Description
1Password Business, billed monthly per user
A password manager for the whole organization: shared vaults scoped by group, private vaults administrators cannot read, single sign-on, and SCIM provisioning that creates and revokes accounts from your identity provider. Priced per user, per month, with no minimum and no annual commitment.
The password manager holds the credentials to everything else you own. That is the argument for the Secret Key model: your account password alone is not enough to open a vault, because decryption also needs a 128-bit key that never leaves your devices. Someone who phishes a password still has nothing.
What your team gets
Shared vaults for credentials a team needs, scoped by group. Marketing sees the marketing vault, finance sees finance. Access can be view only, fill only, or full edit.
A private vault for each person, which administrators cannot read. That matters for adoption: people will not put their own logins somewhere the boss can see.
Apps and browser extensions across macOS, Windows, Linux, iOS and Android, with unlimited devices per user and offline access to vaults.
Passkey support, so accounts that have moved past passwords still live in one place.
Developer tools, including SSH key signing, Git commit signing, a CLI and secrets in CI/CD pipelines.
What administrators get
SCIM provisioning with Microsoft Entra ID, Google Workspace, Okta, OneLogin, Rippling and JumpCloud. Accounts created when someone joins, revoked automatically when they leave. Offboarding by hand is the step that gets forgotten, and the password manager is the one system where forgetting it matters most.
Single sign-on, so your existing MFA and conditional access rules apply to 1Password rather than being configured separately.
Custom groups and granular vault permissions, view only, fill only or full edit.
Watchtower across the whole organization, flagging weak and reused passwords, logins missing two-factor authentication, and credentials found in known breaches.
Event streaming to SIEM tools including Splunk, Elastic, Sumo Logic and Panther.
Custom business reports on usage, account activity and onboarding progress.
Twenty guest accounts for external collaborators, and a free Families plan for every user.
Data residency in Canada
1Password lets you choose where encrypted data is stored: the United States, Canada, or the European Union. If you have a Canadian residency requirement, say so when you order and we will set the account up in the Canadian region from the start. Moving later is harder than choosing correctly now.
Why buy it from Nuformat
Billed monthly alongside the rest of your security stack, on one invoice, with no annual commitment. We set up the tenant, connect it to your identity provider, and stay involved after go-live. If you are already running Microsoft Entra ID, Sophos ITDR or TrendAI identity protection with us, this sits alongside them rather than beside them.
Frequently asked questions
Is there a minimum number of users?
No. 1Password Business is priced per user with no minimum seat count and no annual commitment through Nuformat. Add or remove users and the next invoice follows.
What is the Secret Key?
A 128-bit key generated on your device and stored there, used alongside your account password to decrypt your data. Both are required, so a stolen or phished account password on its own does not open a vault. 1Password cannot decrypt your data either, which is what zero-knowledge means in practice.
Where is our data stored?
1Password offers data residency in the United States, Canada or the European Union. Canadian organizations with residency requirements can keep encrypted data in Canada. Choose the region when the account is created, because moving it later is harder.
Does it work with Microsoft Entra ID or Okta?
Yes. Single sign-on works with Microsoft Entra ID, Okta, Google Workspace, OneLogin, Rippling and JumpCloud, and SCIM provisioning creates and removes accounts automatically as people join and leave.
What does Watchtower do?
It audits every credential in your vaults and flags weak passwords, reused passwords, accounts missing two-factor authentication, and any credential that has appeared in a known breach. Administrators see this across the whole organization rather than one account at a time.
What happens when someone leaves?
With SCIM provisioning, removing them from your identity provider revokes their 1Password access automatically. Without it, an administrator suspends the account and recovers any items held in their private vault.
Does 1Password support developer workflows?
Yes. SSH key signing, Git commit signing, a CLI, SDKs, and integrations with IDEs, CI/CD pipelines and infrastructure-as-code tools.
How many guest accounts do we get?
Twenty. Guests can be given access to specific shared vaults without a full user licence, which suits contractors and external collaborators.
Get started
Tell us your user count and whether you need Canadian data residency. We will confirm the monthly cost, set up the tenant and connect it to your identity provider. Nuformat serves Canada and the United States.
Request a quoteFeature set as published by 1Password. Pricing and availability confirmed by Nuformat at the time of order.