Pricing and plans

• 1Password Enterprise Password Manager secures passwords and provides multi-factor authentication to unmanaged apps and apps in the queue for federation.
• 1Password Device Trust ensures all managed and unmanaged devices are trusted before allowing them to access business applications and sensitive data, including employees' personal devices.
• 1Password SaaS Manager discovers and secures your employees’ access to all apps, whether company-managed or unmanaged.

Yes. While 1Password Extended Access Management products work seamlessly together as a unified platform, each component—Enterprise Password Manager, Device Trust*, and SaaS Manager—can be purchased individually on an annual plan based on your priorities for credential management, device trust enforcement, or SaaS access governance.

*Depending on the Device Trust SKU purchased, 1Password Enterprise Password Manager may be required.

Billing for 1Password Extended Access Management is based on your chosen products, user volume, and any necessary customizations. Our sales team will work with you to create customized pricing that aligns with your infrastructure, usage, and security goals.

We offer extended trial periods or proof of concepts for large-scale implementations. Exact trial durations can be tailored to your evaluation needs. Please contact our sales team to discuss.

When an organization has its end users install the Device Trust agent on an unmanaged device, it then acts as a possession factor for authentication. If a device is missing the agent or is failing health checks, it cannot authenticate to SSO-protected apps or integrated VPNs. Additionally, an integration with the 1Password EPM browser extension can block non-compliant devices from accessing web apps, including those not behind SSO.

1Password uses a unique zero-knowledge architecture with dual-key encryption to keep your data private. Our Two-Secret Key Derivation (2SKD) model combines your account password with a device-generated Secret Key, ensuring only you can decrypt your data. Even when using SSO, decryption happens locally on trusted devices—your identity provider never sees your encryption keys. With support through the 1Password SDK for securely storing secrets used by AI agents, scripts, and service accounts, 1Password helps you protect all identities with complete visibility and control.

SaaS Manager helps IT teams discover, manage, and secure every SaaS application. It automates user provisioning and de-provisioning with 350+ direct app integrations, enforces access policies based on roles, and identifies risky or unused access to reduce security gaps. SaaS Manager also provides visibility into SaaS usage, shadow IT, and license spend—empowering teams to streamline operations, meet compliance standards like SOC2 and ISO 27001, and prevent unauthorized access with automated, no-code workflows.

1Password Extended Access Management integrates seamlessly with your existing IT and security stack. It supports identity providers like Okta, Azure AD, and Google Workspace for SSO and SCIM-based provisioning. It integrates with tools like Datadog and Splunk to surface access activity in your SIEM. With hundreds of app integrations, support for custom workflows, and a flexible API, 1Password makes it easy to orchestrate access, enforce policy, and improve compliance across your environment. Explore what's available in the 1Password Marketplace.