# Giving seasonal hiring staff job board access without sharing passwords

There are four ways: their own user on the job board, your identity provider, a password manager, or a tool that signs them in. Three never reveal the password.

Updated: October 16, 2026

There are four ways to give seasonal hiring staff access to a job board, and three of them never tell anyone the password. You can add each person as a user on the job board itself, or let your identity provider sign them in. An identity provider is the service that holds your company logins, such as Okta or Microsoft Entra ID. The other two are sharing through a password manager and using an access tool that signs people in without showing the password. A password manager can still expose it. People with permission to view it can read it, and Bitwarden warns that hiding it doesn't fully prevent access. All four let you shut the person off on their last day.

Seasonal staff here means anyone added for the hiring rush: people borrowed from other teams, temps from a staffing agency, and short-term hires.

## Seasonal staff are users like everyone else

A short stint doesn't change what a login needs. NIST SP 800-53 Rev. 5 is a US catalog of security controls, required for federal systems and used by others on a voluntary basis. Its control IA-2 asks you to identify each of your organization's users one by one and confirm they are who they say they are. The discussion of IA-2 says these users include employees and people you treat like employees, such as contractors. A temp working your job board for three weeks is a user in the same sense.

Once a seasonal hire knows the password, nothing short of changing it stops them from signing in after their last day. The AC-2 discussion names temporary accounts that are no longer needed as a reason to disable them. Who counts as an employee, a contractor or a temp is covered in [Giving company accounts to employees, contractors and temps](/guides/outsourcing-access/employees-contractors-temps-account-access).

## Four ways compared

| Method | Does the person know the password? | What it needs | What to do on the last day |
| --- | --- | --- | --- |
| Their own user on the job board | No. They sign in with their own login | The job board lets you add users | Remove the user on the job board |
| Your identity provider signs them in | No. In Microsoft Entra ID, users don't see the shared password | The person has an account in your identity provider. Entra ID needs an EMS, Entra ID P1 or P2 license for each user and the My Apps extension | Take the person out of the group that has the app |
| A password manager | They can see it if allowed. Hidden passwords still work through autofill | The person is a user of the same password manager | Suspend them, change the passwords they could reach, then remove them |
| An access tool that signs them in without showing the password | No. The tool enters it for a verified person | Conditions differ by product. Check its documentation | Stop the person's access in the tool |

Adding the person as a user takes the least effort, where the job board supports it. On Indeed, an admin adds users on the Users page and picks an access level for each one. Limited access lets a person review and message candidates for specific jobs only, which suits a temp screening applicants for a few openings. LinkedIn works differently. If a job is posted through a personal LinkedIn account, only the poster can see the applicants. The poster can forward applicant profiles to coworkers who are 1st-degree connections, so a seasonal helper receives profiles instead of a login.

The identity provider route fits people who already have a company account, such as staff borrowed from another team. Microsoft's documentation says Entra ID stores the shared password and enters it for the people assigned to the app. It also says the admin can grant or revoke access and knows who has access and who used the account. A temp you never added to your directory can't use this route.

A password manager stores the password, but hiding it doesn't fully keep a person from getting it. Bitwarden's help center says a hidden password can still be filled in by autofill. Its advice is to "Treat hidden passwords as shared credentials." 1Password's offboarding steps for a departing member are to move their data, suspend the account, change the passwords they had access to, and then remove them. So with a password manager, the last day still includes changing job board passwords. [Does hiding a shared password keep it secret?](/guides/shared-accounts/hidden-password-sharing-limits) goes into detail.

You don't have to pick one method for everything. Give people their own users on boards that support it, and use a method that signs people in for them on accounts that can't be split. [Comparing ways for several people to use one shared account](/guides/shared-accounts/comparison-of-shared-account-methods) compares the methods for shared accounts in general.

## Shutting access off when the season ends

The last day goes smoothly if the roster exists before the season starts. Work through it in six steps.

