%201.svg)
HIPAA Compliance Checklist for 2025
TL;DR
- 1Password pricing for businesses is $8.99 per user per month on the Business plan, billed annually. Teams Starter Pack covers up to 10 users for a flat $24.95 per month.
- Every paid seat is a vault of live company credentials. An idle seat wastes money. An un-revoked seat after an employee leaves is a standing credential exposure.
- Most organizations over-provision security tools and under-deprovision them. The seats nobody uses and the accounts nobody closed are the two costs that 1Password pricing never shows you.
- The Teams-to-Business cliff is the plan trap most buyers miss: user 11 forces a jump from the flat rate to per-user pricing at a significantly higher per-seat cost.
- CloudEagle.ai gives you one view across both problems: which seats are idle, and which vaults still belong to people who are no longer there.
You can read 1Password's plan structure in a minute. Teams Starter Pack, Business, Enterprise. What that page cannot show you is how many of those paid vaults belong to people who left three months ago, or how many seats your rollout provisioned that nobody has opened since.
For most security tools those are spend questions. For a password manager they are also security questions, because every paid seat holds working credentials to everything the person was accessing on the day their account went dark.
1. Why 1Password pricing gets harder to control at scale
1Password pricing plans and what they list for
Here is what each business plan costs and what it includes.
Rates from 1Password's business pricing page, confirmed July 2026. 1Password raised prices across all plans in early 2026, so if your renewal quote looks higher than last year, that is not an error.
Business plans are annual-only, with no monthly billing option. Individual and Families plans are available, but this guide is written for the org buyer.
The Teams-to-Business cliff
The Teams Starter Pack is a strong value if your team stays at 10 users or fewer. At $24.95 per month, it includes SSO and SCIM, features that often cost more with other vendors.
The catch is user 11:
- Exceeding 10 users moves the entire account to the per-user Business plan.
- The flat-rate pricing disappears.
- You now pay $8.99 per user per month for the whole team, not just the extra seat.
If you're approaching the 10-user limit, factoring this pricing cliff into your budget can prevent an unexpected cost jump.
Why a security tool is the worst place to carry dead seats
Most per-user SaaS tools follow the same pattern:
- Provisioned broadly at rollout.
- Adopted by only a subset of users.
- Rarely audited before renewal.
Idle seats on a project management tool waste money. Idle seats on a credential manager create security risk.
Every 1Password Business seat is a vault that may contain:
- Production system credentials
- Shared service account logins
- Customer-facing tool access
- API keys and developer secrets managed through 1Password Secrets Automation
An unused seat means the person never opened it. An unrevoked seat after someone leaves means they still can, and every credential they saved may remain valid until someone rotates it.
That is why license waste and access governance are the same problem in 1Password. The solution is not just a seat audit. It also requires deprovisioning checks as part of every offboarding process.
2. How CloudEagle.ai gets 1Password spend and access under control
CloudEagle.ai works the problem in the order it actually occurs. It discovers every place 1Password is paid for, shows which seats are genuinely used, then governs who holds access and revokes it cleanly when people leave.
Each lever below works on its own, and they compound when run together, because the same usage data that cuts your seat count is what you carry into the renewal.
Right-size 1Password seats against real usage
Per-user security tools are consistently over-provisioned. CloudEagle.ai identifies which Business seats are actively used and which have been inactive for months, then reclaims idle licenses through approval workflows and user notifications.
Timing matters. Business plans are billed annually, so seat reductions only take effect at renewal. CloudEagle.ai tracks renewal dates alongside license usage, giving IT and procurement enough time to reduce seats before the renewal locks them in.
How it helps
- Identifies active, inactive, and underutilized 1Password seats
- Automates license reclamation through approval workflows
- Tracks renewal timelines alongside seat utilization
- Optimizes seat counts before annual renewals
Revoke the vault when the employee leaves
Removing SSO access is only part of offboarding. Shared vault access, independently created accounts, and credentials that predate your IdP integration can remain active after an employee leaves.
CloudEagle.ai extends Zero-Touch Offboarding beyond the identity provider, revoking 1Password access as part of automated HRIS-triggered offboarding. That ensures access to shared credentials is removed alongside the employee's other applications.
How it helps
- Extends offboarding beyond IdP-connected applications
- Revokes access through HRIS-triggered automation
- Removes lingering access to shared vaults and credentials
- Reduces the risk of orphaned credential access
Match vault access to role with access reviews
Access to a 1Password vault is access to the systems those credentials unlock. Regular access reviews ensure employees only retain the vault permissions they still need.
