# Managing shared accounts

A shared account is one login that several people use. Move what you can to personal accounts, and run the rest in a way that shows who used them.

Updated: October 16, 2026

As long as people share a password, you change and resend it each time someone leaves, and the service's records can't tell you who did what. You can't remove every shared account. You can shrink the list, and choose how to run the accounts that remain.

## What a shared account is

A shared account is one account on one service, meaning one username and password, that several people use. The service's records show the account's name, not the person behind it. [What is a shared account?](/guides/shared-accounts/what-is-shared-account) covers the definition and what NIST's security controls say about it.

## Why shared accounts exist and why they stay

Shared accounts start with how a service is built. Microsoft's Entra ID documentation names two common cases. One is a service that issues a single sign-in for the whole company, such as a corporate social media account. The other is a single high-privilege account used for setup, administration and recovery. If a service gives you only one account, sharing is the only way to use it.

They stay for the same reason. You can't change how another company's service works. So you can split an account into personal ones only when the service supports more than one user. A brand's social media profile stays shared. So does the admin login of a department tool that can't connect to your single sign-on (SSO: one login that opens many apps).

## What goes wrong with a shared login

The trouble falls into five kinds.

- People who left can still sign in. Anyone who knows the password gets in until someone changes it and sends out the new one.
- You can't say who did something. The service's records show only the account name.
- Nobody else can sign in when the person with the phone is out. The verification code appears on one registered phone, or goes to one registered number.
- Passwords end up on personal devices. People save the shared password in their browser or in a note.
- Unused accounts go unnoticed. Without an up-to-date list, nothing shows who still uses them.

Departures and records are the two that security guidance speaks to directly. NIST SP 800-53 Rev. 5 is a catalog of security controls. It is mandatory for federal information systems, and NIST encourages private organizations to consider it. Its account management control, AC-2, covers shared accounts. AC-2 k asks for a process to change a shared or group account's passwords and other sign-in secrets when someone leaves the group. Enhancement AC-2(9) permits shared and group accounts only when they meet conditions the organization defines. Its discussion gives the reason: "the lack of accountability with such accounts."

The CIS Controls, published by the Center for Internet Security, begin account management with a list. Safeguard 5.1 asks for a list of every account the organization manages, with active accounts confirmed as authorized at least quarterly. Neither text bans shared accounts. NIST permits them under conditions you set. To meet AC-2 k, you also need to know who holds each shared login, so you can cut off people who leave.

## Ways to run shared accounts

There are four ways to let several people use one account. Which ones you can use depends on whether you run an identity provider. That's a service such as Okta or Microsoft Entra ID that manages employees' accounts and signs them in to many apps.

| Method | What it does | What it leaves | Fits when |
| --- | --- | --- | --- |
| A list plus scheduled password changes | Needs no tools; the list shows who knows each password | Everyone knows the password, and each change means sending it out again | A few people use the account |
| Sharing through a password manager | Shares a vault and fills in logins | Everyone with access can use the password, even when it's hidden | You want to tidy how passwords are stored and handed out |
| The identity provider fills in the login (Okta Secure Web Authentication, Entra ID password-based SSO) | Signs people in without showing the password | Covers only people who have an account in the identity provider | Everyone who uses the account has an account there |
| An access management tool | Enters the password on the person's behalf | Supported apps and devices vary by product | Some users have no account in your identity provider |

The first two rows and the last two differ on records. With a list or a password manager, the service's records still show only the shared account's name. An identity provider or an access management tool keeps its own record by person before the sign-in reaches the service. Device requirements differ too. A list works anywhere, and a password manager works wherever its vault opens. With Entra ID, people need Microsoft's My Apps Secure Sign-in Extension in Edge or Chrome, or Edge on a phone.

Okta's Secure Web Authentication (SWA) is for web apps that can't use Okta's standard single sign-on connection. An admin can set the app's username and password. When the admin sets one shared login, Okta doesn't let end users reveal the password. After signing in to Okta, people click the app and Okta fills in the login. Okta's Application Usage report shows who signed in to which app during a period. Entra ID's password-based SSO stores the password and submits it during sign-in. Microsoft requires an Enterprise Mobility Suite or Entra ID P1 or P2 plan for each person who uses a shared account this way. Microsoft says users with permission don't see the shared password. Admins can grant or revoke access and see who accessed the app and when.

