> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.
# Add and remove team members
## Requirements
Before you can use 1Password CLI to add and remove team members, you'll need to:
1. [Sign up for 1Password Business](https://1password.com/pricing/password-manager).
2. [Install 1Password CLI](/cli/get-started/#step-1-install-1password-cli).
If you use [automated provisioning hosted by 1Password](https://support.1password.com/provisioning/), you'll also need to [complete a one-time setup](#with-automated-provisioning) before managing users with the CLI.
## Set up provisioning
### With automated provisioning
Support for automated provisioning hosted by 1Password is available in [the latest beta build of 1Password CLI](https://app-updates.agilebits.com/product_history/CLI2#beta), version `2.36.0-beta-02` or later.
If your account uses [automated provisioning hosted by 1Password](https://support.1password.com/provisioning/), you'll need to run a one-time setup command before you can manage users with the CLI. Skip this section if your account doesn't use automated provisioning.
Run `op provisioning configure` with your provisioning token and SCIM URL. The `--token` value must be a [secret reference](/cli/secret-references) that points to the vault, item, and field where your token is stored in your 1Password account (for example, `op://vault-name/item-name/field-name`). The `--url` flag accepts the SCIM URL as plaintext or as a secret reference. For example:
```shell theme={null}
op provisioning configure --token --url
```
After you create users with the CLI with automated provisioning enabled, automated provisioning must remain enabled on the account. Users created this way are placed in provisioning-specific states. If automated provisioning is removed from the account, the CLI will return an error when attempting to suspend or reactivate those users.
### With 1Password CLI
If you don't use automated provisioning, an owner or administrator must visit the [Provisioning settings page on 1Password.com](https://start.1password.com/settings/provisioning/cli) and select **Turn On CLI Provisioning**. This will create a [Provision Managers](https://support.1password.com/groups/#provision-managers) group with the permissions needed to provision and confirm team members, as well as recover accounts. The person who created the group will be added to it.
## Manage who can provision team members
By default, the owner or administrator who created the [Provision Managers](https://support.1password.com/groups/#provision-managers) group is the only person added to it. If other team members need to be able to provision users, use [`op group user grant`](/cli/reference/management-commands/group/#group-user-grant) to add them to the group.
For example, to add Wendy Appleseed to the Provision Managers group:
```shell theme={null}
op group user grant --group "Provision Managers" --user "wendy.appleseed@agilebits.com"
```
To see a list of everyone in the Provision Managers group:
```shell theme={null}
op group user list "Provision Managers"
```
## Add team members
To invite people to your team, use [`op user provision`](/cli/reference/management-commands/user/#user-provision) with the team member's name and email address.
For example, to invite Wendy Appleseed to join your 1Password account:
```shell theme={null}
op user provision --name "Wendy Appleseed" --email "wendy.appleseed@agilebits.com"
```
The person will receive an email invitation to join the team. After they've accepted the invitation, a member of the Provision Managers group can confirm them.
## Confirm team members
If your account uses automated provisioning, users are confirmed automatically. You can skip this section.
Anyone who belongs to the [Provision Managers](https://support.1password.com/groups/#provision-managers) group can confirm new team members with [`op user confirm`](#with-op-user-confirm) or [on 1Password.com](#on-1password-com).
### With `op user confirm`
To confirm a team member on the command line, use [`op user confirm`](/cli/reference/management-commands/user/#user-confirm) with their name or email address. To confirm all unconfirmed team members, include the `--all` flag.
For example, to confirm Wendy Appleseed:
```shell theme={null}
op user confirm "wendy.appleseed@agilebits.com"
```
To confirm all pending users:
```shell theme={null}
op user confirm --all
```
### On 1Password.com
To confirm a team member on 1Password.com:
1. [Sign in](https://start.1password.com/signin) to your account on 1Password.com.
2. Select **[People](https://start.1password.com/people)** in the sidebar.
3. Select the name of any team member with the Pending Provision status.
4. Select **Confirm** or **Reject**.
If you don't see the option to confirm or reject a team member, ask your administrator to [add you to the Provision Managers group](#manage-who-can-provision-team-members).
## Remove team members
To remove someone's access to vaults and items, you can suspend or delete their account.
### Suspend an account temporarily
Use [`op user suspend`](/cli/reference/management-commands/user/#user-suspend) to suspend a team member temporarily.
Include the `--deauthorize-devices-after` flag, followed by the number of seconds, minutes, or hours (for example, `600s`, `10m`, or `1h`) to set the time after suspension to deauthorize the suspended team member's devices. The maximum time permitted is 24 hours. If unspecified, their devices will be deauthorized immediately.
If your account uses automated provisioning, the `--deauthorize-devices-after` flag is ignored. The provisioning service always deauthorizes devices after 10 minutes.
For example, to suspend Wendy Appleseed temporarily and deauthorize her devices after 10 minutes:
```shell theme={null}
op user suspend "wendy.appleseed@agilebits.com --deauthorize-devices-after 10m"
```
You can reactivate a suspended user with [`op user reactivate`](/cli/reference/management-commands/user/#user-reactivate).
### Remove an account permanently
Use [`op user delete`](/cli/reference/management-commands/user/#user-delete) to permanently remove a team member's access to vaults and items and delete all of their data from the account.
For example, to remove Wendy Appleseed:
```shell theme={null}
op user delete "wendy.appleseed@agilebits.com"
```
## Learn more
* [Add and remove team members on 1Password.com](https://support.1password.com/add-remove-team-members/)
* [Set up automated provisioning](https://support.1password.com/provisioning/)
* [Workflow: Programmatically manage your organization](/get-started/manage-organization)
* [Administrator quickstart](/get-started/administrator-quickstart)