When shared accounts can't be split into personal ones

The way to reduce shared accounts is one account per person. But how a service is built, or who needs to use it, leaves some accounts you can’t split even if you want to. The definition is in What is a shared account?.

Split what you can first

Security guidance starts from individual accounts. NIST SP 800-53 Rev. 5 asks organizations to define which account types are allowed and which are prohibited (AC-2 a). Its discussion lists shared and group accounts among the types organizations may want to prohibit because of increased risk. The CIS Controls ask for an inventory of all accounts (safeguard 5.1) and for deleting or disabling dormant accounts after 45 days of inactivity, where supported (safeguard 5.3). With personal accounts, the service’s records name the person who acted. When someone leaves, you disable their account and you’re done. So split first. This article is about what’s left over.

Tell the accounts you could split from the ones you can’t. Department email addresses are the usual example. A Microsoft 365 shared mailbox is a mailbox several people open with their own accounts. Microsoft says to block sign-in for the shared mailbox’s own account and keep it blocked. Google Workspace can turn a group into a Collaborative Inbox, where members assign conversations to each other and mark them complete. If everyone signs in to a department address with its own password, you can move it to one of these and stop sharing the login.

Four kinds of accounts that can’t be split

Microsoft’s Entra ID documentation names two common cases where several people end up on one username and password. One is a service that issues a single sign-in for the whole company, such as a corporate social media account. The other is a single high-privilege account used for setup, administration and recovery. Microsoft’s examples are an admin account in Microsoft 365 and the root account in Salesforce. Add limits on how many logins a service gives you and on who can be a user, and you get four kinds.

A service that gives you one login

The service expects one sign-in per user but gives your company only one, with no way to add users or split permissions. A supplier portal that issues one login per customer company would be this kind. Before you file an account here, check the service’s help pages for a way to add users.

The brand account itself

This is Microsoft’s first case. The account’s name is what the public sees, so a second account wouldn’t do the same job. Check the platform’s help pages for a way to give several people roles on the account. Where there is none, the login stays shared.

A single admin account

This is Microsoft’s second case. Other people may have their own logins, but the one account that can set up, administer and recover the service exists once. Day-to-day work can run on personal logins, while the admin account is kept for the jobs only it can do.

People you can’t add as users

Some services register only people inside your organization, or your own policy doesn’t give accounts to outsiders. A Microsoft 365 shared mailbox, for instance, can’t be opened by people outside your business. For them, Microsoft points to a Microsoft 365 group instead.

What to require of the shared accounts you keep

For every shared account you keep, settle three things: who knows the password, how each use gets tied to a person, and what happens when someone leaves. These line up with NIST SP 800-53 Rev. 5. AC-2(9) permits shared accounts only under conditions you define, and its discussion points to the lack of accountability. AC-2 k asks for a process to change a shared account’s password when someone leaves the group.

What each of the three looks like depends on the case. The table below is one way to set them. Here, a sign-in tool means an identity provider’s fill-in feature or an access management tool: anything that enters the password for a person.

The group that knows the password can be smaller than the group that uses the account only if people can sign in without knowing it. If admins hold the password and everyone else goes through a sign-in tool, the password stays with the admins. Managing shared accounts compares identity providers’ fill-in features (Okta, Microsoft Entra ID) with access management tools. Without such a tool, everyone who uses the account knows the password. Then each departure means changing it and sending the new one to everyone who stays.

The contract terms in the last row are examples. What your vendor contract should say about accounts goes into them, and your lawyer should review the wording.

The order to decide in

1. Check the service’s help pages for multiple users. If it supports them, split. Move department addresses to a shared mailbox or a group inbox.
2. For brand accounts, check whether the platform can give several people roles. Use roles where it can.
3. For each account you keep, write the three items above into your account list. If you can’t fill in all three, the account isn’t ready to keep yet. How to take inventory of shared accounts covers the list.