If you’re an administrator in 1Password Teams or 1Password Business, you can use mobile device management (MDM) to enforce stricter controls for employees who use 1Password on their devices. You can use these settings to configure 1Password using your MDM solution.
Important
The preference domain for 1Password 8 for Mac is com.1password.1password. These settings must be applied using MDM and cannot be set manually using the defaults command.
Download a sample .mobileconfig profile.
General
These settings allow you to control basic options for the 1Password app.
| Setting | Key | Type |
|---|---|---|
| Start at login | app.startAtLogin | Boolean |
| Save new items in [vault]* | app.defaultVaultForSaving | String |
| Submit automatically with Universal Autofill | security.autofill.autosubmit | Boolean |
* Learn how to set the default vault for saving new items. If this string is left empty, 1Password will suggest a vault.
Security
Help
These settings affect how a team member unlocks 1Password and uses data in it.
| Setting | Key | Type |
|---|---|---|
| Enforce unlock using Touch ID | security.authenticatedUnlock.appleTouchId | Boolean |
| Enforce unlock using Apple Watch | security.authenticatedUnlock.appleWatchUnlock | Boolean |
| Allow 1Password to unlock when the device is unlocked | security.authenticatedUnlock.deviceBasedUnlock | Boolean |
| Set the account password requirement timeframe* | security.authenticatedUnlock.requireAccountPasswordAfter | String |
| Set auto-lock timeout† (in minutes) | security.autolock.minutes | Integer |
| Lock when device locks or sleeps | security.autolock.onDeviceLock | Boolean |
| Lock when main window is closed | security.autolock.onWindowClose | Boolean |
| Remove copied information and one-time passwords after 90 seconds | security.clipboard.clearAfter | Boolean |
| Use Universal Clipboard to copy to other devices | security.deviceClipboardSharing | Boolean |
| Keep device active for Large Type | security.blockSleepEnabled | Boolean |
| Always show passwords and full credit card numbers | security.revealPasswords | Boolean |
| Always show Wi-Fi QR codes | security.revealWifiQrCodes | Boolean |
* The allowed values are "one-day", "two-weeks", "thirty-days", and "never". Each value must be enclosed in quotation marks, as shown here.
† You can choose a number from 1 to 1440 (1 day).
Privacy
These settings allow you to manage settings related to privacy and Watchtower.
| Setting | Key | Type |
|---|---|---|
| Show app and website icons | privacy.downloadRichIcons | Boolean |
| Check for compromised websites | privacy.checkCompromisedWebsites | Boolean |
| Check for vulnerable passwords | privacy.checkHibp | Boolean |
| Check for two-factor authentication | privacy.checkMfa | Boolean |
| Check for passkeys | privacy.checkPasskeys | Boolean |
Trusted browsers
The following setting allows you to control how 1Password connects with trusted browsers. Browsers you add this way are combined with any a team member adds themselves in Settings > Browser > Add Browser. MDM can’t remove a browser a team member added on their own or a browser that 1Password trusts by default.
| Setting | Key | Type |
|---|---|---|
| Add trusted browsers | browsers.admin-trusted-apps | String |
This setting doesn’t use a fixed value. Generate it on a Mac with 1Password installed:
If 1Password is open, quit it completely.
Open Terminal, then copy and paste the following command. Replace the browser path with the browser you want to use. For example, to generate values for Waterfox:
/Applications/1Password.app/Contents/MacOS/1Password --generate-trusted-browser-config /Applications/Waterfox.appCopy the
<key>and<string>XML that 1Password prints to the terminal and paste them in the fields for this setting.
Updates
Important
These settings allow you to manage 1Password updates.
| Setting | Key | Type |
|---|---|---|
| Automatically check for updates | updates.autoUpdate | Boolean |
| Set release channel* | updates.updateChannel | String |
* The allowed values are PRODUCTION, BETA, and NIGHTLY.
If your organization manages the release channel with a 1Password.com policy, that policy overrides these MDM settings for automatic updates and the release channel.
