Teams and business

Manage child accounts with multi-tenancy for 1Password

Learn how to manage 1Password for your child accounts with multi-tenancy.

With 1Password Enterprise Password Manager, you can set up and manage 1Password child accounts.

After you set up the parent account, you can add child accounts that you want to manage.

Add a child account

Before you add a child account, make sure your parent account is in the region of the account you want to manage. You can only create and manage accounts in your parent account’s region.

You’ll also need an owner, administrator, or person who belongs to a custom group with child account management permissions.

When you’re ready to add the account, follow these steps:

  1. Sign in to your parent account on 1Password.com.
  2. Choose Child accounts in the sidebar.
  3. Select New account in the top right, then:
    • If you want to create a new account, choose Create new account and continue to the next step.
    • If you want to link an existing account, choose Link existing account and follow the onscreen instructions.
  4. Enter an account name and optionally add a website.
  5. Select the country or region the account is located in, then enter its address information and choose Save.

    This does not affect the region the account is located in. Your parent and child accounts must be in the same data region to be linked.

After you add a child account, choose the launch button beside it to sign in, then follow the steps to set it up.

Set up a child account

After you add or link a child account, follow these steps to set it up:

  1. Create team policy templates, custom groups, and vaults to share items.
  2. Implement a recovery plan.
  3. Invite new team members or migrate team members from your parent account.
  4. Deploy 1Password for Mac and Windows.

You’ll be administrating the account, so you may want to learn more about getting started with 1Password as an administrator.

Tip

If you want to co-own an account with someone in a child account, add them that person to the Owners group in the child account.

If you want to allow someone to co-manage the account with you, add them to the Administrators group so they can perform administrative tasks, such as account recovery for team members.

Manage child accounts

To manage your child accounts, sign in to your parent account on 1Password.com and choose Child accounts in the sidebar.

Filter and sort

You can search for an account by name, or sort by status or filled seats. The first time you sort by account name, it’ll show in ascending alphabetical order. When you sort by name a second time, it’ll show in descending alphabetical order, and a third time will show in order of when the account was linked.

To remove sorting or filters that you’ve applied, choose Clear all at the top right of the page.

Edit account details

To edit an account’s details, select it from the list, then choose Edit. You can change the account name, website, and region. Select Save when you’re finished.

View shared vaults and items

You can view shared vaults and items within an account you manage. Launch into the account, then choose Vaults in the sidebar, select a vault, and give yourself access to it if you don’t already have it. Then choose View Vault.

Recover accounts

If team members in a child account have lost access, you can recover their accounts so they can sign back in. An administrator in the account can also help recover accounts, so you may want to add someone to the Administrators group to help with this in the future.

Before you unlink a child account, consider the following:

  • Someone in the account will need to manage it as an owner going forward. Launch into the child account you want to unlink, then add someone to the Owners group first.
  • After the account is unlinked, it’ll be placed on a 14-day free trial and can be used normally until the end of that period. Someone in the Owners group will need to subscribe to 1Password or link another parent account to continue using it after the trial has ended.

To unlink a child account, make sure least one person is in the account’s Owners group. Then follow these steps:

  1. Sign in to your parent account on 1Password.com.
  2. Choose Child accounts in the sidebar.
  3. Find the account and choose the ellipsis > Unlink.

Manage permissions

To manage permissions for a custom group to help manage child accounts:

  1. Sign in on 1Password.com.
  2. Select Groups in the sidebar, then select the group.
  3. Select Manage in the Permissions section.
  4. Scroll down to the Child Account Tasks section to see the available permissions.
PermissionShort nameDescription
Access Child Accounts PageViewView the Child accounts page.
Create or Link Child AccountsAddAdd a new child account or link an existing one.
Unlink Child AccountsUnlinkUnlink a child account that you currently manage.
Launch into Child AccountsLaunchSign in to a child account to perform administrative tasks.
Edit Child AccountsEditEdit a child account name, website, or region.

Create policy templates

You can create policy templates in the parent account to control team policies in child accounts. Before you create a policy template, consider the following:

  • The policies you select in a template become the defaults for child accounts you apply them to.
  • To suggest policies instead of enforcing them, select Allow overrides next to each policy. Administrators of child accounts can only change policies that have Allow overrides on, or that aren’t part of the template.
  • A child account can only have one policy template assigned to it at a time.

When you’re ready to create a policy template, follow these steps:

  1. Sign in to your parent account on 1Password.com.
  2. Select Policies in the sidebar.
  3. Select Manage beside “Policy templates”.
  4. Select Create template, enter a name for your template, then select Create.
  5. Select Add and remove policies, then choose policies to add to the template.
  6. When you’re done, select Apply policies.

To apply policies to child accounts:

  1. Configure the policy defaults you want to use on the template page, then select the Child accounts tab.
  2. Select Manage child accounts, then select accounts where you want the policy template to apply.
  3. Select Save and apply.

After you save the changes, mandated policies will be applied to the child accounts you selected.

Get help

If you want to set up unlock with SSO in a child account, you’ll need to invite yourself to the child account as a team member, then add yourself to the Administrators group. Parent account administrators can only set up SSO as administrators within the child account.

Learn more


Published: