The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To use 1Password for business, an administrator creates the organization, sets its policies, invites team members, and decides which shared vaults each group can reach. Employees then accept the invitation, finish their sign-in setup, and save, fill, and find work credentials through the browser extension or a device app. Identity-provider features such as Unlock with SSO and automated provisioning are optional, separate capabilities, and each needs its own planning.
Before you start
Four things should be settled before anyone is invited:
As an Amazon Associate I earn from qualifying purchases.
- Who the account owner is. The person who creates the organization becomes its owner and holds administrative privileges. Choose someone who will remain with the company and can manage billing and policy changes.
- Which groups need which credentials. Sketch the teams or projects that need shared logins, and which of them need access to the same items.
- Whether you need an identity provider. If your company already signs staff in through a directory service, decide now whether that sign-in should also unlock 1Password. This is covered in the SSO section below.
- Who owns recovery and access reviews. Name the person who handles account recovery requests and who periodically confirms that people still need the access they have.
Step 1: Create and configure the organization
The organization is the container for everything else: members, groups, vaults, and policies. After it exists, open the administration area and work through the policy settings before inviting anyone, so that the first members inherit the right rules. The administrator guide covers policy controls for password requirements, two-factor authentication, sign-in controls, visibility of app versions, and requirements to keep apps updated.
Free tools Windows power users keep installed
One-click scans. No signup required.
Not every control is necessarily included in every plan. Check the current plan comparison before promising a particular control to the business, because packaging changes over time.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Step 2: Invite members and onboard them
Administrators can invite people one at a time by email, or share a signup link. An invitee must confirm the account before they can reach shared items, so an invitation that sits unaccepted means that person has no working access yet.
Give employees a short onboarding message rather than sending them the admin guide. A workable sequence is:
- Accept the invitation from the email you received.
- Follow the sign-in instructions to set up your account and secure it.
- Install the desktop or mobile app, or the browser extension, on the devices you use for work.
- Save one login, fill it from the extension, and find it again using search. Doing this once in the first session prevents most early support questions.
1Password also publishes an official onboarding launch kit with tutorials, adaptable email templates, and FAQs. It describes a three-step path covering business setup, SSO integration, and enabling team members, which makes it a useful starting point for an internal rollout announcement.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- PHISHING-RESISTANT 2FA: Cryptographically binds to real domains, making phishing attacks impossible unlike SMS codes or authenticator apps.
- 3-SIDE CAPACITIVE TOUCH: Tap the end, left, or right side to authenticate, so it works in any orientation or crowded USB port.
- MULTI-COLOR LED INDICATOR: Blue means ready, blinking blue means tap now, green means success, and red means error for instant status feedback.
- IP68 WATERPROOF & BATTERY-FREE: Crush-resistant one-piece construction survives daily carry on a keychain or in a bag for years without any batteries.
- UNIVERSAL COMPATIBILITY: Works with Google, Microsoft, Apple, GitHub, AWS, and any FIDO2 / U2F / WebAuthn service, storing up to 100 passkeys.
Step 3: Organize shared vaults and access
Each employee has a personal Employee vault intended for work-related information that is theirs. Anything colleagues need should go into a vault that they can access. Sharing an item therefore means moving or saving it into a shared vault, not sending a copy by email or chat.
Scope vaults by team or project rather than creating one large vault that everyone can open. A finance vault, an engineering vault, and a vault for a single client engagement make it easier to remove access when someone changes roles, and easier to answer the question “who can see this?” Review membership periodically, because access granted for a project often outlives the project.
Contractors and other limited collaborators usually do not need full membership. A guest account restricted to a single vault is designed for that case. Check the current guest limits for your plan before relying on guests for a large group of outside users.
Rank #3
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
Step 4: Decide whether you need SSO and provisioning
Many administrators treat “SSO” as one feature. In 1Password’s documentation it is two different jobs, and you can use either without the other.
Unlock with SSO
Unlock with SSO is an authentication path. Members sign in to unlock 1Password through your identity provider instead of using their account password and Secret Key. It changes how people get into the vault; it does not create or remove people.
The official setup guidance expects you to plan the rollout, confirm requirements, connect the identity provider, and then configure the feature. The prerequisites include owner or administrator permission in 1Password, administrator access in the identity provider, email addresses that match between the two systems, and up-to-date apps and extensions. Read the recovery and export considerations before enabling it for the whole company, because a user locked out of the identity provider needs a clear path back in.
Rank #4
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Automated provisioning
Automated provisioning is a lifecycle job. Through your identity provider, 1Password can create users and groups, grant or revoke group access, and suspend users. 1Password states that its automated provisioning article does not cover SSO, so enabling provisioning does not turn on Unlock with SSO.
Choosing automated provisioning has a consequence to note early: it affects whether a self-hosted SCIM Bridge can be used on that account later. If your organization is migrating from an earlier provisioning setup, follow the current migration documentation before you change anything.
Follow the current provider instructions
Identity-provider setup pages change, and the vendors revise them on their own schedule. Recently published Okta and Microsoft Entra setup guides both warn that their steps may change, with the Okta guide last updated in August 2026 and the Microsoft Entra guide in September 2026. Use whichever version is current on the day you configure the integration, and cross-check it against the 1Password setup article for your situation.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Step 5: Monitor and maintain the account
Once people are active, the ongoing work is reviewing activity. The administrator documentation describes four tools you can build a routine around:
- Audit logs show what happened in the organization and when.
- Usage reports show which items are being accessed.
- Reports help identify compromised information and security issues, including developer secrets.
- Guest accounts and developer tools support limited sharing and administration at larger scale.
These are review aids, not guarantees. A monthly or quarterly check of audit logs, guest accounts, and the people in each shared vault will catch more problems than relying on reports alone. Members also have Watchtower, which surfaces password breaches and other security problems in their own items; it is a monitoring feature, so your team still needs a response procedure for anything it flags.
Pricing and plan choice
The official pricing page, checked on 7 October 2026 in US dollars, listed the plans below. Prices, currency, and billing terms vary by market and change over time, so confirm them on the pricing page before budgeting.
| Plan | Price shown (USD, billed annually unless noted) | Member limit | Features named on the page |
|---|---|---|---|
| Teams Starter Pack | $24.95 per month | Up to 10 members | Not stated in the source reviewed |
| Business | $8.99 per user per month | Scales per user | Identity-provider integrations, expanded role-based vault sharing and permissions, Watchtower alerts, broader administration and reports, and developer workflow items such as CLI, SDKs, SSH key signing, and Git commit signing |
The same page listed a 14-day free trial; the page did not specify which plan the trial applies to, so confirm that when you sign up.
To choose between the plans, compare these axes against your situation:
Quick Recap
- Team size. A small team of up to 10 people may find a set-price tier simpler to budget. Larger teams pay per user on the Business tier.
- Identity integration. If you need identity-provider integration, SSO, or provisioning, confirm current entitlements for your plan before buying.
- Administration depth. Compare role-based permissions, reporting, and guest needs against how many people will administer the account.
- Developer use. Include CLI, SDK, and signing features in the comparison only if your engineers will use them.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
