1Password business provisioning failed: SCIM bridge connection error troubleshooting

TL;DR

Restore the SCIM bridge as a service first: confirm the bridge host is running and reachable at its provisioned address, its credentials file matches the bearer credential the identity provider presents, and its connection to 1Password is healthy, then test provisioning with one user before resuming the full sync.

1Password business provisioning failed: SCIM bridge connection error

Use this when

• Identity provider provisioning to 1Password reports a bridge connection or timeout error for all users.
• The bridge host was patched, moved, or its certificate renewed recently.
• Manual 1Password administration and sign-in work normally.

Not for this skill when

• Individual user creates fail validation while the connection test passes. That is user data, not the bridge.
• Users cannot sign in to 1Password itself. Restore account access before provisioning.

Steps

1. Locate the bridge deployment from the team inventory, whether a cloud instance, a container, or a small virtual machine, and confirm the service is running, its recent logs show no crash loop, and the host clock and resources are healthy. Verify: the bridge process state is known from its own logs
2. From the identity provider side, run the provisioning test connection and capture the exact failure, distinguishing cannot connect, TLS failure, and an authentication rejection, because each points to a different layer. Verify: the failure layer is named
3. For connection failures, confirm the bridge public address and port the identity provider uses still resolve and pass the firewall after any network change, testing reachability from outside the bridge network. For TLS failures, check the certificate expiry and chain on the bridge endpoint. Verify: reachability and certificate state are both confirmed
4. For authentication rejections, compare the bridge credentials: the bridge holds a credentials file created at setup and the identity provider presents the matching bearer credential; if either side was rotated alone, re-issue the pair together following the 1Password bridge setup flow and update both sides in one change. Verify: both sides hold the matched credential pair without exposing values in tickets
5. Restart the bridge service if configuration changed, wait for its healthy log line, then provision one test user from the identity provider and confirm the user appears in 1Password with the correct groups pending assignment. Verify: the test user provisions through the bridge successfully
6. Resume full provisioning, monitor the bridge logs through the first cycle, and add uptime and certificate expiry monitoring for the bridge endpoint so the next failure alerts before hires are affected. Verify: monitoring covers the bridge endpoint with an alert owner

Why it happens

The 1Password SCim bridge is a self-hosted relay the identity provider talks to instead of talking to 1Password directly, which adds host, network, certificate, and credential layers that pure SaaS provisioning does not have. Any layer failing presents as a generic bridge connection error in the identity provider, while 1Password itself stays perfectly healthy. Working layer by layer from the host outward isolates the broken one, and the bridge logs usually state the problem plainly once someone looks at them. Treating the bridge as production infrastructure with monitoring prevents silent expiry failures.

Variants and edge cases

Bridge healthy but identity provider still fails

Check for an address change after a cloud instance rebuild. Update the identity provider base URL to the current bridge address and retest.

Bridge logs show 1Password API rejections

The bridge connection to 1Password uses its own integration credential that can be revoked in the 1Password admin console. Reconnect the integration there and restart the bridge.

Multiple bridges for high availability disagree

If two bridges run, both must hold the same credentials and version. Compare versions and credential generation dates across the pair.

Compatibility: Applies to 1Password Business with the SCIM bridge deployed on cloud or container hosts. Requires bridge host admin and 1Password admin access.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstEGj7XpPckyM9B9bO4T2gQ