Automating SOC workflows with 1Password Enterprise Password Manager

Modern security teams increasingly rely on integrated security operations center (SOC) workflows that correlate signals and alerts, while orchestrating detection responses in real time. Behind every alert is an identity: a person, a service account, an API key, or an AI agent. However, when remediation requires manual steps, investigation and response slows, increasing security risks. Organizations are also expected to maintain continuous compliance via clearly enforced access controls and auditable processes. 

Today, 1Password is expanding the 1Password Enterprise Password Manager (EPM) through the public preview of the Users API for Partners, enabling security teams to respond to incidents faster during active security events. Powered by the Users API for Partners, security automation integrations with partners like CrowdStrike, in addition to BlinkOps, Elastic, Sumo Logic, Tines, and Torq enable mutual customers to automatically suspend or restore users in EPM when risk is detected. Together, these capabilities embed identity actions programmatically into coordinated SOC workflows.

Moving from visibility to response with the Users API for Partners

The Users API for Partners, now in public preview, enables execution of user-related actions within 1Password EPM. The API uses OAuth 2.0-based authentication designed for secure, enterprise-grade security. This enables ecosystem partners to build integrations for 1Password Enterprise Password Manager and use delegated, scoped authorization to list users, suspend access when risk is detected, and restore access after remediation.

We’re also introducing api.1Password.com as the single access point to 1Password APIs, accessible to ecosystem partners looking to build solutions with 1Password. The Users API for Partners will be the first API available through this access point with additional APIs accessible via api.1Password.com in the future.

Partners can explore and build integrations for 1Password EPM through our public preview documentation and provide feedback for improvements before general availability. For partners, this enables joint value solutions built on OAuth designed for secure, enterprise-grade extensibility.

New security automation integrations now available

1Password Enterprise Password Manager customers can now enable security automation integrations with CrowdStrike, as well as BlinkOps, Elastic, Sumo Logic, Tines, and Torq. 

With these integrations, customers can use EPM events activity logs and SIEM insights, alongside security automations, to trigger automated SOC workflows to suspend or restore users in 1Password Enterprise Password Manager when risk is detected.

Security teams can now: 

• Reduce manual intervention by embedding identity actions programmatically into coordinated security processes, accelerating containment during high-risk incidents.

• Orchestrate enforcement of access policies in alignment with organizational and regulatory requirements.

• Maintain clear audit trails of what actions were taken, when they occurred, and which events triggered them.

Joint customers can configure their OAuth application within the Integrations page in EPM starting today to connect one of our new security automation integrations. For customers, this helps SOC teams reduce exposure time and act on risk with greater speed and consistency.

Strengthening the operational foundation of Enterprise Password Manager 

In addition to enabling SOC teams to execute programmatic users actions within automated workflows, we are strengthening the operational foundation of 1Password Enterprise Password Manager.

Automated Provisioning, hosted by 1Password, is our next-generation provisioning solution built directly into 1Password. It requires no servers, no SCIM bridge, and no customer-managed infrastructure. Running within 1Password’s secure infrastructure using confidential computing, it preserves our zero-knowledge architecture while enabling automated user creation and access management.

Enterprise multi-tenancy will support parent and child account structures with delegated administration, centralized visibility, and consistent policy enforcement. Organizations can scale across business units or acquisitions while maintaining oversight.

Together, these enhancements enable workflows at enterprise-scale, through automation and governance, for 1Password Enterprise Password Manager customers.