1Password Business Review 2026: Enterprise Password Management That Teams Actually Use

1Password Business manages credentials for over 180,000 businesses including IBM, Slack, Shopify, and GitLab. After deploying it across dozens of small and mid-sized organizations throughout South Florida, we consistently see one thing the spec sheet doesn't capture: teams actually adopt it. In our deployments, 1Password consistently hits 85%+ employee adoption within the first 30 days — compared to the 40–50% we historically saw with alternatives where user friction drove people back to browser-saved passwords. The difference comes down to the end-user experience: the browser extension autofills reliably on the vast majority of login forms without requiring manual intervention, the mobile app integrates with iOS and Android's native autofill frameworks so it behaves like the built-in password manager employees are already used to, and the onboarding flow is short enough that non-technical employees can complete it without IT hand-holding. When a password manager feels invisible in daily use, people don't look for workarounds.

This review covers admin console capabilities, SSO integration, Watchtower monitoring, and real pricing at team scale — based on hands-on deployment experience across South Florida businesses.

Quick Assessment

---

Who 1Password Business Is (and Isn't) For

Choose 1Password Business if:

• Your team has 10+ people and you need centralized password governance
• SSO integration with your identity provider (Okta, Entra ID, Google, JumpCloud) is a requirement
• You want a password manager with high adoption rates — clean UX reduces user resistance
• Your compliance needs require detailed audit logs, SIEM integration, and custom security policies
• The free Families account perk matters for employee satisfaction and overall security posture

A common question from IT admins: "Why pay for 1Password when Entra ID or Google Workspace already saves passwords?" Browser-based and IdP-native credential saving works for individual logins, but it doesn't provide cross-platform vault sharing between team members, zero-knowledge encryption independent of the browser vendor, admin-level visibility into organizational password health, or structured vault permissions that survive employee transitions. For a detailed comparison, see our 1Password vs built-in password managers guide.

Look elsewhere if:

• You need the cheapest per-user option — Bitwarden Teams at $4/user/month or Proton Pass at $1.99/user/month cost significantly less
• Open-source transparency is non-negotiable — 1Password is closed-source
• Your team is under 10 people and budget-constrained — the Teams Starter Pack works, but Bitwarden is cheaper
• You're a solo founder or very small Mac-only team — Apple Passwords (built into macOS/iOS) handles individual credential storage well for free, but it lacks the shared vaults, admin controls, and cross-platform governance that a growing team needs
• You require Swiss/EU data jurisdiction for privacy — 1Password is US/Canada-based (though it offers data residency choices including EU)

---

How Much Does 1Password Business Cost in 2026?

1Password Business costs $7.99 per user per month when billed annually, while the Teams Starter Pack offers a flat rate of $19.95 per month for up to 10 users. Enterprise pricing is custom.

Plans at a Glance

Real Cost at Team Scale

The crossover point matters: for teams of exactly 10, the Teams Starter Pack at $19.95/month ($239.40/year) costs 75% less than Business pricing at $959.40/year. The trade-off is no SSO, no Watchtower admin dashboard, no SCIM provisioning, and a 5-group limit versus 20 on Business.

March 2026 Price Increase Context

Effective March 27, 2026, 1Password increased its consumer tier pricing. Individual plans rose from $35.88 to $47.88/year (equivalent to $2.99 to $3.99/month with annual billing; month-to-month increased from $3.99 to $4.99). Family plans rose from $59.88 to $71.88/year ($4.99 to $5.99/month annual; month-to-month from $6.95 to $7.99). Business and Teams plan pricing remains entirely unaffected.

This follows a broader industry trend: Bitwarden nearly doubled its individual Premium plan from $10 to $19.80/year in January 2026 — the first price increase in Bitwarden's 10-year history. Business-tier pricing across the password manager market has remained stable, suggesting consumer plans are absorbing the cost of continued platform development.

Enterprise customers frequently negotiate below list price — Vendr data shows median contracts around 10–17% below published rates for multi-year commitments.

