How to Set Up Okta SCIM Provisioning for 1Password (2026)

title: How to Set Up Okta SCIM Provisioning for 1Password (2026) slug: how-to-set-up-okta-scim-provisioning-for-1password excerpt: Automate 1Password user provisioning and vault access from Okta using 1Password SCIM Bridge. Step-by-step setup guide. post_type: how-to

Lead

When Okta SCIM provisioning is set up for 1Password, new employees are automatically created in 1Password and assigned to vaults the moment they're assigned to the right Okta group. Deprovisioning is immediate: deactivate the Okta account, and 1Password suspends access across all vaults.

Quick answer:

• Deploy or request 1Password SCIM Bridge (hosted on 1Password's cloud)
• Generate a bearer token and note your bridge URL
• Paste both into Okta's Provisioning tab
• Map Okta groups to 1Password vaults and assign users

Verified against:** Okta Workforce Identity Cloud and 1Password Business on 2026-05-04.

Prerequisites

How ScaleIT handles this: See how compliance works

• 1Password Business or Enterprise plan. SCIM provisioning is not available on the Teams or Family plans. You must have a team account on 1Password.com.
• Okta Lifecycle Management licensed. Your Okta plan must include the Lifecycle Management add-on.
• 1Password SCIM Bridge deployed or provisioned. The bridge can be hosted on 1Password's cloud (easiest) or self-hosted on your infrastructure (Google Cloud Platform, Azure, DigitalOcean, etc.).
• 1Password owner or admin access. You need to be able to generate and retrieve the SCIM bridge credentials from 1password.com → Integrations.
• Okta admin access. You need to configure the 1Password app integration in Okta.
• The 1Password Enterprise Password Manager app already installed in Okta. Search for "1Password Enterprise Password Manager" in the Okta Integration Network and add it.

Steps

Step 1: Set Up or Request 1Password SCIM Bridge

1. Log in to your 1Password team account at start.1password.com.
2. Go to → Integrations (sidebar) → Automated User Provisioning (or SCIM Bridge if you haven't set it up yet).
3. If you see a "Set Up SCIM Bridge" option:

• Click it and select your deployment region (e.g., US, EU, Canada).
• 1Password will provision a hosted bridge for your account within ~60 seconds.
• A bearer token and bridge URL (e.g., https://scim.example.com) will be displayed. Copy both and save them (the bearer token is shown only once).

1. If the bridge is already set up, you can regenerate credentials if needed from → Manage Credentials.

Step 2: Confirm Provisioning is Enabled

1. Still on the Automated User Provisioning page (or integrations page), make sure Provisioning users & groups is toggled On.
2. This setting allows Okta to provision users and groups to 1Password. Without it, Okta will receive an error.

Step 3: Add the 1Password App to Okta

1. In the Okta Admin Console, go to → Applications → Browse App Catalog.
2. Search for → 1Password Enterprise Password Manager.
3. Click it, then click → Add Integration.
4. Choose your Region (must match the region of your 1Password account).
5. Enter the beginning of your 1Password sign-in address (e.g., if your URL is acme.1password.com, enter acme).
6. For Sign-in method, select → Bookmark-only → Done.

Step 4: Enable API Integration in Okta

1. Click → Provisioning tab on the 1Password app tile.
2. Click → Configure API Integration.
3. Check → Enable API integration.
4. In the Base URL field, paste your 1Password SCIM bridge URL. Do not include a trailing slash. Example: https://scim.example.com
5. In the API Token field, paste your bearer token.
6. Click → Save.
7. Okta will run a validation call. If it succeeds, you'll see a success message. If you see a 401 error, double-check the token. If you see a 404, verify the bridge URL is correct.

