How to Invite and Onboard Team Members in 1Password Business

Onboarding team members to 1Password Business is essential for establishing secure password management across your organization. This guide covers multiple invitation methods, from individual email invitations to automated SCIM provisioning for enterprise deployments.

Prerequisites

Before you begin, ensure you have:

• Owner or administrator access to your 1Password Business account
• Team member email addresses for those you want to invite
• Allowed email domains configured (if using sign-up links)
• Identity provider access (if using SCIM provisioning)

Understanding Invitation Methods

1Password Business offers several ways to invite team members:

Method	Best For	Automation Level
Email invitations	Individual invites, small teams	Manual
Sign-up links	Large teams, department rollouts	Semi-automated
Slack integration	Teams using Slack	Semi-automated
SCIM provisioning	Enterprise, automated onboarding	Fully automated

Step 1: Configure Account Password Policy

Before inviting team members, establish your password requirements:

1. Sign in to your account on 1Password.com
2. Navigate to Settings > Security
3. Select Account Password Policy
4. Configure minimum requirements:
   • Minimum password length
   • Character requirements
   • Password strength indicator threshold
5. Click Save

Important: Password policies aren't retroactively enforced. People who join before the policy is set will only need to comply if they change their password or have their account recovered.

Step 2: Invite Team Members by Email

Individual Email Invitations

1. Sign in to your account on 1Password.com
2. Select Invitations in the sidebar
3. Click Invite by email
4. Enter the team member's email address(es)
   • Separate multiple addresses with commas
   • Email addresses must be associated with functional inboxes
5. Click Invite
6. Repeat for additional team members

Using Custom Invitation Emails

To personalize the invitation experience:

1. From the Invitations page, click Settings
2. Select Customize invitation email
3. Add your custom message explaining:
   • Why they're being invited
   • What 1Password is used for at your organization
   • Who to contact with questions
4. Click Save

Step 3: Use Sign-Up Links for Bulk Onboarding

For inviting large groups simultaneously:

Configure Allowed Domains

1. Navigate to Settings > Invitations
2. Under Sign-up link, enter your organization's email domains
   • Example: yourcompany.com, subsidiary.com
3. Click Save

Share the Sign-Up Link

1. Return to the Invitations page
2. Copy the sign-up link displayed under your allowed domains
3. Share the link via:
   • Company-wide email
   • Internal wiki or intranet
   • Team chat channels
   • New employee onboarding documentation

Note: Only people with email addresses matching your allowed domains can use the sign-up link.

Step 4: Invite via Slack Integration

If your organization uses Slack:

Connect Slack to 1Password

1. Navigate to Integrations > Slack
2. Click Connect to Slack
3. Authorize 1Password to access your Slack workspace
4. Select which channels or groups to sync

Send Slack Invitations

1. From the Invitations page, select Slack
2. Choose your invitation method:
   • Invite Everyone - Invites all workspace members
   • Choose People to Invite - Select individuals, channels, or groups
3. Click Send Invitations

Note: Slack invitations also expire after 5 days.

Step 5: Confirm New Team Members

After team members accept their invitation and create their account:

1. Navigate to Invitations in the sidebar
2. You'll see pending members under Needs Confirmation
3. Review each pending member:
   • Verify the email address is correct
   • Confirm they're a legitimate team member
4. Click Confirm next to each approved member
5. The team member receives an email confirming they can start using 1Password

Batch Confirmation

For multiple pending members:

1. Select the checkboxes next to members to confirm
2. Click Confirm Selected
3. All selected members are confirmed simultaneously

Step 6: Set Up SCIM Provisioning (Enterprise)

For automated onboarding with your identity provider:

Supported Identity Providers

• Google Workspace
• Microsoft Entra ID (Azure AD)
• Okta
• OneLogin
• JumpCloud
• Rippling

Enable SCIM Provisioning

1. Sign in to your 1Password Business account as an owner
2. Navigate to Settings > Provisioning
3. Click Turn On CLI Provisioning or Set up SCIM
4. A Provision Managers group is automatically created
5. Note your SCIM URL and generate a Bearer Token

Configure Your Identity Provider

Each provider has specific configuration steps. Generally:

1. Create a new application in your identity provider
2. Configure SCIM provisioning settings:
   • SCIM URL: Your 1Password SCIM endpoint
   • Bearer Token: The token generated in 1Password
3. Map user attributes (email, display name)
4. Enable automatic user provisioning
5. Configure group sync if needed

SCIM Capabilities

With SCIM configured, you can:

Action	Result in 1Password
Assign user to 1Password app	User receives invitation, auto-confirmed after signup
Update user email/name	Changes reflected in 1Password
Remove user from app	User suspended in 1Password
Push groups	Groups synced to 1Password

Note: SCIM automatically confirms users every 5 minutes after they sign up.

Step 7: Assign Users to Groups and Vaults

After team members are confirmed:

Add to Custom Groups

1. Navigate to Groups in the sidebar
2. Select or create a group (e.g., "Marketing", "Engineering")
3. Click Add People
4. Select team members to add
5. Click Save

Grant Vault Access

1. Navigate to Vaults in the sidebar
2. Select the vault to share
3. Click Manage Access
4. Add users or groups
5. Set appropriate permissions
6. Click Save

Best Practices for Team Onboarding

Use the Principle of Least Privilege

• Only grant access to vaults team members need for their role
• Start with minimal permissions and add more as needed
• Review access quarterly and remove unnecessary permissions

Create Onboarding Documentation

Prepare resources for new team members:

• How to install 1Password on desktop and mobile
• How to use the browser extension
• Which vaults they should use for different credentials
• How to request access to additional vaults
• Who to contact for 1Password support

Set Up a Welcome Vault

Create a "Getting Started" vault containing:

• Company password guidelines
• Instructions for using 1Password
• Links to training resources
• Common shared credentials new employees need

Troubleshooting Common Issues

Invitation Email Not Received

Solutions:

1. Check spam/junk folders
2. Verify the email address is correct
3. Resend the invitation from the Invitations page
4. Add 1Password email addresses to your email allowlist

Team Member Can't Sign Up

Solutions:

1. Verify their email domain is in the allowed domains list
2. Check if an invitation was sent and hasn't expired
3. Ensure they're using the correct sign-up link
4. Have them try a different browser or device

SCIM Sync Not Working

Solutions:

1. Verify the SCIM URL is correct in your identity provider
2. Regenerate and update the bearer token
3. Check your SCIM bridge status (if self-hosted)
4. Review identity provider logs for errors

Next Steps

After onboarding your team:

1. Create shared vaults: Organize credentials by team, project, or function
2. Configure policies: Set team-wide security policies for passwords and access
3. Enable SSO: Connect 1Password to your identity provider for single sign-on
4. Set up emergency access: Ensure account recovery options are configured
5. Monitor usage: Review reports to track adoption and identify issues

Additional Resources

• 1Password Business Admin Guide
• SCIM Provisioning Documentation
• Custom Groups Guide

---

Need help with your 1Password Business deployment? Inventive HQ offers comprehensive identity and access management services, including 1Password implementation, SSO integration, and security policy configuration. Contact us for a free consultation.