1Password SCIM provisioning from Google Workspace

1Password provisions users through the 1Password SCIM bridge, a small service you deploy in your own cloud. Setting it up gives you two things: the bridge's URL and a bearer token. Most of this guide shows how to get them. In AnySCIM you then paste both and choose who gets 1Password.

Before you start

• A 1Password Business account.
• A 1Password owner or administrator.
• A place to run the bridge with a public HTTPS domain, for example scim.example.com. 1Password has one-click guides for Google Cloud, Azure, AWS and DigitalOcean, plus Docker and Kubernetes.

Step 1: Generate the bridge credentials

1. Sign in to your account on 1Password.com and open Integrations in the sidebar.
2. Set up automated user provisioning with the self-hosted SCIM bridge. If provisioning is already set up with another integration, deactivate it first under More Actions → Deactivate Provisioning.
3. Generate the credentials. 1Password creates a scimsession file and a bearer token.
4. Click Save in 1Password to store both in a vault, and download the scimsession file.

The bearer token goes to AnySCIM. The scimsession file goes only to the bridge: never share it.

Step 2: Deploy the SCIM bridge

1. Follow 1Password's deployment guide for your platform and give the bridge the scimsession file.
2. Point your domain, for example scim.example.com, at the bridge. Use a static IP address: an ephemeral one can change and stop provisioning.
3. Open the domain in a browser and sign in with the bearer token. The status page should show the bridge as healthy.

Step 3: Add the token to AnySCIM

1. Open Connections → New connection and choose 1Password.
2. In the base URL, replace {scim_bridge_domain} with your bridge's domain, for example https://scim.example.com/scim.
3. Paste the bearer token and click Test connection.
4. Choose who gets 1Password: tick the Google groups or organizational units. Turn on Push group membership to create 1Password groups from Google groups, then give those groups access to vaults in 1Password.
5. Check the dry-run and click Activate connection.

Good to know

• New users get an invitation to create their 1Password account. Once they accept, the bridge confirms them without delay.
• Provision Managers: the bridge creates a group with this name to confirm users. In most cases, nobody should be added to it.
• Protected groups: groups with the Recover Accounts or Manage All Groups permissions, such as Owners and Administrators, aren't managed by provisioning.
• Leavers: when a Google user is suspended, they're suspended in 1Password.

Troubleshooting

• 401 on every request: the bearer token doesn't match the bridge's scimsession file. Regenerate the credentials, update the bridge and paste the new token into the connection.
• 404 on every request: the base URL is missing /scim. It should end right where /Users begins.
• Connection worked, then stopped: the bridge's IP address or domain changed. Give it a static IP and check the status page.

FAQ

Which 1Password plan supports SCIM provisioning?

1Password Business. Automated provisioning connects your identity provider to your 1Password account through the SCIM bridge.

Why does 1Password need a SCIM bridge?

1Password is end-to-end encrypted, so confirming new users needs keys that 1Password's servers never hold. The bridge runs in your infrastructure with the scimsession file and does that step for you.

Can Google groups control 1Password vault access?

Yes. With Push group membership on, Google groups become 1Password groups. Give each group access to vaults once in 1Password, and membership then follows Google Workspace.