What is a shared account?

A shared account is one account on one service, meaning one username and password, that several people use.

How is a shared account different from a personal account?

The difference is whether the service’s records point to a person. With a personal account, the username in the records is the person who acted. With a shared account, the records show only the account’s name. To learn who acted, you have to check a list or ask around.

A department email address is a common case. If everyone signs in with the address’s own password, it is a shared account. A Microsoft 365 shared mailbox works differently: each person opens it with their own account, and Microsoft says to block sign-in for the mailbox’s own account.

Why do shared accounts exist?

They come from how services are built. Microsoft’s Entra ID documentation names two common cases. One is a service that issues a single sign-in for the whole company, such as a corporate social media account. The other is a single account with high privileges, used for setup, administration and recovery. Microsoft’s examples are an admin account in Microsoft 365 and the root account in Salesforce. You can’t change how a service works, so where it gives you only one account, sharing is the only way to use it.

What happens when someone leaves?

To cut off a person who left, or who moved to other work, you have to change the password and send the new one to everyone who stays. Until then, anyone who knows the old password can still sign in.

What do NIST’s account controls say?

NIST SP 800-53 Rev. 5 is NIST’s catalog of security and privacy controls. Its controls are mandatory for federal information systems, and NIST encourages private organizations to consider them. Control AC-2, Account Management, names shared and group accounts among the account types a system can have. It asks organizations to define which account types are allowed and which are prohibited (AC-2 a). It also asks for a process to change the authenticators of shared or group accounts when individuals are removed from the group (AC-2 k). Authenticators here means passwords and other sign-in secrets. The discussion gives the goal: former group members should not keep access.

Enhancement AC-2(9) goes a step further. It permits shared and group accounts only when they meet conditions the organization defines. Before allowing them, NIST asks organizations to consider “the increased risk due to the lack of accountability with such accounts.” So the catalog doesn’t ban shared accounts. It expects you to decide when one is acceptable, to know who uses it, and to cut off people who leave.