Authentication
These settings allow you to control the process of signing into the 1Password app.
| Setting | Key | Type |
|---|---|---|
| Set a default sign-in address* | authentication.defaultDomain | String |
| Enforce the default sign-in address† | authentication.enforceDomain | Boolean |
* Use the following structure for the sign-in address: domain.1password.com. The scheme (https://) shouldn't be included.
† To use this setting, you must set a sign-in address for the authentication.defaultDomain setting.
You can use an administrative template (ADMX) to control settings in 1Password through Group Policy. You can import templates directly into Active Directory or Intune.
To get the template for 1Password, download this ZIP file, then extract its contents. If you need the template for a specific version of 1Password, replace latest at the end of the URL with the version of 1Password you need (8.12.36, for example).
To learn how to set up and use the template in your organization, review the README.md file in the template folder for further instructions.
Important
If you’re using the HKEY_LOCAL_MACHINE\SOFTWARE\Agilebits Inc.\1Password\Policy registry key to control settings in your organization, you should migrate to administrative templates.
This registry key is deprecated, and we’ll be removing support for it in a future update. You can find steps to migrate in the README.md file after you create a template.
General
These settings allow you to control basic options for the 1Password app.
| Setting | Key | Type |
|---|---|---|
| Show the main app window at login* | app.openAppOnStartup | Boolean |
| Save new items in [vault]† | app.defaultVaultForSaving | String |
| Allow the use of Auto-Type | app.autoTypeEnabled | Boolean |
| Allow proxy detection‡ | proxy.autoDetectNetworkSettings | String |
| Submit automatically with Auto-Type | security.autofill.autosubmit | Boolean |
* To control this setting, 1Password must be turned on in Windows Settings > Apps > Startup.
† Learn how to set the default vault for saving new items. If this string is left empty, 1Password will suggest a vault.
‡ Turn this off to force a direct network connection.
Security
Help
These settings affect how a team member unlocks 1Password and uses data in it.
| Setting | Key | Type |
|---|---|---|
| Set the account password requirement timeframe* | security.authenticatedUnlock.requireAccountPasswordAfter | String |
| Allow 1Password to unlock when the device is unlocked | security.authenticatedUnlock.deviceBasedUnlock | Boolean |
| Set auto-lock timeout† (in minutes) | security.autolock.minutes | Integer |
| Lock when device locks or sleeps | security.autolock.onDeviceLock | Boolean |
| Lock when main window is closed | security.autolock.onWindowClose | Boolean |
| Remove copied information and one-time passwords after 90 seconds | security.clipboard.clearAfter | Boolean |
| Keep device active for Large Type | security.blockSleepEnabled | Boolean |
| Always show passwords and full credit card numbers | security.revealPasswords | Boolean |
| Always show Wi-Fi QR codes | security.revealWifiQrCodes | Boolean |
* The allowed values are "one-day", "two-weeks", "thirty-days", and "never". Each value must be enclosed in quotation marks, as shown here.
† You can choose a number from 1 to 1440 (1 day).
Privacy
These settings allow you to manage settings related to privacy and Watchtower.
| Setting | Key | Type |
|---|---|---|
| Show app and website icons | privacy.downloadRichIcons | Boolean |
| Check for compromised websites | privacy.checkCompromisedWebsites | Boolean |
| Check for vulnerable passwords | privacy.checkHibp | Boolean |
| Check for two-factor authentication | privacy.checkMfa | Boolean |
| Check for passkeys | privacy.checkPasskeys | Boolean |
Updates
These settings allow you to manage 1Password updates.
| Setting | Key | Type |
|---|---|---|
| Automatically check for updates* | updates.autoUpdate | Boolean |
| Set release channel† | updates.updateChannel | String |
* This setting only applies if 1Password is installed with the MSIX, MSI, or App Installer. Learn how to control updates if you deploy 1Password through the Microsoft Store.
† The allowed values are PRODUCTION, BETA, and NIGHTLY. This setting only applies if 1Password is installed with the MSIX or MSI, not with App Installer or through the Microsoft Store.
If your organization manages the release channel with a 1Password.com policy, that policy overrides these MDM settings for automatic updates and the release channel.
