In short: 1Password Business is an end-to-end encrypted password manager for organisations. Data is protected by each user's account password and a 128-bit Secret Key, so 1Password cannot read it. Business includes shared vaults with permissions, Watchtower alerts, Unlock with SSO, automated provisioning from your identity provider, reporting and activity logs.
How 1Password's security model works
1Password protects each account with two secrets. The account password is chosen by the user and never stored by 1Password. The Secret Key is a 128-bit key generated on the user's device when the account is created. Vault data is encrypted with keys derived from both before it leaves the device, so a copy of 1Password's servers would be useless to an attacker without both secrets for each account.
The Secret Key is the distinctive part. Even a weak account password cannot be brute-forced from stolen server data, because the attacker would also need a key that only exists on the user's own devices. 1Password states that it is SOC 2 Type 2 certified, and accounts can be created in its EU region (1Password.eu) as well as its US and Canadian regions, which helps UK organisations thinking about data location under UK GDPR. Staff use apps for Windows, macOS, Linux, iOS and Android and browser extensions that fill passwords, passkeys and two-factor codes.
What 1Password Business includes
Business is 1Password's plan for established organisations; 1Password now markets the product itself as its Enterprise Password Manager. Its core features:
- Shared vaults with permissions by user and custom group, so each team sees only its own credentials, plus limited-access guest accounts for specific vaults
- Watchtower, which flags weak, reused and breached passwords, sites where two-factor authentication is available but not set up, and other vault hygiene problems
- Unlock with SSO, letting staff open 1Password with the identity they already use. 1Password has set-up guides for Okta, Microsoft Entra ID, Google Workspace, JumpCloud and Auth0, and supports other OpenID Connect providers such as Duo, OneLogin and Ping Identity
- Automated provisioning and deprovisioning of users and groups from Microsoft Entra ID, Okta, Google Workspace, JumpCloud, OneLogin and Rippling, so vaults follow your joiners and leavers process
- Security policies and custom rules: sign-in requirements, two-factor enforcement and controls on sharing, including temporary shares with expiry dates
- Reports and activity logs on usage and account activity, with event streaming to SIEM tools such as Splunk, Elastic, Sumo Logic and Panther
- Passkeys, secure notes, documents and two-factor codes stored alongside passwords
- A free 1Password Families membership for each Business user, which keeps personal passwords out of the work vault
The smaller Teams Starter Pack is a fixed-size pack for small teams with general security alerts rather than Watchtower and without identity provider integration, and Enterprise adds onboarding support and regular business reviews for larger organisations.
The wider 1Password range
1Password now presents itself as a wider access platform, which it calls Unified Access. Beyond the password manager, it sells a set of enterprise products, usually bought directly by larger organisations:
| Product | What it does |
|---|---|
| 1Password Device Trust | Checks device health and identity and blocks non-compliant devices from protected apps, guiding users to fix problems themselves. Device Trust Connect integrates with Okta, Microsoft Entra ID (P1 or higher) and Google Workspace; Device Trust Core works without an identity provider. |
| SaaS Manager | Discovers the managed and unmanaged SaaS and AI apps staff use, automates provisioning, deprovisioning and access reviews, and flags unused licences and duplicate tools |
| Privileged Access | Grants access only when requested and only for the task, then removes it, so neither people nor AI agents keep standing privileges |
| Secrets management and developer tools | The 1Password CLI, SDKs and integrations that keep secrets out of code and pipelines |
| Credential Broker | Verifies automated workloads and AI agents when they request access and releases only the credentials their policy allows; in public preview for Enterprise Password Manager customers at the time of writing |
What we supply is 1Password Business, through 1Password's managed service provider edition, which gives you the full Business feature set billed monthly on the seats in use. If you are interested in the enterprise products above, we can help you assess whether they fit alongside your existing identity security and zero trust controls.
