Use the built-in groups in your team

Learn how to add and remove people from the Owner, Administrator, and Team Member groups.

1Password comes with three built-in groups you can use to delegate administrative responsibilities to your team members. With 1Password Business, you can also use custom groups.

Tip

Add a second owner to your team as soon as possible to make sure everyone on your team always has access when they need it, including you.

Team Members

Everyone in your team belongs to the Team Members group, with the exception of guests. Team Members don’t have any team-level administrative permissions but may be able to manage individual vaults. Team Members can’t be removed from this group.

Security

People in the Security group can view security reports and account activity.

You’ll only see this group after you set up the domain breach report.

Administrators

Administrators can add and manage vaults, groups, and team members. They can also recover accounts.

Owners

Owners can do everything Administrators can, plus make changes to billing and delete the team. The account creator automatically belongs to the Owners group, and more owners can be added at any time. Owners can be removed from the group, but there must be at least one on the team.

Provision Managers

The Provision Managers group is used by automated provisioning with SCIM and 1Password CLI to allow you to provision and confirm new team members. If someone wants to use 1Password CLI to provision new users, they need to be temporarily added to this group. Otherwise, team members shouldn’t be part of this group.

You’ll only see this group after you set up automated provisioning with 1Password SCIM Bridge or 1Password CLI.

Tip

The Provision Managers also has access to Employee vaults before users complete signup. You can add people to the group to allow them to create items in Employee vaults as part of onboarding.

If you don’t want to see Employee vaults, remove yourself from this group.

Manage group membership

To add or remove people from the built-in groups:

Sign in to your 1Password account.
Click Groups in the sidebar to see a list of your groups.
Click Owners, Administrators, or Security.
Click Manage in the People section.
Select or deselect team members, then click Update Group Members.

Appendix: Default permissions

The built-in groups cannot be deleted. The chart below shows the default permissions for each of them. With 1Password Business, you can create groups with custom permissions.

Permission	Owner	Administrator	Security	Team Member
Create Vaults	✅	✅	❌	✅
View Administrative Sidebar	✅	✅	✅	❌
View Security Reports	❌	❌	✅	❌
Recover Accounts	✅	✅	❌	❌
Manage People	✅	✅	❌	❌
Suspend People	✅	✅	❌	❌
Invite & Remove People	✅	✅	❌	❌
Manage All Groups	✅	✅	❌	❌
Manage Settings	✅	✅	❌	❌
Manage Billing	✅	❌	❌	❌
Delete Account	✅	❌	❌	❌

Create Vaults is not turned on by default for team members on teams created before April 9, 2017.

Appendix: Export group members

You can export a list of everyone in a group to a comma-separated values (CSV) file:

Click Groups in the sidebar.
Choose the group you want to export.
Click Export list of group members (CSV) at the bottom of the People section.
You may need to scroll down to see this button.

The exported file includes UUIDs, names, and roles of people in the group. If someone’s role is R, they’re a group member. If their role is A, they’re a group manager.

Learn more

Was this article helpful?

Glad to hear it! If you have anything you'd like to add, feel free to contact us.

Sorry to hear that. Please contact us if you'd like to provide more details.