1Password for Business

Key facts

• 4iT is a 1Password partner. 1Password is the password manager we deploy, configure and manage for client businesses, and what we use internally.
• Business plans provide unlimited shared vaults with role-based permissions, so credentials are shared by team or function instead of being passed around in chat and email.
• Watchtower reports weak, reused and breached credentials. On business accounts, administrators see the security problems across shared vaults without being able to read the passwords themselves.
• Guest accounts let contractors, bookkeepers and external parties reach specific vaults without paying for a full licence.
• 1Password supports single sign on with Entra ID, Okta, Google Workspace, JumpCloud and OneLogin, and SCIM provisioning so accounts follow your directory rather than being maintained by hand.
• Vaults are protected by two separate secrets, your account password and a device Secret Key, so a stolen or guessed password on its own does not open the vault.
• 1Password holds SOC 2 Type II certification and provides activity and audit logs, which is useful evidence for cyber insurance questionnaires and compliance work.
• Passkeys are supported, both stored in the vault and used to unlock it.

Why does a business need a password manager at all?

Because the alternative is already in place and it is worse. In most small businesses that have not addressed this, credentials live in a spreadsheet on a shared drive, in a browser profile tied to one person’s login, in a notes app, or in someone’s head. The same password appears across several systems, and when one of those systems is breached elsewhere on the internet, every other account using that password is exposed. Credential reuse is the mechanism behind a large share of successful attacks on small businesses, and it costs nothing to exploit.

A password manager changes what is possible rather than just what is recommended. Once every login is generated and stored rather than remembered, unique passwords stop being an instruction people ignore and become the default behaviour. That single change removes an entire category of risk, and it does more for a small business than most of the security products sold above it.

What does 1Password Business give you?

Structure, visibility and a way out. Shared vaults let you organise credentials by function, so the finance team reaches the accounting and banking logins, the operations team reaches the systems they run, and nobody has standing access to everything by default. Permissions are set per vault, so you can distinguish between people who may use a credential and people who may change or share it.

Watchtower is where the reporting sits. It flags reused passwords, weak passwords, credentials that have turned up in a known breach, and accounts that have multi-factor authentication available but not switched on. On a business account this rolls up across shared vaults, so an administrator can see that there are eleven reused passwords in the finance vault and get them fixed, without being able to see what those passwords are. That distinction matters: you get oversight without creating a single person who knows every credential in the business.

How does 1Password handle staff joining and leaving?

This is the part that usually justifies the cost on its own. When someone joins, they are added to the vaults their role needs and they have working access on day one without anyone reading passwords out to them. When someone leaves, their account is suspended centrally and their access to every shared credential ends at once. Anything held in the shared vaults stays with the business rather than walking out in a personal browser profile.

Compare that with the usual situation, where offboarding means trying to remember which systems a person had logins for, and then deciding whether it is worth the disruption of changing shared passwords that half the team uses. Most businesses quietly skip that step, which is exactly how former staff retain access for years. If you connect 1Password to your directory, suspension follows the identity automatically. See IT onboarding and offboarding for how this fits the wider process.

How does 4iT deploy and manage 1Password?

We start by working out where credentials live now, which is usually more places than anyone expects, then design the vault structure around how the business is organised rather than importing the existing mess into a new tool. Sharing rules, permissions and administrator roles are set deliberately, single sign on and provisioning are connected to your identity platform where you have one, and the applications and browser extensions are deployed to the fleet so nobody has to install anything themselves.

Adoption is the part that decides the outcome, so we run staff through it properly rather than sending a link and hoping. After that it is ongoing: Watchtower reports get acted on, vaults get tidied as teams change, joiners and leavers are handled as they happen, and the audit trail is there when an insurer or auditor asks. Credential hygiene is one layer of a security programme, and it sits alongside multi-factor authentication, security awareness training and dark web monitoring.