# What is a shared account? A shared account is one login that several people use on a service. Its records show the account, not the person, so you need another way to tell who acted. Updated: October 16, 2026 A shared account is one account on one service, meaning one username and password, that several people use. ## How is a shared account different from a personal account? The difference is whether the service's records point to a person. With a personal account, the username in the records is the person who acted. With a shared account, the records show only the account's name. To learn who acted, you have to check a list or ask around. A department email address is a common case. If everyone signs in with the address's own password, it is a shared account. A Microsoft 365 shared mailbox works differently: each person opens it with their own account, and Microsoft says to block sign-in for the mailbox's own account. ## Why do shared accounts exist? They come from how services are built. Microsoft's Entra ID documentation names two common cases. One is a service that issues a single sign-in for the whole company, such as a corporate social media account. The other is a single account with high privileges, used for setup, administration and recovery. Microsoft's examples are an admin account in Microsoft 365 and the root account in Salesforce. You can't change how a service works, so where it gives you only one account, sharing is the only way to use it. ## What happens when someone leaves? To cut off a person who left, or who moved to other work, you have to change the password and send the new one to everyone who stays. Until then, anyone who knows the old password can still sign in. ## What do NIST's account controls say? NIST SP 800-53 Rev. 5 is NIST's catalog of security and privacy controls. Its controls are mandatory for federal information systems, and NIST encourages private organizations to consider them. Control AC-2, Account Management, names shared and group accounts among the account types a system can have. It asks organizations to define which account types are allowed and which are prohibited (AC-2 a). It also asks for a process to change the authenticators of shared or group accounts when individuals are removed from the group (AC-2 k). Authenticators here means passwords and other sign-in secrets. The discussion gives the goal: former group members should not keep access. Enhancement AC-2(9) goes a step further. It permits shared and group accounts only when they meet conditions the organization defines. Before allowing them, NIST asks organizations to consider "the increased risk due to the lack of accountability with such accounts." So the catalog doesn't ban shared accounts. It expects you to decide when one is acceptable, to know who uses it, and to cut off people who leave. ## Frequently asked questions **Are shared accounts allowed?** NIST SP 800-53, mandatory for federal systems, doesn't ban them. AC-2(9) permits shared and group accounts that meet conditions the organization sets, and AC-2 k asks for a process to change their passwords when people leave the group. **Is a department email address a shared account?** It is if everyone signs in with the address's own password. If people open it as a shared mailbox with their own accounts, it isn't. **How can I tell a shared account from a personal one?** Look at the service's records. If the username there points to the person who acted, it's personal. If it shows only the account name and you have to find the person some other way, it's shared. ## Sources - [Microsoft Learn: Sharing accounts and credentials - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/users-sharing-accounts) - [Microsoft Learn: About shared mailboxes in Microsoft 365](https://learn.microsoft.com/en-us/microsoft-365/admin/email/about-shared-mailboxes) - [NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (AC-2)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf) ## How Junify handles this **Doing this by hand** To keep shared accounts safe, you track who knows each password, and change it and send out the new one whenever someone leaves. You also keep a separate record of who did what under the same login. **With Junify** Junify lets you keep a shared account and still know who used it. People verify on their own phone before they open it, so Junify records each use by person even when the service's records show only the account name. You stop relying on a list or on asking around. The admin adds the password, and it isn't shown to the people who use the account. Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when. - [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=shared-accounts&from=guide&cluster=shared-accounts&slug=what-is-shared-account) - [Book a 30-minute demo](https://www.junify.com/bpo/demo) ## More on this topic - [How 1Password and Junify differ for shared accounts](/guides/shared-accounts/1password-and-junify): 1Password fits storing and sharing each employee's own passwords. Junify fits shared accounts people should use without seeing the password. You can run both. - [How Bitwarden and Junify differ for shared accounts at work](/guides/shared-accounts/bitwarden-and-junify): Bitwarden fits employees who keep their own passwords and share some with trusted coworkers. Junify fits shared accounts used without seeing the password. - [Should employees save work passwords in the browser?](/guides/shared-accounts/browser-saved-passwords-at-work): Fine for a person's own work login, in a company-managed profile, on a device only they use. Avoid it for shared accounts, personal devices and personal sync.