> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# 1Password Admin

*This is the **1Password – Admin** connector: it authenticates with a 1Password admin user account and provides full sync of users, groups, and roles plus provisioning and deprovisioning. For read-only visibility of users and groups only, use [1Password – Groups](/integrations/library/1password/1password-groups) instead. Both connectors run through the Lumos On-Premise Agent using the 1Password CLI.*

## After this article

You will be able to connect 1Password to Lumos via the On-Premise Agent to sync users, groups, and roles, and to provision, deprovision, and manage access, including group membership assignment and account deactivation.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | User account records |
| Roles | Permission | Yes | Yes | Roles in 1Password (derived by analyzing group memberships and permissions) |
| Groups | Permission | Yes | Yes | Groups in 1Password, membership assignment/removal |

| AppStore | Offboarding | Access Reviews | License Management |
| - | - | - | - |
| Yes | Yes | Yes | Yes |

Provisioning workflow: assign the user to the app, then assign the entitlement (group membership).

## Required plan and roles

* **1Password plan:** a 1Password **Business or Enterprise** account.
* **1Password role:** administrative access to 1Password is required to supply the admin account credentials.
* **Host prerequisites:** a Lumos On-Premise Agent (see the On-Premise Agent guide in the Lumos Developer Docs at app.lumosidentity.com/docs), Python 3.6+, and the 1Password CLI (`op`) version 2.18+ installed **and on PATH for the service account that runs the agent**, with outbound network access to 1Password's API.
* **Credentials and scope:** read/write. The Admin method uses the admin account's **username, password, and Secret Key** (some 1Password docs call this the master key), and **2FA must be disabled** on that account. This grants Lumos full visibility (users, groups, and roles) and the ability to provision and deprovision.

Note: this connector is deliberately on-prem. Most companies do not allow access to their 1Password instance from outside their network, so the agent keeps 1Password traffic inside your infrastructure. A cloud-only variant does not exist today. Lumos uses the 1Password CLI through the agent for a complete integration. Unlike the SCIM Bridge (which only returns partial data such as SCIM-provisioned users and groups), the CLI retrieves all users including native groups and permissions.

## Instructions

**Phase 1: Prepare the On-Premise Agent host**

1. Set up the Lumos On-Premise Agent following the Lumos Developer Docs.
2. Install the 1Password CLI (`op`) on the agent host and verify it is on PATH **for the service account that runs the Lumos agent service** (not just your interactive shell).

**Phase 2: Gather admin credentials in 1Password**

1. Gather the admin account credentials: username, password, and Secret Key.
2. Confirm that 2FA is disabled on that admin account.

**Phase 3: Connect in Lumos**

1. Click the 1Password card in your Lumos integrations (reconnect an existing card or add a new one) and choose the **Admin** method.
2. Enter the admin credentials (username, password, Secret Key) in the Lumos UI. You do **not** need to set any credential as an environment variable on the agent host. Lumos passes the credential to the agent, which sets it in the CLI subprocess environment automatically.
3. Follow the on-screen instructions to enable 1Password on-premise and click **Connect**.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Clicking Connect appears to do nothing.** Check that the on-prem agent is running and healthy. Connection errors from the agent are surfaced in the UI, and a crashed agent (stale heartbeat) will prevent the connection from completing.

**`op` CLI not found even though it's installed.** The Lumos agent service runs with its own PATH, which differs from your interactive shell. Install the CLI so it is on PATH for the service account that runs the agent service.

**Deactivating a user fails for accounts in "Invited" status.** 1Password rejects the standard deactivate call (HTTP 400) for users who have not yet accepted their invite. The connector handles Invited-status users separately, so retry the action on a current connector version.

**Provisioning fails at the Assign Entitlement step.** The AppStore workflow assigns the user to the app and then assigns the entitlement (group membership). This is handled by a current connector version. Retry on the latest connector.

**Do I need to disable 2FA?** Yes. The Admin method authenticates as an admin user account, and 2FA must be disabled on that account for the CLI to authenticate non-interactively.

**Why can't this run from the Lumos cloud?** The connector was built as an on-prem integration because most customers block access to their 1Password instance from outside their network.