Step 5: Enable Provisioning Actions

1. Still on the Provisioning tab, go to → To App in the Settings section.
2. Click → Edit.
3. Check the following:

• Create Users
• Update User Attributes
• Deactivate Users
• Leave Sync Password unchecked (1Password uses Okta SSO)

1. Click → Save.

Step 6: Review and Customize Attribute Mappings (Optional)

1. On the Provisioning tab, go to → Attribute Mappings.
2. Confirm the default mappings are in place:

• userName → Okta username (this is the user's email address)
• givenName → first name
• familyName → last name
• emails[type eq "work"].value → email address

1. These defaults are almost always correct. Customize only if you have special requirements (consult 1Password support if unsure).
2. Click → Save.

Step 7: Assign Users and Test Provisioning

1. Go to the → Assignments tab on the 1Password app in Okta.
2. Click → Assign and add one test user.
3. Go back to → Provisioning → To App and click → Edit (if you haven't already).
4. Verify Create Users, Update User Attributes, and Deactivate Users are all checked.
5. Click → Save.
6. Wait a few seconds for the provisioning job to run. Check the Provisioning Log for success.
7. Log in to 1password.com and verify the test user appears in your account.

Step 8: Map Okta Groups to 1Password Vaults (Optional but Recommended)

1. Go back to → Provisioning → Push Groups.
2. Create Okta groups that mirror your 1Password vaults (e.g., "Vault-Engineering", "Vault-Finance").
3. Click → Push Groups and select each group to sync to 1Password.
4. Once synced, log in to 1Password and go to each vault → Sharing.
5. Add the pushed group with the appropriate access level (View Items, Edit Items, Manage Vault).
6. Now, adding someone to the Okta group automatically grants them vault access on the next sync.

Verify

• Assigned user is created in 1Password. Check your 1Password account at start.1password.com → Team Members and confirm the test user is listed.
• No provisioning errors. Go to the 1Password app's Provisioning tab → Provisioning Log in Okta and confirm all events show success.
• User receives invitation (if new). If the user's email wasn't in 1Password before, they should receive an invitation email. They need to accept it to complete setup.
• Email domain is in 1Password allowed list. If the user's email domain isn't in your 1Password account's allowed domains, provisioning will fail. Add it at start.1password.com → Integrations → Automated User Provisioning → Allowed Domains.

Troubleshooting

Symptom: "Error authenticating" when setting up API integration

Cause: The bearer token is invalid, expired, or the base URL is malformed. Alternatively, provisioning isn't enabled on the 1Password account.

Fix: Check start.1password.com → Integrations → Automated User Provisioning and confirm Provisioning users & groups is toggled On. Then generate a fresh bearer token and bridge URL from Manage Credentials and paste them into Okta.

Symptom: User is created but provisioning shows "Error" or "Not imported"

Cause: The user's email domain isn't in 1Password's allowed domains list, or the user email format is incorrect.

Fix: Go to start.1password.com → Integrations → Automated User Provisioning → Allowed Domains and add the email domain. Then retry the provisioning job from the Provisioning Log in Okta.

Symptom: "401 Unauthorized" when testing API credentials

Cause: The bearer token is invalid or has been revoked.

Fix: Log in to start.1password.com → Integrations → Automated User Provisioning → Manage Credentials and generate a new bearer token. Paste it into Okta.

Symptom: "404 Not Found" when testing API credentials

Cause: The bridge URL is incorrect or includes a trailing slash.

Fix: Double-check your bridge URL. It should look like https://scim.example.com (no trailing slash, no /scim/v2). Okta appends the SCIM path automatically.

Symptom: Users appear in 1Password but vault memberships aren't syncing

Cause: Okta groups haven't been pushed to 1Password, or the push failed.

Fix: Go to Provisioning → Push Groups on the 1Password app tile in Okta. Manually push each group. Check the Provisioning Log to ensure the push succeeded. Then log in to 1Password and assign the groups to vaults in each vault's Sharing section.

CTA

Once 1Password SCIM is live, vault onboarding becomes a zero-touch process. If you're juggling provisioning across multiple apps and want a clear rollout plan, or if you're seeing provisioning errors you can't resolve, our team can help scope and debug the setup. Reach out for a quick conversation.