1Password lets administrators take ownership of work-related accounts and the credentials used to access them. The experience depends on your setup:
- With 1Password Business: Administrators can discover work-related items stored in team members’ vaults and take ownership of them on 1Password.com.
- With 1Password SaaS Manager: Administrators can also assess the risk associated with each discovered application and manage credentials from SaaS Manager.
Both experiences share the same underlying design, which provides visibility and control over work-related accounts and their credentials while preserving 1Password’s zero-knowledge and end-to-end encryption security model.
Technical design
Item and app discovery
1Password can discover work-related items, applications, and credentials in business account vaults when item or app discovery is turned on.
If you use 1Password Business without SaaS Manager, administrators take ownership of the credentials item discovery identifies and manage them on 1Password.com. Company-managed credentials appear on the Items page.
Risk assessment with SaaS Manager
If you use SaaS Manager, it assigns a risk score to each discovered application based on the risk of the associated accounts. It estimates risk using factors such as the potential impact if an account is compromised, the sensitivity of the data the app can access, the level of privileged access associated with the account, and the likelihood of common real-world attack patterns. These risk scores are continuously refined based on actual usage, access, and security posture data.
Transferring account ownership
When an administrator decides to take ownership of a work-related account, 1Password creates a company-managed credential policy. If you use SaaS Manager, the policy is created in 1Password SaaS Manager. If you use 1Password Business only, the policy is created on 1Password.com. In both cases, the policy identifies the credentials used to access the account by attributes such as domain and username. The policy defines which credentials should be managed, but it doesn’t modify any credential data on its own.
When a team member unlocks 1Password on their device, the 1Password client evaluates the credentials the team member can access against the company-managed credential policy. If the client finds a matching credential, it begins the ownership transfer locally on the device.
During the transfer, the 1Password client decrypts the credential, generates a new item-level encryption key, and re-encrypts the credential with that key. The new key is then shared with an authorized group, allowing people in that group to manage the credential. By default, the authorized group is the Administrators group in your 1Password account.
Newly transferred credentials are stored on 1Password servers and are always end-to-end encrypted. Administrators can assign team members access to credentials and manage their permissions in SaaS Manager or on 1Password.com, depending on which setup you use.
Security model
Company-managed credentials remain end-to-end encrypted throughout the ownership transfer process. Credential data is encrypted with a symmetric, item-level encryption key using AES-256-GCM, and only devices belonging to authorized groups can decrypt it.
Credential ownership transfers are performed locally on the 1Password client. A new symmetric item-level key is generated on the device and used to re-encrypt the credential data, making sure the credential is never decrypted or re-encrypted on the 1Password server.
The new item-level key is encrypted for the authorized group using RSA-OAEP with 2048-bit moduli and a public exponent of 65537. To prevent unauthorized transfer of credentials, 1Password uses DNS-based verification to establish an external source of trust for the group keys involved in the credential ownership transfer.
Risk considerations
Company-managed credential fields, such as passwords, remain concealed to team members in the 1Password apps. Team members can use company-managed credentials by autofilling with the 1Password browser extension. While 1Password controls access to company-managed credentials, it can’t prevent a team member from attempting to capture credential information after it’s been used. We recommend using multi-factor authentication or passkeys for company-managed credentials.
Was this article helpful?
Glad to hear it! If you have anything you'd like to add, feel free to contact us.
Sorry to hear that. Please contact us if you'd like to provide more details.