Automated provisioning

Set up 1Password automated provisioning with Google Workspace (beta)

Learn how to set up and use 1Password automated provisioning with Google Workspace.

Important

Before you turn on provisioning, if you have existing users in 1Password, make sure they’re in at least one Google Workspace group that you plan to provision. Any users that aren’t in a provisioned group will be suspended in 1Password.

With 1Password Business, you can integrate 1Password with Google Workspace to automate many common administrative tasks:

Provision

  • Create users: Users in selected Google Workspace groups will be provisioned to 1Password.
  • Update user attributes: Changing user attributes in your Google Workspace directory, such as the user’s name and email address, will change the mapped attributes in 1Password.
  • Deactivate users: Suspending or deleting a user in Google Workspace will suspend them in 1Password. Removing them from their last synced group also suspends them.

Manage groups

  • Sync groups: Groups you select in Google Workspace will be created in 1Password.
  • Update group membership: Adding or removing users from a synced group will update their 1Password group membership.
  • Remove groups: Deleting a synced group in Google Workspace will remove it from 1Password.

To integrate 1Password with Google Workspace, you’ll create a Google service account and authorize it as an API client that can read your directory, then run a short script that lets 1Password use it to keep your directory in sync automatically.

Before you begin

Before you begin, review the considerations and current limitations of automated provisioning.

To set up automated provisioning, you’ll need to be in the Owners or Administrators group in your 1Password Business account. If you have existing users in 1Password, you’ll also need to:

  • Make sure they’re in at least one Google Workspace group that you plan to provision. Any users that aren’t in a provisioned group will be suspended in 1Password.
  • Make sure their email address domains are in the allowed domains list. Public domains, such as gmail.com, aren’t currently supported.

Google Workspace and Google Cloud requirements

A Google Workspace Super Administrator must grant the service account read-only access to your directory, using domain-wide delegation in the Google Admin console. 1Password never receives your administrator credentials, only the service account key.

In Google Cloud, the person who creates the service account and runs the setup script needs:

  • Permission to create a service account, enable APIs, and create the sync job and its hourly trigger. The Owner role, or Editor with Cloud Run Admin, includes these permissions. If you’re not sure which permissions you have, view your current access in Google Cloud.
  • Permission to create service account keys. Some Google Cloud organizations block key creation by default, even for Owners. If yours does, an Organization Policy Administrator can allow service account key creation.
  • A project with billing turned on. The hourly sync runs in Cloud Run and Cloud Scheduler, both of which require a billing account. The sync stays within Google Cloud’s free usage limits.

Tip

Create the Google Workspace groups you plan to sync before you start step 1. The setup process doesn’t refresh the list of groups, so any you create partway through won’t appear. To see how provisioning works before you sync your whole organization, start with a test group that contains a few users.

Step 1: Create a Google service account and authorize it

To integrate 1Password with Google Workspace, you’ll create a Google service account and authorize it as an API client that can read your directory, then run a short script that lets 1Password use it to keep your directory in sync automatically.

These steps were recorded in September 2026 and may have changed since. Refer to Google's documentation to create a project, create a service account, and create a service account key.

1.1: Create a Google service account and key

Sign in to your account on the Google Cloud Console and follow these steps.

  1. In the Google Cloud Console, create a new project for 1Password provisioning. You can also type “create a project” in the search bar at the top of the console.

    If you have an existing project that you want to use, select the project name in the top navigation.

  2. Open the Google Cloud Marketplace and find the Admin SDK API. If you’re asked to select a project, select the one you created for 1Password provisioning.
  3. Select Enable to turn on the API. This will take a moment.
  4. Select the navigation menu in the top left, then select IAM & Admin > Service Accounts.
  5. Select Create service account, fill out the Service account name field, then select Done.
  6. Select the service account you just created, then select Keys.
  7. Select Add Key > Create new key.
  8. Select JSON, then select Create. The service account key will be downloaded to your computer.

    If you see an error that service account key creation is disabled, your Google Cloud organization blocks it by default. Ask an Organization Policy Administrator to follow Google's steps to allow service account key creation, then try again.

