# How to handle admin logins for domain, DNS and payment consoles

Check each console's help docs for identity provider sign-in, personal logins with roles, and required two-step verification. Split logins wherever you can.

Updated: October 16, 2026

Domain registrars, DNS services and payment dashboards often sit outside your identity provider (such as Okta or Microsoft Entra ID), and their admin login gets passed around. Before you write rules for sharing it, read the console's own help docs. All three examples below let you add each person under their own login, and two of them connect to your identity provider.

## Three things to check in the help docs

1. Can people sign in through your identity provider? Search the help center for "SSO" or "single sign-on" (one company login that opens many apps). If yes, people use their company login, and you manage their access where you manage everything else.
2. Can you add people with their own login and role? Look for "team," "members," "users" or "delegate." If yes, each person gets their own login, and you can limit what each one can change.
3. Can you require two-step verification, and with which methods? Look under "security." Authenticator apps and security keys stay with each person. Codes by text or email go to one phone number or address, so you have to decide whose it is.

## What Cloudflare, Stripe and GoDaddy offer

These three cover DNS, payments and domain registration. A dash means the pages cited don't describe it.

| | Cloudflare | Stripe | GoDaddy |
| --- | --- | --- | --- |
| Sign-in through your identity provider | Dashboard single sign-on, free on all plans, for a company email domain you verify | Any identity provider that supports SAML 2.0 | — |
| Personal logins | Super Administrators invite members by email | Invite team members by email; invites expire after 10 days | Delegate access: the delegate signs in with their own GoDaddy account |
| Roles | Super Administrator, Administrator, Administrator Read Only, Billing, DNS and others | Super Administrator, Administrator, IAM Administrator, Developer, Analyst, View Only and others | Four delegate levels, from products, domains and purchases down to account connection only |
| Two-step verification | Security key, authenticator app or email; a Super Administrator can require it for all members | Administrators can require it for the whole team | GoDaddy app, authenticator app, passkey or security key, or text message |

At Cloudflare, a Super Administrator can change any setting, make purchases, update billing and manage members. An Administrator can work across the whole account but can't manage members or the billing profile. Only Super Administrators add and remove members. When a Super Administrator turns on required two-factor authentication, invited members must set it up before they can accept. Dashboard single sign-on, once on, applies to every user on that email domain, existing users included. Cloudflare advises keeping a backup way to turn it off in case you get locked out.

At Stripe, each account has one account owner. The IAM Administrator role handles only access: inviting, editing and removing team members. Stripe asks you to grant the lowest permission each person needs for their job. It also warns that if an attacker takes over a user whose role can invite others, they can invite more users under their control. When you require two-step authentication, members without it set it up at their next sign-in, and new invitees set it up before joining. Stripe keeps team members' account activity from the past 180 days in its security history.

Stripe's single sign-on can be required for everyone or offered alongside email and password. One limit matters for departures. Without automatic user sync, Stripe doesn't hear right away when you remove someone in the identity provider. It cuts them off only once their Stripe sign-in expires and they try to sign in again. To remove someone at once, delete them in Stripe's team settings.

At GoDaddy, you invite a delegate by name and email address, and they need their own GoDaddy account to accept. An invitation expires if it isn't accepted within 48 to 72 hours. Delegates can't invite others, manage payment methods, or view or change your account password or Support PIN. You can remove a delegate at any time. GoDaddy recommends at least one backup verification method, set up on a different device.

## When the console lets you add people

Consoles like these three can be run the way Google Workspace or Microsoft 365 are ([Managing top-level admin accounts in Google Workspace and Microsoft 365](/guides/privileged-access/google-workspace-microsoft-365-admins)). Give the top role to very few people, and give everyone else the role their work needs. Require two-step verification for everyone. When someone leaves or changes roles, remove them. The console's log then shows each person's name, and nobody needs the shared admin password.

## When the console has only one login

If a console's help docs show no way to add people, several people end up using one login. Three decisions follow.

