In short: 1Password Business is the business plan of the 1Password password manager. Every user gets an encrypted vault; admins get shared vaults, custom groups, sign-in policies and firewall rules, Unlock with SSO, SCIM provisioning, Watchtower, Insights, reports and an activity log. It is licensed per user, with one seat covering all of a person's devices.
What 1Password Business is
1Password Business is the plan 1Password provides for organisations, and the one its managed service provider edition provisions for each client. 1Password now markets the product as 1Password Enterprise Password Manager, with Business and Enterprise plans. Every user gets a private vault plus access to the shared vaults their team needs, holding passwords, passkeys, two-factor (TOTP) codes, secure notes, documents and other items. 1Password fills them in browsers and apps, generates strong passwords, and can sign in to sites that support passkeys.
Data is encrypted on the device using the account password and a 128-bit Secret Key, and 1Password describes this dual-key design as keeping even itself unable to see what you store. 1Password states it is certified to SOC 2 Type 2 and ISO 27001.
What is included
| Area | What you get with 1Password Business |
|---|---|
| Vaults and sharing | Private and shared vaults, with permissions set per person, group and vault |
| Administration | Admin console and custom groups for organising teams and delegating responsibilities such as account recovery |
| Policies | Custom security policies, for example account password requirements and required two-factor authentication |
| Firewall rules | Allow, report or deny sign-ins by country, continent, IP address or range, or anonymous IP type such as Tor or public VPNs |
| Sign-in | Unlock with SSO through identity providers including Microsoft Entra ID, Okta, OneLogin and Duo |
| Provisioning | SCIM bridge to create and suspend users and groups from Entra ID, Google Workspace, Okta, OneLogin, Rippling or JumpCloud |
| Security insight | Watchtower alerts on weak, reused and breached passwords, and Insights on password health and team usage |
| Reporting and audit | Custom business reports and an activity log of team actions |
| Integrations | Event streaming to SIEM tools such as Splunk, Elastic, Sumo Logic and Panther, plus a command-line tool for developers |
| Extras | Guest accounts with access to a single shared vault, and a complimentary Families membership for each user |
1Password's Teams Starter Pack, sold directly to small teams, does not include single sign-on, automated provisioning or custom reports. Because the MSP route provisions Business, you get these from the first seat.
How it is licensed
The licence is per user. A seat covers one person across all of their devices, so a laptop, a phone and a tablet do not cost extra, and guests with access to one shared vault are allowed up to the limit 1Password sets for the plan. Through Forever Systems, Business is billed monthly for the seats in use, with no licence minimum; the 1Password vendor page explains that consumption model and how account regions work.
What this means day to day is that licence admin follows your identity provider. When the SCIM bridge suspends a leaver in Entra ID or Google Workspace, their 1Password account is suspended too and the seat stops counting. When a new starter joins a group, they get the vaults that group is allowed to see. Nothing needs to be bought in advance for a new team.
| Question | Answer |
|---|---|
| What counts as a seat? | Each team member with a vault |
| Do guests need a seat? | Not up to the plan's guest limit; a guest sees one shared vault |
| Does a seat cover all devices? | Yes: computers, phones, tablets and browsers |
| Can an existing account be moved? | Usually, by linking it to our MSP console |
Prices depend on seat count, so ask us for a quote. For how monthly billing compares with annual commitments, see monthly vs annual licences.
Requirements and deployment
1Password has apps for Mac, Windows, Linux, iOS and Android, browser extensions, and a command-line tool. There is nothing to host: the service is delivered from 1Password's cloud, with the region chosen at sign-up.
A typical rollout:
- Create the account in the EU region and link it to our MSP console.
- Connect Unlock with SSO and the SCIM bridge to your identity provider, or invite users by email.
- Set team policies, create groups by department or site, and build the shared vaults.
- Import existing passwords from browsers or another password manager, then deploy apps and extensions with your device management tool.
- Review Watchtower and Insights to fix weak and reused passwords.
Who it suits and how we help
1Password Business suits organisations that want a password manager staff will actually use, with the controls IT needs: enforced two-factor authentication, an audit trail, and quick offboarding when someone leaves. It helps evidence access control for Cyber Essentials and insurer questionnaires.
Forever Systems scopes the account, handles monthly billing alongside your other subscriptions, sets up SSO and provisioning, and looks after joiners, leavers and recovery requests. 1Password requires our technicians to re-verify with MFA for admin actions and logs what they do, and it states vault contents are not visible to it. Also considering Keeper Password Manager or LastPass Business? We can compare them for you.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between 1Password Teams and 1Password Business?
The Teams Starter Pack is a plan for small teams that does not include single sign-on, automated provisioning or custom reports. 1Password Business adds those, along with features such as firewall rules and event streaming to SIEM tools. We supply Business.
Does 1Password Business work with Microsoft Entra ID?
Yes. Unlock with SSO lets users open 1Password with their Entra ID sign-in, and the SCIM bridge can create and suspend users and groups automatically.
Do 1Password Business users get a personal account?
Yes. Each Business user gets a complimentary 1Password Families membership, linked to the business account but kept separate from it; the business cannot see or manage it. If the person leaves, the membership unlinks and they need to add a payment method to keep it.
Can 1Password Business block sign-ins from certain countries?
Yes, by restricting where people can sign in. Firewall rules in 1Password Business can allow, report or deny sign-ins by country, continent, IP address or range, or anonymous IP type such as Tor or public VPNs.
What happens to a leaver's passwords?
Shared vault items stay with the organisation. When you suspend or remove the user, through provisioning or the admin console, they lose access, and their seat stops being billed.