  9. Save the service account key in 1Password so you can find it later.

1.2: Authorize the service account in Google Workspace

A Google Workspace Super Administrator needs to complete these steps. The scopes you add give the service account read-only access to your users, groups, group memberships, and audit reports.

  1. On the Details tab of the service account you created, select Advanced settings.
  2. Select the copy button to copy the Client ID.
  3. Open the Domain-wide Delegation page in the Google Admin console.
  4. Follow Google’s steps to add a new client. Paste the Client ID you copied before, then copy and paste the following scopes as a single line in the OAuth scopes field:
    https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.group.member.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly
  5. Select Authorize.

Step 2: Set up provisioning in 1Password

After you’ve created your Google service account, you can set up automated provisioning in 1Password:

  1. Sign in to your account on 1Password.com.
  2. Select Integrations in the sidebar.
  3. Select Google Workspace in the User Provisioning section.
  4. Select Set up hosted provisioning.

2.1: Upload your Google Cloud credentials

Important

For this step, you’ll need the email address for a Super Administrator, or an account that has the Users > Read, Groups > Read, and Reports Admin API privileges. You can create a custom administrator role with only those privileges if you prefer.

When you get to the “Upload Google Cloud credentials” page:

  1. Select Select a .json Google Workspace account key to upload, then select the .json key you created in step 1.
  2. In the “Google workspace administrator account (email)” field, enter the email address of the administrator in Google Workspace that the service account will act on behalf of.

    1Password uses this address to read your directory through the service account. It never receives the administrator's password.

  3. Select Next.

2.2: Set up automated sync

To keep your account secure, 1Password doesn’t store your Google Workspace credentials. Instead, you’ll run a short script in Google Cloud Shell that sets up a job in your Google Cloud project. The job provides 1Password with the credentials it needs to provision new users and groups hourly, and deprovision removed ones immediately. Learn more about the setup script.

When you get to the “Set up automated sync” page:

  1. Select Copy to copy the setup script. To review the full script before you run it, select Show full script.
  2. Select Google Cloud Shell, which will open in a new browser tab. If Cloud Shell asks for permission to use your credentials, select Authorize.
  3. Paste the script into the shell, then press Enter to run it. The script sets up the sync to provision hourly and deprovision immediately.

    If the script stops with a billing or Cloud Scheduler error, turn on billing for the project and run the script again.

  4. Go back to the 1Password setup tab in your browser, then select Next.

2.3: Select Google Workspace groups to sync

Important

Users who aren’t in a selected group will be suspended in 1Password. When you select groups to sync to 1Password, you’ll be asked to review potential suspensions before they happen.

When you get to the “Select Google Workspace groups to sync” page:

  1. Choose one or more groups you’d like to provision to 1Password. You can use the search field to find groups, or select Select all.
  2. Select Finish.

Migrate from a self-hosted SCIM bridge

If you currently provision Google Workspace with a self-hosted SCIM bridge, you can migrate to automated provisioning. Before you begin, review the considerations for automated provisioning. Then follow these steps:

  1. If you don’t already have a Google service account, follow step 1 to create one.
  2. On the “Upload Google Cloud credentials” step, upload the .json service account key, enter the Google Workspace administrator account email, and select Next.
  3. On the “Set up automated sync” step, select Copy to copy the setup script, then select Google Cloud Shell. Paste the script into Cloud Shell and run it to provision hourly and deprovision immediately, then return to 1Password and select Next.
  4. On the “Select Google Workspace groups to sync” step, choose the groups you want to provision, then select Finish.

Next steps

When you turn on provisioning, existing 1Password users will be linked to Google Workspace users if their email address matches. If their email address is different, they’ll be invited to 1Password again, so make sure any affected team members update their email address before you turn on provisioning.

If a team member hasn’t accepted their invite after 2 days, they’ll receive a reminder email. Invites don’t expire.

If you have existing groups in 1Password that you want to sync with Google Workspace, add them to the groups managed by provisioning:

  1. Sign in to your account on 1Password.com.
  2. Select Integrations in the sidebar, then select Hosted Provisioning.
  3. Select Manage in the Managed Groups section, then select the groups to sync.