Authentication
These settings allow you to control the process of signing into the 1Password app.
| Setting | Key | Type |
|---|---|---|
| Set a default sign-in address* | authentication.defaultDomain | String |
| Enforce the default sign-in address† | authentication.enforceDomain | Boolean |
* Use the following structure for the sign-in address: domain.1password.com. The scheme (https://) shouldn't be included.
† To use this setting, you must set a sign-in address for the authentication.defaultDomain setting.
The preference domain for 1Password 8 for iOS is com.1password.1password.
General
These settings allow you to control basic options for the 1Password app.
| Setting | Key | Type |
|---|---|---|
| Save new items in [vault]* | app.defaultVaultForSaving | String |
* Learn how to set the default vault for saving new items. If this string is left empty, 1Password will suggest a vault.
Security
Help
These settings affect how a team member unlocks 1Password and uses data in it.
| Setting | Key | Type |
|---|---|---|
| Enforce unlock using Touch ID | security.authenticatedUnlock.appleTouchId | Boolean |
| Enforce unlock using Face ID | security.authenticatedUnlock.appleFaceId | Boolean |
| Allow unlock with device passcode | security.authenticatedUnlock.appleDevicePinUnlock | Boolean |
| Allow 1Password to unlock when the device is unlocked | security.authenticatedUnlock.deviceBasedUnlock | Boolean |
| Set the account password requirement timeframe* | security.authenticatedUnlock.requireAccountPasswordAfter | String |
| Set auto-lock timeout† (in minutes) | security.autolock.minutes | Integer |
| Clear clipboard after timeout | security.clipboard.clearAfter | Boolean |
| Use Universal Clipboard to copy to other devices | security.deviceClipboardSharing | Boolean |
| Keep device active for Large Type | security.blockSleepEnabled | Boolean |
| Always show passwords and full credit card numbers | security.revealPasswords | Boolean |
| Always show Wi-Fi QR codes | security.revealWifiQrCodes | Boolean |
* The allowed values are "one-day", "two-weeks", "thirty-days", and "never". Each value must be enclosed in quotation marks, as shown here.
† You can choose a number from 0 to 480. If you choose 0, the app will lock immediately when no longer in focus.
Privacy
These settings allow you to manage preferences related to privacy and Watchtower.
| Setting | Key | Type |
|---|---|---|
| Show app and website icons | privacy.downloadRichIcons | Boolean |
| Use Apple Maps | privacy.mapsEnabled | Boolean |
| Check for compromised websites | privacy.checkCompromisedWebsites | Boolean |
| Check for vulnerable passwords | privacy.checkHibp | Boolean |
| Check for two-factor authentication | privacy.checkMfa | Boolean |
| Check for passkeys | privacy.checkPasskeys | Boolean |
Autofill
These settings allow you to manage preferences related to Autofill.
| Setting | Key | Type |
|---|---|---|
| Show passkey suggestions | app.autoFillPasskeyShowFillingSuggestions | Boolean |
Notifications
These settings allow you to manage the notifications that team members receive from 1Password.
| Notification type | Key | Type |
|---|---|---|
| One-Time Passwords | app.notifyCopyTotpToClipboard | Boolean |
Authentication
These settings allow you to control the process of signing into the 1Password app.
| Setting | Key | Type |
|---|---|---|
| Set a default sign-in address* | authentication.defaultDomain | String |
| Enforce the default sign-in address† | authentication.enforceDomain | Boolean |
* Use the following structure for the sign-in address: domain.1password.com. The scheme (https://) shouldn't be included.
† To use this setting, you must set a sign-in address for the authentication.defaultDomain setting.
Appendix: Set the default vault for saving new items
To specify a vault and account to save new items, use the following structure:
{"VaultReference":{"vault_uuid":"UUID","account_uuid":"UUID"}}
Replace both UUID values with the appropriate ones for the vault and account you want to use.
To enforce the default behavior and prevent users from changing this setting, enter the following string instead:
CurrentVaultOrFallback
Learn more
Was this article helpful?
Glad to hear it! If you have anything you'd like to add, feel free to contact us.
Sorry to hear that. Please contact us if you'd like to provide more details.