CloudEagle.ai presents vault access to business owners for review, helping remove unnecessary access while improving both security and license governance.
How it helps
- Reviews vault access across employees and collaborators
- Identifies users who no longer need shared credentials
- Removes unnecessary access through recurring reviews
- Strengthens least-privilege access and audit readiness
If you want to learn more about the process, read our guide to User Access Reviews, which explains how to run recurring access certifications instead of waiting for an audit or security incident.
Walk into the renewal with usage data
Most 1Password renewals are based on last year's seat count rather than actual usage. Without utilization data, reducing costs becomes difficult.
CloudEagle.ai pairs renewal dates with active-seat data, so procurement teams negotiate using real usage instead of historical provisioning. On Business plans, the biggest lever is optimizing seat count. For Enterprise plans, where pricing is custom and volume-based, usage trends provide stronger negotiating leverage.
How it helps
- Tracks renewals in a centralized renewal calendar
- Combines renewal timelines with active-seat data
- Optimizes license counts before renewal
- Strengthens Enterprise negotiations with usage-backed insights
Know Which 1Password Seats Are Worth Paying For.
3. What companies actually pay for 1Password
This is where the over-provisioning finding lands in dollar terms. CloudEagle.ai benchmark data, drawn from actual deal outcomes and last refreshed on 27 July 2026, puts typical 1Password pricing here:
Source: CloudEagle.ai benchmark data, last refreshed 27 July 2026. Directional, roughly 80% to 90% accurate.
Two things stand out from that table.
- Business benchmarks range from $77 to $96 per user per year, compared to a list price of $107.88.
- Buyers who negotiate typically land 10% to 20% below list.
- A documented Bitwarden evaluation is the strongest negotiation lever. Since Bitwarden Business is roughly 50% cheaper with comparable enterprise features, even a partial evaluation can move 1Password pricing by 15% to 25%.
Over-provisioning has an even bigger impact than price negotiation. In one 320-seat deployment from our benchmark data, only 240 seats had logged in within 60 days. Removing 80 idle seats saved $7,680 per year before any rate negotiation.
The benchmark tells you what a good rate looks like per active seat. Utilization determines how many active seats you actually have.
Enterprise carries a meaningful premium over Business, with list pricing of $108 to $144 per user per year. In one 600-seat deployment, Enterprise was quoted at $144 per seat versus $96 for Business.
The only differentiators were custom IdP integration and a dedicated CSM. Since the company used standard Okta SAML, it stayed on Business and saved 50%. If standard Okta, Entra ID, or Google Workspace integration meets your needs, Business is usually sufficient.
One contract clause deserves close attention. Multi-year 1Password agreements should lock the per-seat price for the full term in writing. Without that language, years two and three may reprice to the then-current list rate, eroding most or all of your negotiated discount.
Benchmark note: These ranges are directional, roughly 80% to 90% accurate. Actual outcomes move on contract length, payment terms, competitive pressure, and where you land in 1Password's quarter. 1Password's fiscal year ends in January, so October through January signatures land at materially better discounts. Validate against current list pricing before you anchor a negotiation. Source: CloudEagle.ai price benchmarking and buying guides, 27 July 2026.
4. Best practices for reducing 1Password costs
None of these require a negotiation. They are all things you can do before you next talk to 1Password.
- Tie deprovisioning to the HRIS, not a manual checklist: The seat and the vault should close on the employee's last day, not when someone remembers to file a ticket.
- Audit idle vaults before renewal, not after: Business plans are annual-only, and removals take effect at renewal. A seat you identify the day after renewal costs you for the whole next term.
- Decide Teams vs Business deliberately at the 10-user line: User 11 ends the flat rate and starts per-user pricing. If you are near that line at renewal, buying down to 10 or committing to Business from the start are both better options than discovering the cliff in the invoice.
- Account for the free Families plan: Every Business seat includes a free Families plan for personal use, currently $71.88 per user per year. If employees would otherwise pay for 1Password at home, that benefit softens the per-seat cost.
- Check nonprofit and journalist discounts: 1Password publishes these on its pricing page. Both are worth a support conversation if you qualify.
- Annual billing is the only self-serve discount on Business: There is no monthly option on Business, so there is no unlock to get. The only structural rate reduction comes through volume and contract length at Enterprise.
- Lock the per-seat rate for the full term if you go multi-year: Without that clause, year 2 and year 3 re-price to then-current list, erasing most of a negotiated discount.
- Cap the annual uplift at 3% to 5% in writing: 1Password's standard renewal includes 5% to 7% uplift unless you negotiate otherwise.