---

1Password Admin Console Capabilities

The 1Password admin console provides centralized credential governance, allowing administrators to manage vault permissions across 20 custom groups and enforce security policies without accessing user data.

User and Access Management

Custom Groups (up to 20): Organize users by department, project, or access level. Each group can be assigned specific vaults with granular permissions — view only, edit, or full management. When someone changes teams, move them between groups rather than reconfiguring individual vault access.

Vault Permissions (13 levels): 1Password provides fine-grained access control that goes well beyond "read" and "write." Admins can control whether users can view items, edit them, copy passwords, print, export, share outside the vault, or manage the vault itself. This granularity matters when your marketing team needs to share social media credentials without giving everyone the ability to export the entire vault.

Account Recovery: When employees get locked out, admins can initiate account recovery without ever seeing vault contents. The recovery process re-encrypts the user's data with a new key — the admin facilitates access restoration, not data access.

Security Policies and Reporting

Custom Security Policies: Enforce master password requirements, mandate two-factor authentication, restrict which devices can access company vaults, and control sharing permissions. Policies apply at the group or organization level.

Audit Logs: Every action — login, item creation, vault sharing, policy change — is logged with timestamps and user attribution. Logs can be exported for compliance documentation or streamed directly to SIEM tools (Splunk, Elastic, Sumo Logic, Panther) for real-time monitoring.

Custom Reports: Generate reports on team usage, account activity, and security posture. Enterprise customers get quarterly and annual business reviews with their dedicated Customer Success Manager.

MDM Deployment

1Password Business supports silent, policy-managed deployment through major MDM platforms — a common requirement for IT admins managing 20+ devices:

• Mac (Jamf, Kandji, Mosyle): Deploy via the PKG installer. MDM configuration profiles enforce policies like biometric unlock, auto-lock on screensaver, and password concealment.
• Windows (Intune): Deploy via MSIX as a Win32 app or line-of-business app, or push directly through the Microsoft Store. MSI is also available for Windows 10 19H2 and earlier environments.
• Browser extension: Deploy 1Password in the browser centrally via managed extension policies in Chrome, Edge, or Firefox.

Admins can also use MDM to set 1Password as a managed installation, which prevents users from installing conflicting personal copies and enables centralized update control.

Support by Plan

Support quality scales with the plan tier — a meaningful consideration at $7.99/user/month:

• Teams Starter Pack: Email support via the 1Password support portal and community forum
• Business: Priority email support with faster routing. 1Password targets a response within one business day for Business plan tickets, though this is not a contractual SLA.
• Enterprise (101+ users): Personalized onboarding, dedicated Customer Success Manager, quarterly business reviews, and a formal uptime SLA (99.9% availability with service credits for outages exceeding 15 consecutive minutes).

For most SMBs on the Business plan, priority email support is adequate. Organizations that require contractual response time guarantees and a named account contact should evaluate the Enterprise tier.

Daily Admin Workflow

In practice, the admin console handles three recurring tasks efficiently:

1. Onboarding: Create the user account, assign to appropriate groups, and vault access propagates automatically. With SCIM provisioning, even this step is automated.
2. Offboarding: Suspend or delete the account. Access revocation is immediate across all devices. Shared vault data stays with the organization.
3. Security monitoring: Check Watchtower dashboard for team-wide password health, review flagged items, and follow up with users who have weak or compromised credentials.

Offboarding in practice: When an employee leaves, the IT admin opens the admin console and clicks "Suspend." Within seconds, the employee's 1Password app on their phone, laptop, and browser extension locks out — they can no longer view, copy, or export any credentials. Every shared vault remains intact with the organization. The admin can then review the user's vault activity log to identify credentials that may need rotation, particularly any the departing employee created or had sole access to. The process typically takes under five minutes, compared to manually tracking down which browser-saved or spreadsheet-stored passwords the employee may have had access to.

We regularly deploy 1Password for clients with 15–75 employees, and the admin console consistently reduces ongoing management overhead compared to platforms where "admin" means a basic user list.

