Picture this. You part ways with a marketing company, or the employee who "did the Facebook stuff" moves on. A week later you try to post, change your hours or pause an ad, and you can't. The page is there, your reviews are there, your followers are there, but the keys are in someone else's pocket.
Your business should own its social media and ad accounts. Keep your Facebook Page, Instagram account and ad accounts inside a Meta business portfolio that your company controls, give at least two trusted people from your own business full control, and give agencies, freelancers and staff only the partial access they need. When someone leaves, you remove their access and nothing breaks.
This is one of those boring setup jobs that saves a lot of pain later. In 20+ years of building for the web, I've seen plenty of small businesses lose time and money untangling who owns what. Here's how to set it up right.
Why ownership matters more than it seems
Your social accounts hold years of work. Your reviews, your followers, your post history and the way people find you. Your ad account holds its own history too, including what you've spent, which audiences worked and the tracking data that tells the ads who to reach. If someone else owns those accounts, all of that walks out the door with them.
It's rarely malicious. More often the person who set it up used their own login because it was fast, and nobody thought about it again. The fix is to make sure the business itself is the owner, with people added as helpers.
How Meta's business portfolio works, in plain words
For Facebook and Instagram, the home base is a business portfolio in Meta Business Suite. Think of it as a folder that belongs to your company. Your Page, your Instagram account and your ad accounts all live inside it.
Meta gives people two levels of access, as its help page on adding people to a business portfolio explains:
- Full control. The person can manage the whole portfolio, including adding and removing people and assigning assets. You need full control to add people at all.
- Partial access. The person can only work on the specific assets and tasks you assign them.
Meta's own advice is to give people only the level of access they need to do their work. I agree. Your part-time social media helper doesn't need the power to remove you.
Agencies should get partner access, not your password
When you work with an outside company, the cleanest setup is partner access. The agency has its own business portfolio, and you share specific assets with it. According to Meta's help page on partner access, you'll need full control of your portfolio and your partner's business portfolio ID. Then you choose which assets to share and whether they get full control or partial access for tasks like creating content, managing ads and replying to messages.
Why this is better than handing over a login:
- The agency's team members get access through the agency, so you don't have to track every person they hire.
- Your ad account and payment method stay in your name.
- When the relationship ends, you remove the partner and their whole team loses access at once.
If you hire us for paid social campaigns, this is how we'll ask to be set up. The accounts stay yours. You can see how we work from the first call on.
Always have two people with full control
This is my strongest recommendation in this whole article. Never let one person be the only one with full control. That includes you. People lose phones, get locked out of personal accounts and change jobs.
If the only person with full control is gone, Meta does have a way back. Its help page on requesting full control covers cases like a former employee or contractor holding control without being an owner. But you'll need to contact Meta's business support and provide identification, proof of ownership and a signed attestation letter. That's a slow, stressful process you can skip by adding a second person today.
Your two should be the owner and one other trusted person, like a partner or office manager. Both should turn on two-factor login on their personal accounts, so a stolen password alone isn't enough to get in.
Other platforms follow the same idea
TikTok, LinkedIn, Google Business Profile and YouTube each have their own settings, but the principle doesn't change. Sign up with a business email address the company controls, like info@ or marketing@ at your domain, never a personal Gmail. Keep the owner as the primary owner, and add other people as managers. If you don't have business email on your own domain yet, that's something our sister studio HEX Web Design can set up.
Checklist: when an agency or employee leaves
- Remove their person or partner access in your business portfolio
- Check every Page, Instagram account and ad account for leftover access
- Change passwords on any login that was ever shared
- Confirm the payment method on your ad accounts is yours
- Download any reports or creative files you paid for
- Update recovery email addresses and phone numbers to company ones
- Confirm two people from your business still have full control
Do it the same day they leave. It takes about 30 minutes, and it's much harder a year later.
One more habit makes all of this easier. Keep a simple account list in a shared document only the owners can open. Write down every platform you're on, the email address each account is tied to, who has full control and who has partial or partner access. Update it whenever someone joins or leaves. When something goes wrong at 8 p.m. on a Friday, you'll know exactly where to look instead of guessing whose phone gets the login code.
Want a second set of eyes on yours?
Not sure who holds the keys to your accounts right now? We'll take a look for free. Our Social Check looks at your profiles and posting rhythm, whether your page actually looks like you, how comments and reviews are being handled, whether any ads are aimed at the right people and whether social visits show up as calls and forms. You get a short written summary. If the answer is "not much needs to change," we'll tell you that. Request your free Social Check.
