

Step 5: Organize Items Within Vaults

Use Categories Effectively

1Password supports various item categories:

• Logins - Website and app credentials
• Secure Notes - Confidential text information
• Credit Cards - Payment information
• Identities - Personal information
• Software Licenses - License keys and registration info
• API Credentials - API keys and tokens
• Servers - Server access information
• Databases - Database connection details

Add Tags for Cross-Vault Organization

1. Open an item in the vault
2. Click Add Tag or the tag icon
3. Enter or select tags
4. Tags can span multiple vaults for organization

Use Favorites

Mark frequently accessed items as favorites:

1. Open the item
2. Click the star icon to add to Favorites
3. Access favorites quickly from the Favorites section

Step 6: Set Up Vault-Specific Policies

Restrict App Access

In 1Password Business, you can control which apps access a vault:

1. Navigate to the vault's settings
2. Under App Access, configure:
   • Allow access from desktop apps
   • Allow access from mobile apps
   • Allow access from browser extension
   • Allow access from 1Password.com
3. Click Save

Configure Item Sharing

Control whether items can be shared outside 1Password:

1. From vault settings, find Sharing
2. Enable or disable:
   • Copy and share items
   • Export items
   • Print items
3. Save your changes

Step 7: Audit and Review Vault Access

Review Current Access

1. Navigate to Vaults
2. Select a vault
3. Review the People and Groups sections
4. Verify access levels are appropriate

Generate Access Reports

1. Navigate to Reports in the sidebar
2. Select Team Report
3. Filter by vault or user
4. Export for compliance documentation

Regular Access Reviews

Schedule quarterly reviews to:

1. Remove access for departed team members
2. Revoke unnecessary permissions
3. Verify group memberships are current
4. Archive unused vaults

Best Practices for Shared Vault Security

Follow Least Privilege Principle

• Grant minimum permissions required for the job
• Use View-only access when editing isn't needed
• Reserve Manage permission for vault administrators only

Restrict Dangerous Permissions

Remove these permissions from group access unless specifically required:

• Export Items - Allows downloading unencrypted data
• Copy and Share Items - Enables sharing outside 1Password
• Move Items - Could move items to personal vaults

Control Vault Creation

Consider removing Create Vaults permission from the Team Members group:

1. Navigate to Groups > Team Members
2. Click Permissions
3. Uncheck Create Vaults
4. Click Save

Then grant Create Vaults permission only to specific groups (managers, IT staff).

Implement Vault Naming Conventions

Establish clear naming standards:

• [Department] - [Purpose] (e.g., "Marketing - Social Media")
• [Project] - [Type] (e.g., "Alpha Launch - Vendor Access")
• Include security classification if needed (e.g., "Finance - SENSITIVE")

Troubleshooting Common Issues

User Can't Access Vault

Solutions:

1. Verify they've been granted access to the vault
2. Check if they're in a group with vault access
3. Confirm their permission level includes viewing
4. Have them refresh their 1Password app

Items Missing from Vault

Solutions:

1. Check if items were moved to another vault
2. Review item history for recent deletions
3. Check archive for archived items
4. Verify vault filters aren't hiding items

Permission Conflicts

Solutions:

1. Review both individual and group permissions
2. Remember: most permissive wins when there's overlap
3. Consider using only group-based permissions for consistency

Migrating Items Between Vaults

Move Items

1. Select the item(s) to move
2. Right-click and select Move
3. Choose the destination vault
4. Confirm the move

Note: Moving requires Move Items permission in the source vault and Create Items permission in the destination.

Copy Items

1. Select the item(s) to copy
2. Right-click and select Copy
3. Choose the destination vault
4. Confirm the copy

Next Steps

After setting up your shared vaults:

1. Document your structure: Create a vault directory for your team
2. Train team members: Ensure everyone knows which vaults to use
3. Configure SSO: Enable single sign-on for easier access
4. Set up Watchtower: Monitor vault items for security issues
5. Schedule reviews: Plan regular access audits

Additional Resources

• 1Password Vault Management Guide
• Custom Groups Documentation
• Vault Permissions Reference

---

Need help organizing your 1Password deployment? Inventive HQ provides comprehensive password management consulting, including vault structure design, permission audits, and security policy implementation. Contact us for a free consultation.