---

Does 1Password Business Support SSO and SCIM?

1Password Business includes Unlock with SSO via OIDC and automated provisioning through SCIM Bridge, supporting eight major identity providers including Okta, Microsoft Entra ID, and Google Workspace.

Unlock with SSO

1Password supports Unlock with SSO using the OpenID Connect (OIDC) protocol. Employees sign in with their existing identity provider credentials instead of a separate 1Password account password.

Supported identity providers:

• Okta
• Microsoft Entra ID (Azure AD)
• Google Workspace
• JumpCloud
• OneLogin
• Auth0
• Duo
• Ping Identity

Important nuances:

SSO in 1Password works differently from typical SaaS SSO. Because of the zero-knowledge architecture, 1Password cannot simply trust the identity provider — it uses a key-splitting mechanism where one encryption key component is released by the IdP during SSO authentication. This preserves end-to-end encryption while enabling SSO convenience.

Members of the Owners group cannot use SSO by design — this prevents a scenario where an identity provider compromise locks out every administrator simultaneously.

Biometric unlock (Touch ID, Face ID, Windows Hello) remains available for offline access even when SSO is the primary authentication method.

SCIM Bridge: Automated User Lifecycle

SCIM (System for Cross-domain Identity Management) Bridge automates the tedious parts of user management:

• User creation: New employees provisioned in your IdP automatically get 1Password accounts
• Group sync: IdP group memberships map to 1Password groups, which control vault access
• Suspension/deletion: Deprovisioned users lose 1Password access automatically
• Supported providers: Okta, Microsoft Entra ID, Google Workspace, JumpCloud, OneLogin, and Rippling

Deployment options:

For Okta and Entra ID, 1Password now offers hosted provisioning — no infrastructure to manage. For other providers, you deploy the SCIM Bridge yourself on Google Cloud Platform, Azure Container Apps, AWS (via CloudFormation), DigitalOcean, or self-hosted infrastructure.

SSO and SCIM are separate integrations that serve different functions — SSO handles authentication, SCIM handles provisioning. Both require configuration in your identity provider, but they complement each other: SCIM creates accounts automatically, SSO eliminates a separate password for those accounts.

Test SSO integration in your own environment with a 14-day 1Password Business trial.

---

How 1Password Watchtower Protects Your Organization

Watchtower monitors every credential in your organization for breaches, weak passwords, missing 2FA, and passkey availability — then surfaces team-wide security metrics in an admin dashboard without exposing individual vault contents.

Individual Watchtower

Every 1Password user gets personal Watchtower alerts:

• Compromised passwords flagged via Have I Been Pwned integration
• Weak passwords that don't meet strength thresholds
• Reused passwords across multiple accounts
• Missing two-factor authentication on supported services
• Expiring passwords for services with rotation requirements
• Passkey availability — alerts when a service supports passkeys but you're still using a password

All breach checks happen locally on the device. 1Password never sends your credentials to external services — it uses k-anonymity techniques to check breach databases without exposing your actual passwords.

Business Watchtower Dashboard

The admin-facing dashboard aggregates Watchtower data across the entire organization:

Team Password Health: See what percentage of organizational credentials are strong, unique, and protected by 2FA. Identify departments or individuals with the weakest security posture without seeing their actual passwords.

Domain Breach Report: Enter your company domain and 1Password monitors for email addresses appearing in public data breaches. When a breach involves credentials tied to your domain, admins get actionable alerts to initiate password rotation.

Security Score Tracking: Monitor organizational security posture over time. Track improvement after policy changes or training initiatives.

The practical value is accountability without surveillance. Admins know the organization has 47 reused passwords and 12 accounts without 2FA — they can address the gaps without knowing which specific passwords are involved.

---

Can Teams Share Passkeys in 1Password Business?

Yes — and this is one of 1Password's most practically useful features for 2026. Passkeys in 1Password are stored in the vault like any other item, which means they can be placed in a shared vault and accessed by any team member with vault permissions.