Some password managers can hide a shared password from the people using it. Bitwarden's help center says users can still use hidden passwords through autofill. [What is a password manager?](/guides/shared-accounts/what-is-password-manager) covers sharing in more detail.

## Where to start

Start with an inventory. Give each account a row with the service, the username, where the password is kept, who uses it and who owns it. Add where two-step verification codes go, and when someone last checked the row. That's the minimum, and [How to take inventory of shared accounts](/guides/shared-accounts/shared-account-inventory) has the full set of columns. Without this list you can't make the next two decisions.

Next, split off what you can. Services that let you add users or give admin rights to several people don't need a shared login. Neither does a department email address. A Microsoft 365 shared mailbox is built for people to open with their own accounts. Microsoft says to block sign-in for the shared mailbox's own account and keep it blocked. So moving a department address to a shared mailbox keeps the shared email while each person signs in as themselves. [When shared accounts can't be split](/guides/shared-accounts/when-accounts-cannot-be-split) sorts out the accounts that remain.

Last, decide how to run what remains. Pick from the table with three questions. Who uses the account, and are they in your identity provider? Do you need a record per account, or per person? Are the devices company-issued or personal? If you're weighing scheduled password changes, look at NIST SP 800-63B-4. For the services that check passwords, it says: "Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically" (section 3.1.1.2). The same item says they shall force a change when there is evidence of compromise. Shared two-step verification has its own problems, covered in [What is two-step verification?](/guides/shared-accounts/what-is-two-step-verification).


## Articles in this guide

- [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both.
- [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password.
- [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.
- [What to check when choosing a tool for shared accounts](/guides/shared-accounts/choosing-shared-account-tools): First decide if you need storage, sign-in or records. Then check who sees the password, how long records last, what removal takes, and who gets two-step codes.
- [Comparing ways for several people to use one shared account](/guides/shared-accounts/comparison-of-shared-account-methods): A list, a password manager, your identity provider or an access management tool. They differ on who knows the password and how each use is recorded.
- [Can you password protect a Google Sheet?](/guides/shared-accounts/google-sheets-password-protection): No. Google Sheets has no password to open a file. Sharing decides who can open it, and anyone who can open a sheet of logins can read every password in it.
- [Does hiding a shared password keep it secret?](/guides/shared-accounts/hidden-password-sharing-limits): No. LastPass, 1Password, Bitwarden and Keeper all say people can still get a password shared as hidden. Treat it as handed over, and change it when they leave.
- [How Keeper and Junify differ for shared accounts at work](/guides/shared-accounts/keeper-and-junify): Keeper fits employees who store and share their own passwords. Junify fits shared accounts used without seeing the password, even by people without Keeper.
- [How LastPass and Junify differ for shared accounts at work](/guides/shared-accounts/lastpass-and-junify): LastPass fits storing employees' passwords and sharing them through shared folders. Junify fits shared accounts people use without seeing the password.
- [What to check before you move off a password manager](/guides/shared-accounts/moving-off-password-manager): Know why you're moving and sort the vault before you export. Some items don't carry over, CSV exports aren't encrypted, and shared passwords may need changing.
- [The limits of changing shared passwords every time someone leaves](/guides/shared-accounts/password-change-on-every-departure): A password someone knows can't be taken back, so a change at each departure makes sense. The limits are resending it, and gaps when no list shows who knows it.
- [How long should a password be?](/guides/shared-accounts/password-length-recommendations): NIST SP 800-63B-4 requires 15 characters for a password used alone, 8 with a second factor, and no mixing rules. PCI DSS requires 12. CISA recommends 16.
- [What to stop and what to change when someone leaves a shared password manager](/guides/shared-accounts/password-manager-offboarding): Suspend the person in the admin console, then change every password in the vaults they could open. Suspending closes the vault, not a password they already saw.
- [A password policy template and how to write each section](/guides/shared-accounts/password-policy-template): A password policy covers scope, password rules, storage, sharing, shared accounts, two-step verification, changes, departures, violations and review.
- [Do passwords still need to be changed every 90 days?](/guides/shared-accounts/periodic-password-change): Not if only one person knows it. NIST SP 800-63B-4 bans forced scheduled changes and requires one after a compromise. Shared passwords change when people leave.
- [Can employees keep work passwords in their personal password manager?](/guides/shared-accounts/personal-password-manager-at-work): It's best not to. The vault belongs to the employee, so the company can't open it, collect it or confirm it's empty when they leave. Use a business plan.
- [How to take inventory of shared accounts and what to record](/guides/shared-accounts/shared-account-inventory): A shared account inventory lists who knows each password and who may use each account. Find the accounts, record what matters, sort them, and keep it current.
- [Can a team share one ChatGPT account at work?](/guides/shared-accounts/sharing-chatgpt-accounts-at-work): No. OpenAI's Terms of Use bar sharing your login, and its business agreement allows one user per account. Anthropic's terms for Claude say the same.
- [Sharing two-step verification across a team](/guides/shared-accounts/sharing-two-step-verification): Codes reach one phone, or every phone that scanned the setup QR code. Keep backup codes in one place, log each sign-in, and redo the setup when someone leaves.
- [What to fix first when your passwords live in a spreadsheet](/guides/shared-accounts/spreadsheet-password-management): First limit who can open the sheet. Next turn it into a list of accounts. Last move the passwords out. The account list can stay in the spreadsheet.
- [How to stop sending passwords over Slack, Teams and email](/guides/shared-accounts/stop-sending-passwords-in-chat): A password sent in a message can be searched, forwarded and exported, and it outlasts people who leave. Set up another way to share it, then write the rule.
- [What is a password manager?](/guides/shared-accounts/what-is-password-manager): A password manager keeps logins in an encrypted vault and fills them in. A shared vault means no passwords sent by chat, but everyone with access can use them.
- [What is a shared account?](/guides/shared-accounts/what-is-shared-account): A shared account is one login that several people use on a service. Its records show the account, not the person, so you need another way to tell who acted.
- [What is two-step verification?](/guides/shared-accounts/what-is-two-step-verification): Two-step verification adds a second check after the password, like an app code or security key. Shared by a team, it no longer ties a sign-in to one person.
- [When shared accounts can't be split into personal ones](/guides/shared-accounts/when-accounts-cannot-be-split): Give each person their own account where you can. Sharing remains for single-login services, brand accounts, lone admin accounts and outsiders you can't add.

