Honest review: 1Password Business for a global team of 400

After leading the analytics engineering function through our organization's recent security infrastructure overhaul, I was tasked with providing a data-backed assessment of our new credential management system. Having now managed 1Password Business for a global team of approximately 400 users across 12 countries for 18 months, I can offer a review grounded in operational metrics and user behavior data.

The transition from a fragmented system of shared spreadsheets and individual password managers was driven by a security audit. Our primary requirements were: centralized administration, granular access controls (especially for our database and BI tool credentials), detailed audit logging, and reliable SSO integration with Azure AD. 1Password Business satisfied the core security checklist, but the operational reality revealed significant nuances.

**The Good: Security & Core Administration**
* The policy engine is robust. We successfully implemented policies requiring 2FA for all users, a 30-day password rotation on all vaults containing production database credentials, and a 90-day rotation for all other items. The Family/Business account linking feature was a silent win, eliminating shadow IT as employees could manage personal passwords separately.
* Audit logs are comprehensive and, crucially, exportable as JSON. We built a dbt model to ingest these logs into our data warehouse, enabling us to track vault access patterns and credential usage frequency. This proved invaluable.
* SCIM provisioning via Azure AD works reliably. User onboarding and offboarding are fully automated, which our People Ops team highlights as a major efficiency gain.

**The Challenges: Analytics & Cross-Functional Workflows**
* While audit logs are detailed, the native reporting is insufficient for a large organization. To answer basic questions like "Which shared vaults are underutilized?" or "How many unique users access our data warehouse credentials monthly?", we had to build our own dashboards. Here's a simplified query we run to monitor high-sensitivity credential access:

```sql
-- Monitor access to 'Production DB' vault items
SELECT
user_email,
vault_name,
item_title,
COUNT(*) as access_count,
MIN(timestamp_utc) as first_access,
MAX(timestamp_utc) as last_access
FROM transformed.one_password_audit_events
WHERE
vault_name = 'Production Data Warehouse'
AND timestamp_utc >= DATEADD(day, -30, GETDATE())
AND action IN ('vault.item.view', 'vault.item.use')
GROUP BY 1,2,3
HAVING COUNT(*) > 5
ORDER BY access_count DESC;
```

* The permissions model, while granular, becomes complex at scale. Managing 50+ shared vaults with different user groups led to permission drift. We now maintain a separate Looker dashboard to visualize user-vault mappings, as the admin console does not provide a clear matrix view.
* The CLI tool is excellent for automating credential injection into CI/CD pipelines, but documentation for less common data stores (e.g., Snowflake) required significant internal engineering time to get right.

**The Verdict:**
For a global team of 400, 1Password Business is a competent and secure vault. However, its true cost extends beyond the per-user license. Be prepared to invest in internal analytics resources to properly monitor adoption, manage permissions proactively, and derive value from the audit data. It is a system that provides excellent raw data (logs) but requires you to build your own business intelligence layer around it to manage effectively at scale. The lack of built-in, actionable insights for administrators is its most significant gap.

- dan