A common scenario: the marketing team needs shared access to a corporate social media account that supports passkeys. In 1Password Business, an admin creates a shared vault for the marketing group, saves the passkey there, and every team member with access can authenticate using that passkey from their own device. No password to share over Slack, no risk of it being saved in someone's personal browser.

This is a meaningful technical distinction. Passkeys in most native ecosystems (Apple Keychain, Google Password Manager, Windows Hello) are cryptographically bound to a single device and cannot be shared or transferred. 1Password solves this by abstracting passkey storage into the vault layer, where vault-level sharing rules apply. The FIDO Alliance is developing a Credential Exchange standard for cross-platform portability, but as of early 2026, 1Password's vault-based approach is the most practical way for teams to share passkeys today. For a deeper look at deploying passkeys across your organization, see our passkeys implementation guide for small business.

For IT admins, the admin policy panel also controls passkey behavior organization-wide — including whether employees can save passkeys in 1Password, and whether autosave prompts appear for passkey-enabled sites.

---

How 1Password's Dual-Key Encryption Works

1Password uses a dual-key encryption architecture requiring both a master password and a locally generated 128-bit Secret Key to decrypt vault data. This model explicitly protects against server-side breaches.

Three elements must exist simultaneously to decrypt company data:

1. The encrypted vault data (stored on 1Password's servers)
2. Your master password (known only to you)
3. Your Secret Key (stored only on your devices, never transmitted to 1Password)

This means even if 1Password's servers are breached and an attacker obtains your encrypted vault data, and separately obtains your master password, they still cannot decrypt your vault without the Secret Key from your device.

Neither Bitwarden, NordPass, nor Proton Pass implement this dual-key model. They use standard single-key derivation from the master password alone. This is 1Password's most significant technical differentiator.

Zero-Knowledge Architecture

• AES-256-bit encryption for all vault data at rest
• Secure Remote Password (SRP) protocol ensures your master password is never transmitted over the network, even in encrypted form
• SOC 2 Type II certified with regular independent third-party audits
• Data residency options: US, Canada, or EU — you choose where your encrypted data is stored

One architectural trade-off worth noting: while passwords, usernames, and notes are fully encrypted, metadata fields such as URLs and item names are not encrypted server-side — meaning they are accessible in encrypted vault storage but not protected by the same end-to-end encryption as credential content. Competitors like Proton Pass encrypt all metadata fields. For most organizations this distinction is not operationally significant, but it is relevant for threat models where concealing which services an organization uses is a requirement.

21-Year Track Record

1Password has operated since 2005 with zero security breaches. In an industry where LastPass suffered a severe, highly publicized breach in 2022 and competitors face periodic security incidents, this track record carries real weight for risk-conscious organizations.

---

Extended Access Management (XAM)

1Password is expanding beyond password management with its Extended Access Management platform, designed to close what they call the "Access-Trust Gap" — the security risks from unmanaged devices, shadow IT, and ungoverned SaaS applications.

Device Trust: Ensures only trusted, compliant devices can access company resources. Blocks unknown and insecure devices while guiding users through self-remediation.

SaaS Discovery: Identifies which applications employees actually use — including unmanaged and shadow IT apps — and provides visibility into SaaS sprawl across the organization.

AI Agent Security: The 1Password SDK for Agentic AI enables secure credential management for AI workflows, allowing programmatic secrets access without hardcoding credentials.

Deployment note for IT admins: XAM's Device Trust component requires installing a separate endpoint agent (powered by Kolide, which 1Password acquired) on each managed device. The agent supports macOS 11+, Windows 10+, and Linux (Debian/RPM). It can be deployed via MDM for managed devices or self-installed by employees when they first authenticate to an SSO-protected application. The agent acts as a cryptographic possession factor — devices without it cannot authenticate to protected apps. The 1Password browser extension can also enforce compliance checks for web applications not behind SSO. This is a separate infrastructure component from the standard 1Password app and requires its own deployment planning, employee communication, and ongoing monitoring.