1. Keep the list of people who know the password short, and log who knows it and who used it when. The console's own log shows only the account name.
2. Decide where two-step codes go. A code sent by text or email reaches one phone number or address. If that's one person's, nobody else can sign in while they're out. Use a company-managed number or mailbox, or name who receives codes and how they pass them on. [Sharing two-step verification across a team](/guides/shared-accounts/sharing-two-step-verification) goes through the options.
3. Change the password when someone leaves or changes roles. With one login, you can't remove just that person.

[When shared accounts can't be split into personal ones](/guides/shared-accounts/when-accounts-cannot-be-split) covers the general case. The ways to keep a shared login while recording who used it are compared in [Managing privileged accounts](/guides/privileged-access).


## Frequently asked questions

**Can domain and payment consoles connect to our identity provider?**

Some can. Cloudflare offers dashboard single sign-on on all plans, and Stripe supports SAML 2.0 sign-in. Check the console's help center first. If it connects, people sign in with their company login.

**Can we require two-step verification for everyone?**

In Cloudflare a Super Administrator can, and in Stripe an administrator can, from the team settings. New members then have to set it up before they can join.

**What do we do with a console that has only one login?**

Keep the people who know the password few and log who they are. Send two-step codes to a company-managed number or address. Change the password whenever someone leaves or changes roles.

**Who should be able to add members?**

As few people as possible. Stripe warns that if an attacker takes over a user who can invite others, they can invite more users under their control.

## Sources

- [Cloudflare Docs: Two-factor authentication](https://developers.cloudflare.com/fundamentals/user-profiles/2fa/)
- [Cloudflare Docs: Roles](https://developers.cloudflare.com/fundamentals/manage-members/roles/)
- [Cloudflare Docs: Manage account members](https://developers.cloudflare.com/fundamentals/manage-members/manage/)
- [Cloudflare Docs: Set up dashboard SSO](https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/)
- [Stripe Docs: Start a team](https://docs.stripe.com/get-started/account/teams)
- [Stripe Docs: User roles](https://docs.stripe.com/get-started/account/teams/roles)
- [Stripe Docs: Single sign-on (SSO)](https://docs.stripe.com/get-started/account/sso)
- [Stripe Support: Require two-step authentication for your team](https://support.stripe.com/questions/require-two-step-authentication-for-your-team)
- [GoDaddy Help: Delegate access: Levels of permission](https://www.godaddy.com/help/delegate-access-levels-of-permission-12374)
- [GoDaddy Help: Invite a delegate to access my GoDaddy account](https://www.godaddy.com/help/invite-a-delegate-to-access-my-godaddy-account-12376)
- [GoDaddy Help: Remove a delegate user from my account](https://www.godaddy.com/help/remove-a-delegate-user-from-my-account-19326)
- [GoDaddy Help: Enable an identity verification method for your GoDaddy account](https://www.godaddy.com/help/add-a-hardware-security-key-for-two-step-verification-31900)

## How Junify handles this

**Doing this by hand** You decide who gets admin rights through requests and approvals, log every use of the admin logins that stay shared, and have someone other than the admins review that log on a schedule.

**With Junify** Junify covers consoles you sign in to with one username and password, outside your identity provider. An admin adds the console login to Junify and assigns it to the people who may use it. They verify on their own phone and click, and Junify fills in the login without showing the password, including authenticator-app codes. Each sign-in is recorded by person, and the console's IP restrictions stay in place.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=privileged-access&from=guide&cluster=privileged-access&slug=non-saml-admin-consoles)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Managing the AWS root user and admin access for a team](/guides/privileged-access/aws-root-and-admin-accounts): AWS says to keep the root user for the few tasks only it can do. Give admins personal sign-ins through IAM Identity Center, and protect and log the root user.
- [Ways to manage shared SaaS admin accounts, compared](/guides/privileged-access/comparison-of-privileged-account-methods): A sign-out log, your identity provider's fill-in, a privileged access management (PAM) product, and an access tool such as Junify, compared on seven points.
- [Managing top-level admin accounts in Google Workspace and Microsoft 365](/guides/privileged-access/google-workspace-microsoft-365-admins): Keep few top-level admins, give everyone else a narrower role, require two-step verification for admins, and keep emergency accounts apart from daily ones.