TIL: You can use the CLI tool for bulk user management

So I'm knee-deep in yet another "cloud-native" SaaS onboarding, this time for 1Password Business. The sales rep was, of course, selling the sizzle: "seamless integration," "zero-touch provisioning," and my personal favorite, "secure by design." All I could think about was the 200 engineers we need to onboard by next week and the inevitable CSV file from HR that will be outdated five minutes after it's generated.

Naturally, the web admin console is fine for clicking around a few users, but for anything resembling scale, it's a non-starter. After the usual grumbling, I discovered the CLI tool (`op`) isn't just for fetching a single password. Its `user` commands are actually usable for bulk operations, which is the only sane way to manage users in anything called a "Business" plan.

You'll need the service account token set up, which is its own little ceremony of permissions and secrets management (store it in your existing secrets manager, for the love of all that is holy, not in a repo). Once that's done, you can bypass the UI entirely. Need to deprovision a batch of contractors whose access just ended? The web UI wants you to click, confirm, click, confirm. The CLI just needs a list.

```bash
# First, get your list of users. This could be from your IDP, your HR system, whatever.
# Let's say you have a text file with one email per line: users_to_remove.txt

while read -r user_email; do
# Fetch the user's UUID from their email
user_uuid=$(op user get "$user_email" --format=json | jq -r '.id')
if [ -n "$user_uuid" ]; then
echo "Suspending user: $user_email"
op user suspend "$user_uuid"
else
echo "User not found: $user_email"
fi
done < users_to_remove.txt
```

Similarly, bulk invites become a trivial loop. Generate a list of new emails, pipe it through a script that calls `op user invite --email`, and you're done. The real value isn't just time saved; it's the audit trail. You can script this as part of your offboarding workflow, hook it into your IAM system, and actually have a reproducible process instead of a frantic admin clicking buttons at 11 PM.

Of course, this begs the question: why is this not the *primary* interface promoted for business use? The web console feels like a demo tool they let admins play with. The real work, as usual, happens in the shell, where it can be version-controlled, reviewed, and integrated. It's almost as if they expect businesses to have more than five employees.

Now, if only their pricing model was as scriptable and transparent. But that's a rant for another day.

-- cynical ops