Deploy 1Password for Mac and Windows

Deploy 1Password for Mac

Step 1: Plan your deployment

Determine which installer is best for your use case:

• If you need automatic app updates, download the 1Password.app installer.
• If you want your IT team to manage app updates, download the 1Password.pkg installer.

Step 2: Deploy 1Password

1Password must be installed in the /Applications folder to work properly. Don’t install the app in the user ~/Applications folder.

If your deployment tool requests a bundle identifier, enter com.1password.1password. If it also requests a group identifier, enter 2BUA8C4S2C.com.1password.

Step 3: Monitor for updates

Subscribe to the RSS feed to keep track of 1Password for Mac updates. To install updates, follow the guidelines for the installer you used:

• 1Password.app: Replace the installer at least every 6 months.
• 1Password.pkg: Replace the installer at least every month.

Deploy 1Password in a virtualized environment

If you deploy 1Password for Mac to a virtualized environment, you’ll need to make sure local data for the 1Password app is preserved between sessions. This will allow your users to unlock 1Password without entering their Secret Key or repeating the steps to set up a linked app or browser every time they’re provisioned to a new virtual machine.

Local data for 1Password is stored in this folder:

~/Library/Group\ Containers/2BUA8C4S2C.com.1password/Library/Application\ Support/1Password

To make sure your users can save and fill passwords in their browser, deploy 1Password in the browser for your team. The 1Password app also needs to be installed with the local data folder preserved between sessions.

Deploy 1Password for Windows

Step 1: Plan your deployment

1Password for Windows supports the following installation methods: Microsoft Store, MSIX, App Installer, and MSI.

Although you should choose the installation method that works best within your organization, here are the deployment options we recommend for most customers:

• If you use Intune, deploy through the Microsoft Store and set the install behavior to User.
• If you’ve disabled the Microsoft Store, deploy the MSIX.
  • To allow your team members to update 1Password, deploy the MSIX as a Win32 app and set the install behavior to User.
  • To manage and deploy updates to 1Password, deploy the MSIX as a line-of-business app and set the install behavior to User.
• If you don’t use an endpoint management tool like Intune, consider the App Installer.
• If you need to deploy to PCs on Windows 10 19H2 or earlier, use the MSI instead.

  Learn more about MSI-specific deployment options.

After you choose your deployment method, consider these additional options before you continue:

• If you need to control settings in the 1Password app, or if you want other installations of 1Password to be automatically removed from your team member’s PCs, learn how to use mobile device management to set the deployed version of 1Password as a managed installation.
• If you need to deploy 1Password in a virtualized environment, learn how to preserve local data for the 1Password app.

Step 2: Deploy 1Password

Learn how to deploy 1Password for Windows through the following methods:

• Deploy through the Microsoft Store
• Deploy the MSIX as a Win32 app
• Deploy the MSIX as a line-of-business app

Deploy through the Microsoft Store

To deploy 1Password through the Microsoft Store, follow the steps to add a Microsoft Store app through Intune. For the “Install behavior” option, select User, then finish the remaining steps.

Deploy the MSIX as a Win32 app

To deploy the 1Password MSIX as a Win32 app:

1. Download these files, then create a new folder and move each file into it:
   • 1Password MSIX
   • InstallScript.ps1
   • UninstallScript.ps1
   • AppDetectScript.ps1
2. Prepare the app content for upload with the Microsoft Win32 Content Prep Tool.
3. Follow the steps to add and assign the Win32 app in Intune.
4. On the Program page, configure these values:
   • Install command: "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File .\InstallScript.ps1
   • Uninstall command: "C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File .\UninstallScript.ps1
   • Install behavior: Select User.
5. On the “Detection rules” page, select the “Rules format” dropdown, then select Use a custom detection script.
6. Upload the AppDetectScript.ps1 file you downloaded earlier.
7. Finish the remaining steps to add and assign the Win32 app.

Deploy the MSIX as a line-of-business app

To deploy the 1Password MSIX as a line-of-business app, download the 1Password MSIX, then follow the steps to add 1Password as a line-of-business app in Intune.

On the Assignmments page, follow these steps:

1. Assign your desired groups.
2. For each group, make sure User context is shown in the Install Context column.

Step 3: Monitor for updates

Visit the 1Password Releases website or subscribe to the RSS feed to keep track of updates to 1Password for Windows. Follow these guidelines depending on how you handle automatic updates:

• If you allow your team members to update 1Password themselves, replace the installer at least every 6 months.
• If you choose to deploy 1Password updates manually, replace the installer at least every month.

Appendix: MSI-specific deployment options

If you need to deploy the MSI, you can choose to configure some specific options:

• /norestart: Include this parameter to prevent team member’s PCs from restarting automatically to finish the installation of 1Password.
• MANAGED_INSTALL: Set this property to 1 to set the deployed version of 1Password as a managed installation.*
• MANAGED_UPDATE: Set this property to 1 to turn off the option for team members to update 1Password themselves.

* If you also want to control settings through mobile device management, learn how to set the managed installation option.

Appendix: Deploy 1Password in a virtualized environment

If you deploy 1Password for Windows to a virtualized environment, such as VMWare Horizon, you’ll need to make sure local data for the 1Password app is preserved between sessions. This will allow your users to unlock 1Password without entering their Secret Key or repeating the steps to set up a linked app or browser every time they’re provisioned to a new virtual machine.

Local data for 1Password is stored in this folder:

%LocalAppData%\1Password

To make sure your users can save and fill passwords in their browser, deploy 1Password in the browser for your team. The 1Password app also needs to be installed with the local data folder preserved between sessions.