- Time Enterprise negotiations to October through January: 1Password's fiscal year ends in January, and end-of-quarter and end-of-fiscal-year deals close at materially better rates.
5. The 1Password account nobody deprovisioned
The cost argument is only part of it. The other part is what stays open after someone leaves.
A 1Password Business vault can hold shared service credentials, production logins, client-facing tool access, and, with Secrets Automation enabled, API keys and developer secrets.
SSO deprovisioning covers IdP-connected apps. It does not automatically revoke a 1Password vault, so someone whose SSO account is disabled may still retain access if their 1Password account is not explicitly removed.
1Password has also expanded into SaaS discovery and access review. If you're evaluating those capabilities, compare them carefully since they overlap with what CloudEagle.ai already covers.
The practical takeaway is simple:
- Employee offboarding must revoke access to the credential store, not just email or SSO.
- Shadow IT discovery surfaces 1Password accounts created outside IT's visibility, where unrevoked vaults most often remain.
6. When consolidation beats another 1Password tier
Before upgrading or switching, check whether the real problem is the plan or the duplication.
Running two credential stores, such as a legacy LastPass tenant alongside 1Password or personal password managers alongside a Business account, is usually the bigger cost and security risk. Every duplicate vault is another place credentials can persist after an employee leaves.
Application rationalization helps identify that duplication before it becomes a security incident.
If you are comparing tools, the competitive landscape looks like this:
- Bitwarden: Open source and roughly 50% cheaper than 1Password Business with comparable enterprise features. A real evaluation typically improves 1Password pricing by 15% to 25%, even if you stay.
- Microsoft Authenticator + Edge Password Manager: Included with Microsoft 365 and suitable for organizations with basic credential management needs.
- Keeper Security: Typically costs $45 to $60 per user per year and is a strong choice for regulated industries requiring FedRAMP or StateRAMP.
- Dashlane: Comparable pricing with growing enterprise capabilities, but less mature enterprise functionality than 1Password.
Migration has hidden costs. Moving a credential store means migrating every saved login, rotating shared credentials, and retraining users.
Use an evaluation to strengthen your negotiation, and switch only if the savings outweigh the migration effort. If 1Password already meets your needs, reducing unused seats is usually more cost-effective than replacing the tool.
7. Get your 1Password seats and access under control
1Password pricing is not really a pricing problem. The Business rate is published, and on that rate itself there is limited room to move. What varies between companies is how many seats were provisioned and never claimed, how many vaults belong to people who are no longer there, and whether anyone checks before the renewal processes.
CloudEagle.ai gives you that answer in one view: every 1Password seat you pay for, who is actively using it, and which vaults are still open to people who have left.
Book a demo and see your own numbers.
Frequently asked questions
- What does a 1Password Business seat actually cost?
$8.99 per user per month, billed annually. There is no monthly billing option on Business. Each seat includes a free Families plan for personal use, which is worth accounting for when comparing to alternatives.
- What happens to the vault when an employee leaves?
The vault remains accessible until the account is explicitly revoked. SSO deprovision closes the IdP-connected login, but a standalone 1Password account or a vault shared through a link that predates the IdP setup can survive that deprovision intact. Offboarding processes need to include explicit 1Password account closure, not just an SSO event.
- What is the Teams-to-Business cliff?
The Teams Starter Pack is a flat $24.95 per month for up to 10 users. User 11 requires moving the entire account to the per-user Business plan at $8.99 per user per month, which is a large jump in per-seat terms for the existing 10. If you are approaching that ceiling at renewal, the timing and planning of that transition matters more than most buyers realize.
- Is 1Password pricing negotiable?
On Teams Starter Pack, the flat rate is what you pay. Business is negotiable, particularly with a documented Bitwarden evaluation, which typically moves the rate 15% to 25%. CloudEagle.ai benchmark data puts typical Business outcomes at $77 to $96 per user per year against a list of $107.88. Enterprise is volume-discounted from Business, with typical list at $108 to $144 per user per year. Two things matter in writing: lock the per-seat rate for the full term on multi-year deals, and cap annual uplift at 3% to 5%, because the standard renewal runs 5% to 7% without an explicit cap.
- Does deprovisioning through SSO close the 1Password vault?
Not necessarily. SSO deprovision closes the IdP-connected sign-in. A 1Password account that was set up with a separate email and master password, or credentials held in shared vaults that predate the SSO integration, can remain active after an SSO event. Explicit 1Password account revocation, not just SSO deprovision, is the complete close.
Know Which 1Password Seats Are Worth Paying For.
.avif)
.avif)
.avif)
.png)