Tip

Learn about best practices for using automated provisioning.

Manage your settings

To manage which groups are provisioned to 1Password:

  1. Sign in to your account on 1Password.com.
  2. Select Integrations in the sidebar, then select Hosted Provisioning.
  3. Select Manage Google groups in the “Synced groups” section, then select or deselect groups to sync.

Users and groups are provisioned hourly and deprovisioned immediately. If you don’t want to wait for the next scheduled sync, select Sync now. You can sync again after 5 minutes.

Rotate your setup script

If you need a new setup script:

  1. Sign in to your account on 1Password.com.
  2. Select Integrations in the sidebar, then select Hosted Provisioning.
  3. Select Rotate script in the Credentials section.
  4. Select Rotate to confirm.

    This can't be undone. The hourly sync won't work again until you paste the new script into Google Cloud Shell.

  5. Select Copy, then select Google Cloud .
  6. Paste and run the new script.

Update your Google Cloud credentials

If your Google service account key or administrator email changes:

  1. Sign in to your account on 1Password.com.
  2. Select Integrations in the sidebar, then select Hosted Provisioning.
  3. Select Update in the Credentials section.
  4. Select a new .json Google Workspace account key to upload, then enter the Google Workspace administrator email.
  5. Select Done. Your existing credentials will stay active until 1Password validates the new ones.

Turn off provisioning

When you turn off provisioning, changes from your Google Workspace directory will no longer affect users in 1Password, but you can continue to add and remove team members on 1Password.com.

To turn off provisioning:

  1. Sign in to your account on 1Password.com.
  2. Select Integrations in the sidebar, then select Hosted Provisioning.
  3. Turn off Sync 1Password with my identity provider.

Tip

If you set up automated provisioning before immediate deprovisioning was available, you’ll see the option to turn it on instead. Select Turn on to start deprovisioning users and groups as soon as they’re removed from Google Workspace.

Get help

If users and groups aren’t being provisioned, make sure provisioning is turned on in your 1Password account:

  1. Sign in to your account on 1Password.com.
  2. Select Integrations in the sidebar.
  3. Select Hosted Provisioning.
  4. Make sure Sync 1Password with my identity provider is turned on.

Appendix: About the setup script

1Password never stores your Google Workspace credentials. Instead, the setup script in step 2.2 creates a small scheduled job inside your own Google Cloud project that gives 1Password the credential it needs, once an hour. You can review the whole script before running it by selecting Show full script during setup.

What the script does

When you run it, the script:

  1. Reads your project details. It uses the project currently selected in Cloud Shell and looks up your project’s default Compute Engine service account, which is the identity used to run the job.
  2. Enables two Google APIs: Cloud Run (run.googleapis.com) and Cloud Scheduler (cloudscheduler.googleapis.com).
  3. Creates a Cloud Run job named op-provisioning-sync that runs the official, public 1Password CLI image with the command op provisioning sync. No custom or third-party software is installed.
  4. Grants your Compute Engine service account permission to trigger the job.
  5. Creates a Cloud Scheduler job named op-provisioning-sync-hourly that runs the job at the top of every hour to provision new users and groups. Users and groups removed from Google Workspace are deprovisioned from 1Password immediately, without waiting for the hourly job.

Everything is created in the us-central1 region, and the script is safe to run more than once. Rerunning it updates the existing job and schedule rather than creating duplicates.

About the token in the script

The script includes a token (OP_SERVICE_ACCOUNT_TOKEN) for a dedicated 1Password service account that 1Password created just for this integration. The token is stored as an environment variable on the Cloud Run job, inside your Google Cloud project. Each hour, the job uses it to read the provisioning credential from 1Password and trigger a sync. The token has no other access to your 1Password account.

Treat the script as sensitive, since it contains your token.

Resources the script creates

The script creates the following resources in the us-central1 region:

  • Cloud Run job: op-provisioning-sync
  • Cloud Scheduler job: op-provisioning-sync-hourly

To stop the sync later, delete those two resources or turn off provisioning in 1Password.

Learn more

Published: