Shared Logins in Small Business: The Risks and What to Use Instead
Short answer: give every person their own login wherever the software allows it. Individual accounts let you set the right permissions, use two-step sign-in properly, remove one person’s access without disrupting everyone else, and see who did what. Where a shared password truly can’t be avoided, keep it in a business password manager, limit who can see it, and change it whenever someone’s access ends.
How shared logins start
Nobody plans a collection of shared accounts. The bookkeeper is away and an invoice has to go out today, so a colleague is handed the accounting login. The website needs a quick update, so the login gets forwarded in a chat. The software was bought when the business had two people, and the one account just kept being passed on.
The username might be accounts@, admin, or the name of someone who left years ago. The password lives in a browser, a spreadsheet or an old message thread. It works, so nobody revisits it.
You can’t see who did what
When five people use one login, the software records the activity against that one account. You can see that a bank detail changed or a report was exported. You can’t see which of the five did it.
Even when everyone acted in good faith, that makes a simple mistake slow to trace. When the change might be fraud, it matters a lot more: was it a current employee, a former one, or someone who stole the password?
One password, many copies
A shared password has to reach everyone who needs it. That usually means email, chat, a shared document, or being typed into several computers. Every copy is another place it can leak from.
If an attacker gets it, they get everything the account can do. And because several people use the account from different places, an odd sign-in is easy to brush off as “probably someone working from home”.
Offboarding gets messy
With individual accounts, when someone leaves, we disable their account at the agreed time and nobody else is affected. With a shared login, the only way to remove a former staff member is to change the password and redistribute it to everyone who’s staying. That’s inconvenient enough that it often doesn’t happen, so the former employee’s access depends on whether they remember the password.
When our team handles a departure, we confirm the request is authorised, agree what happens to the person’s mailbox and files, sort who keeps access to what, and go through every system in scope. Shared logins are the item on that list that most often turns a 15-minute task into a round of password changes. Australian government guidance makes the same point: credentials for a shared account should change whenever the group using it changes.
Two-step sign-in doesn’t fit a shared account
Two-step sign-in (MFA) is meant to prove the person signing in is the account holder. On a shared account, the prompt goes to one person’s phone while someone else is trying to log in. Staff start forwarding codes or approving each other’s prompts, which defeats the point. With individual accounts, everyone has their own sign-in and their own second step.
Everyone gets the account’s full permissions
Whoever uses a shared login gets everything that login can do. Someone who only needs to view records can also export them. Someone who updates the website can also see billing and user settings. Individual accounts let you give each person what their job needs and nothing more. That’s the principle of least privilege, and it’s recommended in cyber.gov.au’s guidance for small business.
A shared inbox doesn’t need a shared password
Several people may need to work from accounts@ or reception@. In Microsoft 365, a shared mailbox lets approved staff open it through their own accounts. Microsoft recommends keeping direct sign-in to the shared mailbox blocked. When someone leaves, you remove their permission and nothing changes for anyone else. This is one of the most common fixes we make when setting up Microsoft 365 for a new client.
Other platforms have the same idea under names like delegation, team access, roles or groups. Check for it before you share a password.
Admin logins deserve extra care
A shared admin account can create users, change security settings and lock other people out. Give each administrator a named admin account, use a standard account for everyday work, and review who holds admin rights. People often keep them from an old role.
What if the software only has one login?
Some older systems and devices don’t support separate users. Until they can be replaced:
– Store the password in a business password manager, not email or chat.
– Make each person sign into the password manager with their own account and two-step sign-in.
– Limit access to the people who need it and review the list when roles change.
– Give the account a named owner who knows what it controls and what breaks if the password changes.
Service accounts (used by software, like a backup tool reaching a server) are different. They should have only the permissions their task needs, a documented purpose and an owner, so nobody disables one by mistake.
How to move off shared logins without disruption
- List every login used by more than one person: accounting, CRM, website, social media, email, cloud storage and specialist apps. Old messages and browser password stores help find forgotten ones.
- For each, note who uses it and why.
- Create named accounts where the platform allows, with only the permissions each person needs.
- Move shared inboxes to shared mailboxes or delegation.
- Put anything that must stay shared into the password manager, then change its password.
- Turn on two-step sign-in for every individual account.
- Add “check shared accounts” to your onboarding and offboarding checklist.
FAQ
Is it OK to share a login if we trust everyone? Trust isn’t really the issue. Shared logins remove your ability to see who did what and to remove one person cleanly, even when everyone means well.
Do individual accounts cost more? Sometimes the software charges per user. Weigh that against what you’d lose if the shared password leaked or a change couldn’t be traced.
What’s the quickest win? Usually shared mailboxes in Microsoft 365, because it’s included and staff barely notice the change.
Where Vaelis IT can help
Our local team helps Northern Beaches businesses find shared logins, set up individual and shared-mailbox access, and put a password manager in place where it’s needed. If you’d like to talk through yours, book a 15-minute IT chat: https://vaelis-it.com.au/contact-us/
Sources: Australian Cyber Security Centre small business guidance (cyber.gov.au); UK NCSC guidance on shared accounts; Microsoft Learn: About shared mailboxes. Adapted from an article by The Technology Press.