## Frequently asked questions

**Should we get rid of every shared account?**

Split off what you can into personal accounts first. Some accounts will remain, such as a single admin account or the company social media profile, so decide how to run those.

**Does changing the password on a schedule keep a shared account safe?**

Everyone gets the new password, so the same people still know it. NIST SP 800-63B-4 says verifiers shall not require periodic changes, and shall force a change when there is evidence of compromise.

**What columns should a shared account list start with?**

Service, username, where the password is kept, who uses it, who owns it, where two-step verification codes go, and the date someone last checked the row.

**Can Okta or Microsoft Entra ID handle shared accounts?**

Both can store a shared username and password and fill it in for people, through Okta's Secure Web Authentication or Entra ID's password-based single sign-on. Check your plan and the app's requirements in their help pages.

## Sources

- [Microsoft Learn: Sharing accounts and credentials - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-sharing-accounts)
- [Microsoft Learn: About shared mailboxes in Microsoft 365](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes)
- [Okta Help Center: About Secure Web Authentication](https://help.okta.com/oie/en-us/content/topics/apps/apps-about-swa.htm)
- [Okta Help Center: Reveal the password of an app integration](https://help.okta.com/oie/en-us/content/Topics/apps/apps_revealing_the_password.htm)
- [Okta Help Center: Report types](https://help.okta.com/oie/en-us/content/topics/reports/report-types.htm)
- [Bitwarden Help Center: Collection permissions](https://bitwarden.com/help/collection-permissions/)
- [1Password Support: Create and share vaults](https://support.1password.com/create-share-vaults-teams/)
- [NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (July 2025)](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AC-2)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf)
- [CIS Controls Assessment Specification: CIS Control 5, Account Management](https://cas.docs.cisecurity.org/en/latest/source/Controls5/)

## How Junify handles this

**Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login.

**With Junify** Junify is for the shared accounts you can't split. Your admin adds the username and password to Junify. People verify on their own phone and click to sign in without being shown the password, and each use is recorded by person even though the login stays shared. Okta or Entra ID stays as it is; you add only the accounts that sit outside it.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)