1Password Business vs Keeper
1Password and Keeper Security are the two options we are most often asked to compare. Both are strong, zero-knowledge business password managers; the differences are in what is included and how far each extends:
| 1Password Business | Keeper Business / Enterprise | |
|---|---|---|
| Encryption model | Account password plus device-held 128-bit Secret Key | Zero-knowledge, keys derived from master password or SSO identity |
| Single sign-on | Unlock with SSO included in Business | SAML 2.0 SSO in Enterprise |
| Provisioning | Included in Business | SCIM and AD/LDAP in Enterprise |
| Breach monitoring | Watchtower included | BreachWatch add-on |
| Personal vaults for staff | Free Families membership per user | Free Family Plan per user on every business edition |
| Privileged access | Separate enterprise Privileged Access product | KeeperPAM and Endpoint Privilege Manager |
| Licensing through us | Per seat, billed monthly on usage | Per user, with add-ons only for those who need them |
Which should you choose?
Choose 1Password Business if you want SSO unlock and provisioning without moving up an edition, Watchtower included as standard, and a vault staff find easy to adopt. Choose Keeper if you expect to add privileged access, remote connection management or endpoint privilege control on the same platform. If NordPass is on your shortlist too, see the three-way comparison on business password managers.
Who 1Password suits
1Password Business suits small and mid-sized UK organisations that want staff to stop reusing passwords and share credentials safely, without a steep learning curve. It is a common answer to insurer questionnaires and supplier security reviews, because you can show who has access to which vaults, enforce two-factor authentication and remove access immediately when someone leaves. It works particularly well where staff already sign in to Microsoft 365 or Google Workspace, because Unlock with SSO means one less password to remember, and it fits organisations with changing headcount, since seats are billed on what is used. See 1Password licensing for how the MSP edition is billed.
Deployment and how we help
- Scope the number of seats, your identity provider and which teams need which shared vaults.
- Connect Unlock with SSO and automated provisioning to Microsoft Entra ID, Google Workspace, Okta or JumpCloud.
- Set up groups, vaults and policies, including two-factor enforcement and sharing controls.
- Migrate staff from browser-saved passwords and spreadsheets, then switch off browser password saving by policy.
- Run it: joiners, leavers, vault access and recovery requests handled by our UK team, with Watchtower reviews at agreed intervals.
Our technicians work in your account through 1Password's MSP console, which requires them to re-verify with multi-factor authentication before administrative actions and records what they do; it does not show vault contents. Pricing depends on seat numbers: ask us for a quote. Contact us to roll out 1Password Business.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is 1Password Business?
1Password Business is 1Password's password manager plan for organisations. It gives every user an end-to-end encrypted vault and gives administrators shared vaults with permissions, Watchtower security alerts, Unlock with SSO, automated provisioning, security policies, reports and activity logs.
What is the 1Password Secret Key?
The Secret Key is a 128-bit key created on the user's device when their account is set up. It is combined with the account password to encrypt vault data, and 1Password never holds it, so stolen server data cannot be cracked by guessing the password alone.
Can 1Password use Microsoft Entra ID for sign-in?
Yes. Unlock with SSO lets staff open 1Password with their Microsoft Entra ID identity, and Okta, Google Workspace, JumpCloud and other OpenID Connect providers are also supported. Users and groups can also be provisioned and removed automatically from Entra ID.
What is the difference between 1Password Teams and Business?
The Teams Starter Pack is a fixed-size pack for small teams with core sharing, admin features and general security alerts. Business adds identity provider integrations such as Unlock with SSO and automated provisioning, Watchtower alerts, more detailed reporting and a free Families membership for each user, with no fixed team size.
Where is 1Password data stored?
1Password accounts are created in one of three regions: the United States, Canada or the European Union (1Password.eu). The region is chosen when the account is set up, so UK organisations that want EU hosting should decide before they start.
Is 1Password better than Keeper?
Neither is better for everyone. 1Password Business includes SSO unlock, provisioning and Watchtower as standard, while Keeper offers a wider range of add-ons for privileged access, remote connections and endpoint privilege management. The right choice depends on your identity set-up and whether you need those privileged access features.