Managing shared accounts

As long as people share a password, you change and resend it each time someone leaves, and the service’s records can’t tell you who did what. You can’t remove every shared account. You can shrink the list, and choose how to run the accounts that remain.

What a shared account is

A shared account is one account on one service, meaning one username and password, that several people use. The service’s records show the account’s name, not the person behind it. What is a shared account? covers the definition and what NIST’s security controls say about it.

Why shared accounts exist and why they stay

Shared accounts start with how a service is built. Microsoft’s Entra ID documentation names two common cases. One is a service that issues a single sign-in for the whole company, such as a corporate social media account. The other is a single high-privilege account used for setup, administration and recovery. If a service gives you only one account, sharing is the only way to use it.

They stay for the same reason. You can’t change how another company’s service works. So you can split an account into personal ones only when the service supports more than one user. A brand’s social media profile stays shared. So does the admin login of a department tool that can’t connect to your single sign-on (SSO: one login that opens many apps).

What goes wrong with a shared login

The trouble falls into five kinds.

• People who left can still sign in. Anyone who knows the password gets in until someone changes it and sends out the new one.
• You can’t say who did something. The service’s records show only the account name.
• Nobody else can sign in when the person with the phone is out. The verification code appears on one registered phone, or goes to one registered number.
• Passwords end up on personal devices. People save the shared password in their browser or in a note.
• Unused accounts go unnoticed. Without an up-to-date list, nothing shows who still uses them.

Departures and records are the two that security guidance speaks to directly. NIST SP 800-53 Rev. 5 is a catalog of security controls. It is mandatory for federal information systems, and NIST encourages private organizations to consider it. Its account management control, AC-2, covers shared accounts. AC-2 k asks for a process to change a shared or group account’s passwords and other sign-in secrets when someone leaves the group. Enhancement AC-2(9) permits shared and group accounts only when they meet conditions the organization defines. Its discussion gives the reason: “the lack of accountability with such accounts.”

The CIS Controls, published by the Center for Internet Security, begin account management with a list. Safeguard 5.1 asks for a list of every account the organization manages, with active accounts confirmed as authorized at least quarterly. Neither text bans shared accounts. NIST permits them under conditions you set. To meet AC-2 k, you also need to know who holds each shared login, so you can cut off people who leave.

Ways to run shared accounts

There are four ways to let several people use one account. Which ones you can use depends on whether you run an identity provider. That’s a service such as Okta or Microsoft Entra ID that manages employees’ accounts and signs them in to many apps.

The first two rows and the last two differ on records. With a list or a password manager, the service’s records still show only the shared account’s name. An identity provider or an access management tool keeps its own record by person before the sign-in reaches the service. Device requirements differ too. A list works anywhere, and a password manager works wherever its vault opens. With Entra ID, people need Microsoft’s My Apps Secure Sign-in Extension in Edge or Chrome, or Edge on a phone.

Okta’s Secure Web Authentication (SWA) is for web apps that can’t use Okta’s standard single sign-on connection. An admin can set the app’s username and password. When the admin sets one shared login, Okta doesn’t let end users reveal the password. After signing in to Okta, people click the app and Okta fills in the login. Okta’s Application Usage report shows who signed in to which app during a period. Entra ID’s password-based SSO stores the password and submits it during sign-in. Microsoft requires an Enterprise Mobility Suite or Entra ID P1 or P2 plan for each person who uses a shared account this way. Microsoft says users with permission don’t see the shared password. Admins can grant or revoke access and see who accessed the app and when.

Some password managers can hide a shared password from the people using it. Bitwarden’s help center says users can still use hidden passwords through autofill. What is a password manager? covers sharing in more detail.

Where to start

Start with an inventory. Give each account a row with the service, the username, where the password is kept, who uses it and who owns it. Add where two-step verification codes go, and when someone last checked the row. That’s the minimum, and How to take inventory of shared accounts has the full set of columns. Without this list you can’t make the next two decisions.

Next, split off what you can. Services that let you add users or give admin rights to several people don’t need a shared login. Neither does a department email address. A Microsoft 365 shared mailbox is built for people to open with their own accounts. Microsoft says to block sign-in for the shared mailbox’s own account and keep it blocked. So moving a department address to a shared mailbox keeps the shared email while each person signs in as themselves. When shared accounts can’t be split sorts out the accounts that remain.

Last, decide how to run what remains. Pick from the table with three questions. Who uses the account, and are they in your identity provider? Do you need a record per account, or per person? Are the devices company-issued or personal? If you’re weighing scheduled password changes, look at NIST SP 800-63B-4. For the services that check passwords, it says: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically” (section 3.1.1.2). The same item says they shall force a change when there is evidence of compromise. Shared two-step verification has its own problems, covered in What is two-step verification?.