1Password

Probo reads your 1Password account’s members through the 1Password SCIM Bridge so you can review who has access.

Caution

Use the bearer token that 1Password issues when you set up automated user provisioning, and pair it with the bridge it was issued for. A token from another 1Password integration, such as Events Reporting, will not work, because the bridge accepts only the bearer token generated alongside its own scimsession file.

Prerequisites

• Probo organization administrator access
• The owner or administrator role in a 1Password Business account (automated user provisioning requires both the plan and the role)
• Automated user provisioning already in place, either hosted by 1Password or on a SCIM bridge you deployed yourself
• The SCIM Bridge URL, which the Connect dialog asks for alongside the token. Enter the bridge address with no path, for example https://scim.example.com, the form 1Password’s own identity provider guides ask for. Probo appends /scim/v2/Users to it. For provisioning hosted by 1Password, the setup page shows a SCIM URL such as https://provisioning.1password.com/scim/v2, so drop the /scim/v2 suffix and enter https://provisioning.1password.com

Collected Fields

Probo field	1Password field	Notes
Name	displayName	Falls back to name.formatted, then to name.givenName and name.familyName joined with a space
Email	userName	Falls back to the primary address in emails. A user with neither is skipped
Role	Not supported
Admin	Not supported
Status	active	Listed as inactive when active is false, including when the response omits the field
MFA	Not supported
Last login	Not supported
External ID	id	Stable identifier used to track the account across reviews
Created at	meta.created	When the account was created. Left empty when the value is not an RFC 3339 timestamp

A SCIM user record has a meta.lastModified timestamp, but that timestamp records the last change to the profile rather than a sign-in, so Probo does not report it as a last login. Probo reads no role from the SCIM record either, so it flags no account as an administrator.

Step 1: Create a Bearer Token

1. In 1Password.com, signed in as an owner or administrator, select Integrations in the sidebar, then your identity provider in the User Provisioning section.
2. Complete the provisioning setup. For provisioning hosted by 1Password, select Set up hosted provisioning. For a self-hosted bridge, choose your deployment platform and follow 1Password’s deployment guide for it.
3. Copy the bearer token that 1Password issues at the end of setup and store it securely. 1Password recommends saving the credentials in 1Password. You deploy a self-hosted bridge with the scimsession file that 1Password generates together with the token, so keep both.

Step 2: Connect in Probo

1. In Probo, go to Access Reviews > Sources > Add Source.
2. Find 1Password, click API Key, paste the bearer token, enter your SCIM Bridge URL (the address of the bridge that token was issued for, with no path), and click Connect.

Probo names the source 1Password and pulls the account’s members into your campaigns.

Troubleshooting

• Token rejected. The bridge accepts only the bearer token paired with the scimsession file it runs with, so a token from an earlier setup or from a different 1Password integration fails. Selecting Regenerate Credentials on the 1Password Integrations page issues a new pair, so reconnect with the new token.
• No members appear. Probo lists the users the bridge returns on its /scim/v2/Users endpoint and skips any record without an email address. Confirm the bridge is healthy and that the URL you connected is the one your identity provider provisions against.
• SCIM Bridge URL rejected. The URL must use http or https and include a host, for example https://scim.example.com. Probo calls the bridge from its own servers, so you cannot connect a bridge that is reachable only on a private network.
• No account is flagged as an administrator. Probo reads no role from the SCIM user records, so Role and Admin stay empty for every member. Review who holds the owner and administrator roles in the 1Password console instead.
• The provisioning setup is unavailable. Automated user provisioning is a 1Password Business feature, and only an owner or an administrator can set it up. On a lower plan, upgrade first.