Migrating from LastPass Enterprise to 1Password - lessons learned

Just finished a six-month, 350-seat migration from LastPass Enterprise to 1Password Business. I was brought in as the "integration specialist" after the internal team got lost in the woods of SCIM mismatches and orphaned shared folders. Let me tell you, the official migration guide is a polite fiction. The real work happens in the API trenches and the middleware you'll inevitably have to build to reconcile the two vastly different data models.

The core philosophical difference that will bite you: LastPass treats shared folders as a primary organizational construct, while 1Password is built around the **Vault** as the central, permission-bound container. This isn't a simple 1:1 mapping; it's a data model migration that requires strategic decisions.

**Key Lessons & Pitfalls:**

* **The Export/Import Illusion:** The provided CSV export from LastPass is a minefield. Custom fields become a mess of `custom_*` columns, and attachment metadata is stripped. A direct CSV import into 1Password will lose structure.
* **Solution:** We wrote a Node.js transformer that mapped LastPass folders to target 1Password vaults based on our naming convention, and used the 1Password CLI's `item create` command for a structured import. Example snippet of our mapping logic:

```javascript
// Example: Determine target vault based on LastPass folder path
const getTargetVault = (lpFolder) => {
const vaultMap = {
'IT/Infrastructure': 'Infrastructure_Secrets',
'Marketing/Campaigns': 'Marketing_Assets',
'_Shared/Finance': 'Company_Finance',
};
// Fallback logic for personal items
return vaultMap[lpFolder] || 'Personal';
};
```

* **SCIM is Not Created Equal:** LastPass's SCIM implementation feels like an afterthought. 1Password's is robust, but if you were using LastPass groups to auto-provision vault access, you'll need to rebuild that logic. 1Password SCIM manages users and groups, but vault membership for those groups is *still* a manual setup or requires a separate automation layer using their REST API.

* **The Attachment Problem:** LastPass stores attachments as base64 blobs in the CSV. 1Password's import expects a URL for each attachment. We had to extract, upload to a secure temporary S3 bucket (with presigned URLs), and reference that in the import JSON. This was the single most time-consuming part of the migration.

* **API Rate Limits & Error Handling:** 1Password's API is solid, but you will hit rate limits during bulk operations. Implement exponential backoff. LastPass's API, on the other hand, was a consistent source of middleware horror stories—unexpected 500s on folder listings, requiring us to write checkpoint/resume logic for our extraction script.

**Final, unsolicited advice:** Do not attempt a "big bang" migration. Pilot with a technical team, validate the transformed data, and test the living daylights out of your automated user provisioning flow. Budget at least three times more for the data cleansing and middleware work than you do for the subscription costs. The actual cut-over weekend was smooth; the months of prep work were not.