# 1Password

Probo reads your 1Password account's members through the 1Password SCIM Bridge so you can review who has access.

:::caution
Use the **bearer token** that 1Password issues when you set up automated user provisioning, and pair it with the bridge it was issued for. A token from another 1Password integration, such as Events Reporting, will **not** work, because the bridge accepts only the bearer token generated alongside its own `scimsession` file.
:::

## Prerequisites

- Probo organization administrator access
- The **owner** or **administrator** role in a 1Password **Business** account (automated user provisioning requires both the plan and the role)
- Automated user provisioning already in place, either hosted by 1Password or on a SCIM bridge you deployed yourself
- The **SCIM Bridge URL**, which the Connect dialog asks for alongside the token. Enter the bridge address with no path, for example `https://scim.example.com`, the form 1Password's own identity provider guides ask for. Probo appends `/scim/v2/Users` to it. For provisioning hosted by 1Password, the setup page shows a **SCIM URL** such as `https://provisioning.1password.com/scim/v2`, so drop the `/scim/v2` suffix and enter `https://provisioning.1password.com`

## Collected Fields

| Probo field | 1Password field                                          | Notes                                                                                              |
| ----------- | -------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| Name        | `displayName`                                            | Falls back to `name.formatted`, then to `name.givenName` and `name.familyName` joined with a space |
| Email       | `userName`                                               | Falls back to the primary address in `emails`. A user with neither is skipped                      |
| Role        |  |                                                                                                    |
| Admin       |  |                                                                                                    |
| Status      | `active`                                                 | Listed as inactive when `active` is false, including when the response omits the field             |
| MFA         |  |                                                                                                    |
| Last login  |  |                                                                                                    |
| External ID | `id`                                                     | Stable identifier used to track the account across reviews                                         |
| Created at  | `meta.created`                                           | When the account was created. Left empty when the value is not an RFC 3339 timestamp               |

A SCIM user record has a `meta.lastModified` timestamp, but that timestamp records the last change to the profile rather than a sign-in, so Probo does not report it as a last login. Probo reads no role from the SCIM record either, so it flags no account as an administrator.

## Step 1: Create a Bearer Token

1. In [1Password.com](https://start.1password.com), signed in as an **owner** or **administrator**, select **Integrations** in the sidebar, then your identity provider in the **User Provisioning** section.
2. Complete the provisioning setup. For provisioning hosted by 1Password, select **Set up hosted provisioning**. For a self-hosted bridge, choose your deployment platform and follow 1Password's deployment guide for it.
3. Copy the **bearer token** that 1Password issues at the end of setup and store it securely. 1Password recommends saving the credentials in 1Password. You deploy a self-hosted bridge with the `scimsession` file that 1Password generates together with the token, so keep both.

## Step 2: Connect in Probo

1. In Probo, go to **Access Reviews** > **Sources** > **Add Source**.
2. Find **1Password**, click **API Key**, paste the bearer token, enter your **SCIM Bridge URL** (the address of the bridge that token was issued for, with no path), and click **Connect**.

Probo names the source **1Password** and pulls the account's members into your campaigns.

## Troubleshooting

- **Token rejected.** The bridge accepts only the bearer token paired with the `scimsession` file it runs with, so a token from an earlier setup or from a different 1Password integration fails. Selecting **Regenerate Credentials** on the 1Password **Integrations** page issues a new pair, so reconnect with the new token.
- **No members appear.** Probo lists the users the bridge returns on its `/scim/v2/Users` endpoint and skips any record without an email address. Confirm the bridge is healthy and that the URL you connected is the one your identity provider provisions against.
- **SCIM Bridge URL rejected.** The URL must use `http` or `https` and include a host, for example `https://scim.example.com`. Probo calls the bridge from its own servers, so you cannot connect a bridge that is reachable only on a private network.
- **No account is flagged as an administrator.** Probo reads no role from the SCIM user records, so Role and Admin stay empty for every member. Review who holds the owner and administrator roles in the 1Password console instead.
- **The provisioning setup is unavailable.** Automated user provisioning is a 1Password **Business** feature, and only an owner or an administrator can set it up. On a lower plan, upgrade first.