> ## Documentation Index
> Fetch the complete documentation index at: https://docs.accessowl.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Password

AccessOwl integrates with 1Password to provision and deprovision user access in your 1Password account.

## Capabilities

<CardGroup cols={2}>
  <Card title="Provisioning" icon="user-plus">
    AccessOwl creates user accounts and assigns them to the specified groups during access requests.
  </Card>

  <Card title="Deprovisioning" icon="user-minus">
    AccessOwl removes users from your 1Password account during access revocations.
  </Card>
</CardGroup>

## Prerequisites

* Membership in the **Owners** or **Administrators** group in your 1Password account, so you can invite the integration account and add it to the Administrators group.
* If your organization enforces **Unlock with SSO**, you'll need to exempt the integration account from it. See [Unlock with SSO](#unlock-with-sso) below.

## Setup

<Steps>
  <Step title="Add 1Password in AccessOwl">
    Either add a new application or open Applications and click the +-symbol, then continue.
  </Step>

  <Step title="Invite the integration account">
    Follow the setup instructions in AccessOwl. You will be notified via Slack once the integration account's initial setup is complete.

    <Warning>
      If your organization enforces **Unlock with SSO**, the integration account must be exempted from it before it can sign in. See [Unlock with SSO](#unlock-with-sso).
    </Warning>
  </Step>

  <Step title="Add the integration account to the Administrators group">
    Wait for the Slack notification indicating the initial setup is complete before attempting to add the integration account to the Administrators group. Then, in 1Password, confirm the new user and add it to the Administrators group so it can manage other users.

    <Note>
      The integration account is added to the Administrators group because that group grants the permissions to invite, suspend, and remove people, and to manage group memberships, which AccessOwl uses to provision and deprovision access.
    </Note>
  </Step>

  <Step title="Add 1Password groups manually (optional)">
    If you plan to provision 1Password groups, add them manually under the application's permissions in AccessOwl.

    <Warning>
      Groups do not automatically sync. If you can't find your 1Password groups in AccessOwl, ensure you added them manually.
    </Warning>
  </Step>
</Steps>

## Unlock with SSO

If your organization enforces **Unlock with SSO**, the integration account can't sign in until you exempt it. AccessOwl signs the integration account in with its own account password and Secret Key, and it can't unlock through SSO the way a person does. While Unlock with SSO is enforced across your organization, the integration account gets blocked and provisioning can't run.

Have your **1Password account owner** exempt the integration account from Unlock with SSO, so it keeps using the account password and Secret Key that AccessOwl manages while the rest of your organization stays on SSO. This is configured on your 1Password side at the organization level, so it isn't something AccessOwl changes for you.

## FAQ

<AccordionGroup>
  <Accordion title="Access requests to groups are taking a long time">
    New 1Password users must accept the invite and complete the setup before they can be assigned to a group. The integration account checks at regular intervals to detect when the invitation has been accepted.
  </Accordion>

  <Accordion title="A request for a 1Password group was reassigned">
    Whenever a user's 1Password invite expires, AccessOwl automatically reassigns the outstanding access request for additional user groups. Resend the invite manually and speak with the user to ensure they accept it.
  </Accordion>
</AccordionGroup>