1. Keep a roster with each person's name, type (employee, agency temp or short-term hire), job boards, method, start date and end date. The roster is the only place that says what to shut off on each end date.
2. On the end date, remove the person's users on the job boards. Until you do, they can sign in with the same rights. Indeed doesn't notify a removed user, so tell the staffing agency or the person's manager.
3. In your identity provider, take the person out of the app's group. In Entra ID, once they leave the group, they can't use the shared account.
4. In the password manager, suspend the person, change the job board passwords they could reach, and then remove them. Skip the change and they can still sign in with a password they saw.
5. If anyone was told a password directly, change it and give the new one to those who stay. If two-step codes go to that person's phone, move them too. [The limits of changing shared passwords every time someone leaves](/guides/shared-accounts/password-change-on-every-departure) covers this work.
6. A few days later, check each job board's user list for people who should be gone, which is where a missed step shows up.

Temps can leave before the date on the roster. NIST control PS-7 asks you to require outside firms, such as a staffing agency, to tell you when their people who hold your logins leave or move. Put that request in the agency agreement. Handling seasonal starts and ends with the same steps as hires and exits is covered in the [account checklist for onboarding and offboarding employees](/guides/hr-access/onboarding-offboarding-checklist).


## Frequently asked questions

**Is it overkill to create a login for a few weeks of help?**

No. NIST SP 800-53 IA-2 asks you to identify each user uniquely, and that includes people you treat like employees, such as contractors. On a job board like Indeed, adding and removing a user takes a few steps on the Users page.

**Do temps from a staffing agency need the same treatment?**

Yes. Give them their own access, write down their start and end dates, and shut it off on the end date. NIST SP 800-53 PS-7 asks you to require the agency to tell you when their people leave or move.

**Does hiding the password in a password manager keep a temp from learning it?**

Not fully. Bitwarden's help center says hidden passwords can still be used through autofill and should be treated as shared. 1Password's offboarding steps include changing the passwords the person could reach.

**Can our identity provider cover seasonal staff?**

Only if they have an account in it. Microsoft Entra ID's shared account feature needs an EMS, Entra ID P1 or P2 license for each user and the My Apps browser extension.

**What do we shut off first when the season ends?**

Work from the roster, sorted by end date. Remove job board users, take people out of identity provider groups and password manager vaults, then change any password someone was told.

## Sources

- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AC-2, IA-2, PS-7)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
- [Indeed Employer Help Center: Adding Users and Setting Access Levels](https://www.indeed.com/help/employers/articles/206589143?hl=en&co=US)
- [Indeed Employer Help Center: Users and Permissions Overview](https://www.indeed.com/help/employers/articles/users-and-permissions-overview?hl=en&co=US)
- [LinkedIn Help: Share job applicants with coworkers](https://www.linkedin.com/help/linkedin/answer/a516725/share-job-applicants-with-coworkers)
- [Microsoft Learn: Sharing accounts and credentials, Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-sharing-accounts)
- [1Password Support: Offboard a team member](https://support.1password.com/offboarding/)
- [Bitwarden Help Center: Collection permissions](https://bitwarden.com/help/collection-permissions/)

## How Junify handles this

**Doing this by hand** You set up job board and HR system access person by person, add and remove it whenever seasonal staff come and go or an RPO partner starts or finishes, and keep track of who opened applicant data.

**With Junify** With Junify, an admin adds the job board login once, adds each seasonal hire, and assigns them the account, so they can start on day one. They verify on their own phone and click to sign in without learning the password, even without a company email address. On their last day, the admin removes their access in Junify.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=hr&from=guide&cluster=hr-access&slug=seasonal-hiring-staff-without-sharing-passwords)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Handing job board accounts to an RPO partner](/guides/hr-access/handing-job-board-accounts-to-rpo): Add the partner's recruiters as users wherever the board allows it. If the CCPA covers you, the partner also needs a contract with service-provider terms.
- [Why a shared admin login in HR and payroll systems is a problem](/guides/hr-access/hr-payroll-system-shared-ids): With a shared admin login, anyone with the password sees Social Security numbers, and no log shows who changed pay. SSN laws, the CCPA and SOX ask about access.
- [Managing Indeed employer account users with an RPO partner or a hiring team](/guides/hr-access/indeed-employer-account-with-rpo): Indeed's terms say account access may not be shared, so add each person as a user. Admins add and remove users on the Users page. Removed users aren't notified.