Why Shared Logins Are a Security Risk for Your Business
A shared login is easy: one username and password for the whole front desk, the whole marketing team or everyone who needs the accounting system. It saves money and avoids the question of who needs access. Shared logins also create risks that are hard to see until something goes wrong.
Why businesses end up with shared logins
Usually for good reasons. A software license costs per user, so one login is cheaper. A shared inbox such as info@ needs to be seen by several people. A new employee needs access today and there is no time to set up an account. Over time the habit sticks and nobody changes the password because everyone would have to be told.
You cannot reliably see who did what
If five people use one account, the activity log says only that the account did it. When a record is deleted, an email goes to the wrong person or money moves, you cannot tell who was responsible. That makes it hard to fix mistakes, handle disputes or investigate a security problem. Some regulations also expect you to track who accessed certain information.
One password can give access to everything in the account
When a password is shared, it travels: by text, by email, on a sticky note, in someone’s head. Each copy is another chance for it to leak. The more people who know it, the more likely it is that someone reuses it somewhere else, loses a device or is tricked into giving it away. A single exposure compromises everyone’s access.
Shared logins make offboarding harder
When someone leaves, you should remove their access. With a personal account, you disable it. With a shared one, you have to change the password and tell everyone else, which many businesses never do. So former employees, contractors and interns may still be able to sign in long after they leave.
MFA is harder to manage with a shared account
Multi-factor authentication sends a code or a prompt to one person’s phone. For a shared account, that means one person must be available every time someone else signs in, or the code is shared too, which defeats the purpose. Often MFA is simply turned off for shared accounts, leaving them the weakest ones in the company.
Everyone gets the permissions of the shared account
A shared login has one set of permissions, so the intern and the manager have the same power. You cannot give each person only what they need, which makes accidents and misuse more likely and more damaging.
A shared mailbox does not require a shared password
The most common reason for shared logins is a shared email address. In Microsoft 365 you can create a shared mailbox, which several people open from their own accounts. Microsoft’s documentation explains that the mailbox’s own account has a system-generated password that nobody knows or is meant to use, and recommends blocking sign-in to it. People get access through permissions, such as Full Access to read and Send As to send as the shared address. When someone leaves, you remove their permission and nothing else changes.
Administrator passwords should never be passed around casually
Accounts with administrator rights control everything else. Each person who needs administrative access should have their own administrator account, used only for administration, with multi-factor authentication. Emergency “break glass” accounts, where used, should be stored securely and monitored. See our post on why employees should not have administrator access.
What to do instead
- Give each person their own account. For most business software, the cost of an extra user is small compared with the risk.
- Use shared mailboxes for shared email addresses, with permissions, not a shared password.
- Use a business password manager to store and share the few credentials that truly must be shared, such as a social media account, with access you can see and remove.
- Use delegated access where a tool supports it, so one person can act for another without knowing their password.
- Use separate service accounts for systems that talk to each other, with limited permissions and no one signing in with them by hand.
- Turn on multi-factor authentication for every account that supports it.
How to move away from shared logins
- Find them. Ask each team which accounts they share, and check your software for generic accounts.
- Decide who needs access, and what level.
- Create individual accounts and set permissions.
- Change the shared passwords once everyone has their own access, and remove the old account if you can.
- Set a rule that new accounts are never shared, and review it each year.
Our Microsoft 365 support covers users and licenses, and multi-factor authentication and access policies. Our managed IT services cover day-to-day support, and you can contact us for help with cleaning up shared accounts. A free security review looks at who can get into your systems and how accounts and passwords are protected.
Frequently asked questions
Is it ever okay to share a login?
Rarely. If a system truly cannot support separate users, store the password in a password manager, limit who can see it, change it when people leave and turn on MFA if possible.
How do we share an email address like info@ safely?
Use a shared mailbox in Microsoft 365. People open it from their own accounts through permissions, so there is no shared password, and you can add or remove people easily.
Aren’t separate accounts too expensive?
Often the extra license costs little compared with the risk and the time lost to a problem you cannot trace. Compare it with the value of what the account can reach.
How do we find shared accounts in our business?
Ask each team what logins they share, review the user lists in your main systems for generic names and check which passwords are written down or sent by text.
What about social media accounts?
Most platforms let several people manage a business page with their own logins and roles. Use those features instead of one shared password.