For a standard business of 10–30 people, XAM is likely more infrastructure than you need — the core Business plan handles credential governance well on its own. XAM becomes relevant for compliance-heavy mid-market organizations (50+ employees, regulated industries, hybrid device environments) where unmanaged devices and shadow IT represent a genuine audit risk. It requires a separate subscription with custom pricing.

---

Does 1Password Business Include a Free Families Account?

Every 1Password Business user receives a complimentary 1Password Families membership supporting up to 5 family members — a $71.88/year value per employee that also improves organizational security posture.

Each Business user can claim a full 1Password Families plan supporting up to 5 family members. The family account is completely separate from the employer's Business account — the company has no visibility into personal vault data. If an employee leaves, their Families account remains active for 14 days so they can add personal billing before it lapses.

Why It Matters for IT Admins

The free Families account solves a persistent security problem: employees storing personal passwords in their work vault (or worse, using their work password manager habits inconsistently at home).

When every employee has a dedicated personal password manager, they're less likely to:

• Save personal logins in company vaults (creating offboarding complications)
• Reuse work passwords for personal accounts (expanding breach exposure)
• Resist password manager adoption (because they see the personal value)

The Math

1Password Families costs $71.88/year at current pricing. For a 50-person team, that's $3,594 in employee benefits included with Business plan — effectively reducing the net premium you're paying for 1Password versus cheaper alternatives.

---

What Are 1Password Business's Limitations?

Price Premium: At $7.99/user/month, you're paying roughly twice what Bitwarden Teams or NordPass Business charge. For budget-constrained teams, that delta funds real alternatives — not all organizations need the SSO, SCIM, and Watchtower features that justify the cost.

Closed Source: Unlike Bitwarden (fully open source) and Proton Pass (open source), 1Password's codebase is proprietary. Security is validated through third-party audits and SOC 2 certification rather than public code review. For organizations with open-source mandates, this is a dealbreaker.

SCIM Bridge Complexity: For identity providers other than Okta and Entra ID (which have hosted provisioning), deploying and maintaining the SCIM Bridge adds real infrastructure overhead. Small teams without DevOps capacity may find this disproportionately complex.

No Free Tier: 1Password offers a 14-day trial but no ongoing free plan. Bitwarden's free tier and Proton Pass's free individual plan allow longer evaluation periods before committing to a subscription.

XAM Upsell: The Extended Access Management features (Device Trust, SaaS discovery) require a separate subscription. Organizations expecting these capabilities in the Business plan will discover they're a premium add-on.

AI Features and Vault Data: 1Password has introduced AI-assisted features such as AI-powered item naming and developer SDK integrations. For security-conscious teams, the relevant clarification is that these AI features operate on metadata and interface interactions — they do not have access to decrypt or process the contents of your vault. Vault data remains protected by the dual-key architecture regardless of AI feature usage. If your organization has a policy against AI features in security tooling, 1Password does not currently offer a way to disable them at the admin level.

US/Canada Jurisdiction: While 1Password offers EU data residency, the company operates under US/Canadian law. For organizations with strict data sovereignty requirements, Proton Pass (Swiss jurisdiction) or Bitwarden (self-hosting option) may be better fits.

---

Developer Tools and Secrets Management

For teams with engineering staff, 1Password Business includes native secrets management and SSH key signing — no separate secrets vault tool required. The SSH agent stores and signs keys without copying them to disk, the CLI enables programmatic vault access for scripts and automation, and CI/CD integrations inject credentials into build pipelines without storing them in environment variables or config files. For most SMBs, this reduces DevOps tool sprawl by consolidating secrets management into the same platform the rest of the team already uses for passwords.

---

Migrating to 1Password Business

One of the most common concerns IT admins raise before committing is migration friction: how difficult is it to move 50 users off LastPass, Bitwarden, or browser-saved passwords?

1Password provides dedicated import tools for every major source. The process is straightforward in most cases:

From LastPass: Export a CSV from the LastPass browser extension, then import directly via the 1Password web portal or desktop app. Passwords, secure notes, addresses, credit cards, and shared folders all transfer. Shared folders become vaults, which only admins can import. Items that don't transfer cleanly — passkeys and LastPass Authenticator TOTP codes — need to be re-enrolled manually.

From Bitwarden, Dashlane, Keeper, KeePass, RoboForm: Each has a dedicated import path in 1Password. The process follows the same CSV export/import pattern.

From browser-saved passwords (Chrome, Firefox, Edge, Safari, Brave): 1Password has individual import guides for each browser. For organizations where passwords live entirely in Chrome or Edge, this is often the most common migration scenario — and a key reason why browser-saved passwords fall short for business use becomes apparent during the transition. As of iOS 26, 1Password also supports the FIDO Credential Exchange standard, allowing direct app-to-app imports on mobile without CSV files.

For large teams: Admins can import on behalf of users into shared vaults. For individual private vaults, each employee handles their own import — which is typically a 5–10 minute process. Plan for a 2–3 week migration window for teams of 25–75 people, including time for employees to verify their data transferred correctly and re-enroll any TOTP codes.

---

How 1Password Compares to Alternatives

For detailed head-to-head comparisons, see:

• Proton Pass vs 1Password — Swiss privacy vs polished UX at half the price
• Best Business Password Managers — Full roundup including Bitwarden and NordPass
• NordPass vs Proton Pass — Two budget-friendly European alternatives compared

---

Who Should Choose 1Password Business

Choose 1Password Business if your organization has 10+ people, uses an identity provider (Okta, Entra ID, Google), and needs a password manager employees will actually adopt. The admin tooling, SSO integration, and security architecture justify the premium. Start a 14-day free trial.

Choose the Teams Starter Pack if you have 10 or fewer people, don't need SSO, and want the 1Password experience at $19.95/month flat rather than per-user pricing.

Choose Bitwarden if you need open-source transparency, want a self-hosting option, or need to minimize per-user cost without sacrificing core password management features.

Choose Proton Pass if Swiss data jurisdiction, open-source code, and aggressive pricing ($1.99–$4.49/user/month) matter more than 1Password's admin polish and adoption advantage.

Choose NordPass if you want modern XChaCha20 encryption at $3.59/user/month with a clean interface and minimal migration friction.

Stick with Apple Passwords if your team is entirely on Apple devices, has no cross-platform needs, and only requires individual credential storage. The built-in Apple Passwords app (available since iOS 18 / macOS Sequoia) handles personal password management well at no cost. It does not offer shared vaults, admin governance, SSO integration, or audit logs — the moment you need any of those for a team, a dedicated business password manager is the appropriate tool.

---

The Bottom Line

1Password Business is a strong choice for organizations that need SSO integration, centralized credential governance, and a tool with a track record of high employee adoption. The dual-key encryption architecture is a genuine technical differentiator, the admin console handles the full user lifecycle efficiently, and the included Families account adds meaningful value beyond the core product.

The $7.99/user/month cost is higher than most alternatives. For teams where budget is the primary constraint, Bitwarden at $4/user/month or Proton Pass at $1.99/user/month are capable tools that cover the fundamentals. For teams where SSO integration, admin visibility, and adoption reliability are the deciding factors, 1Password Business is worth the difference.

The 14-day free trial gives you enough time to connect your identity provider, test the admin console, and run a pilot group — which is the most useful way to evaluate whether the platform fits your organization.

Pricing verified against 1password.com as of March 2026. Feature details confirmed through 1Password's official documentation and support resources.

---

Related Resources

• Best Business Password Managers 2026 — Full comparison of 1Password, Bitwarden, NordPass, and Proton Pass for IT admins.
• Best Password Manager for Small Business — Admin-focused comparison with real deployment guidance.
• Proton Pass vs 1Password 2026 — Head-to-head comparison of pricing, privacy, and admin features.
• Passkeys for Small Business — Implementation guide for passwordless authentication.
• The True Cost of Password Spreadsheets — Why the "free" approach to password management is the most expensive.
• 1Password vs Built-in Password Managers — Why browser-saved passwords fall short for business use.