Most businesses have at least one login that several people know: the accounts@ mailbox, the website admin, the accounting system, a supplier's ordering portal. Passing the password on is the quickest way to get someone working, and for a while nothing seems wrong. The trouble appears later, when something changes and nobody can say who did it, or when someone leaves and still knows the password.
How shared logins creep in
A system bought when the firm had three staff got one login, which was handed on as the team grew. Adding users cost extra, or nobody set them up. People who watch the same email address were given its password because nobody showed them another way. Each decision made sense at the time; together they leave accounts that nobody fully controls.
Five problems with a shared password
You cannot see who did what
When five people sign in as one account, the system records one name. If a payment instruction is changed, a client record is deleted or a report is exported, the log shows the account, not the person.
Tracing an honest mistake means asking everyone what they were doing. Investigating fraud or a stolen password is much harder, because you cannot tell a colleague from a former employee or an attacker.
The password lives in too many places
A shared password ends up in emails, chat threads, spreadsheets and several browsers, and every copy can leak. If one person types it on an infected laptop, the attacker gets the whole team's access, and an unfamiliar sign-in is easy to dismiss as a colleague working from home.
Leavers keep the key
When someone with their own account leaves, you disable it and nobody else is affected. With a shared login, removing a leaver means changing the password and sending the new one to everyone else. Because that is disruptive, it often does not happen, and the former employee keeps access for as long as they remember the password.
MFA stops belonging to anyone
Multi-factor authentication (MFA) works because the second factor, such as an app on a phone or a security key, belongs to the person signing in. On a shared account, the prompt goes to one person's phone, so staff forward codes or approve prompts for each other, which is exactly the habit attackers exploit.
Everyone gets the account's full permissions
Whoever uses a shared login can do everything it can do. Someone who only needs to view client records can also export them. Individual accounts let you give each person what their role needs and no more, which is known as least privilege.
Why this matters for client trust and audits
Firms are often asked by clients and auditors to show who accessed what, and when. Client due diligence questionnaires and auditors typically look for individual accounts, regular access reviews and records that tie each action to a named person.
A shared login breaks that chain: the log exists, but it cannot answer the question. Individual accounts give clients and auditors the audit trail they expect.
The Microsoft 365 way: one person, one account
Most of our clients use Microsoft 365, which already has what you need.
Shared mailboxes without a shared password
Addresses such as accounts@ or info@ should be shared mailboxes, not ordinary accounts with a password passed around. Each authorised person opens the shared mailbox through their own account, and an administrator grants or removes that permission in the Microsoft 365 admin centre or the Exchange admin centre.
Microsoft recommends blocking direct sign-in to the shared mailbox account itself, so nobody signs in to it with a password. When someone changes role, you remove their permission and nobody else is affected.
Named admin accounts, kept separate
Give each administrator their own named admin account, separate from the account they use for email, Teams and everyday browsing. The admin account is used only when a task needs it. If an everyday account is caught by a phishing email, the attacker does not automatically gain control of your whole Microsoft 365 environment.
Review who holds admin roles in Microsoft Entra ID regularly. People often keep rights from a previous job because nobody removed them.
MFA for every person
With individual accounts in Entra ID (the sign-in service behind Microsoft 365), every person registers their own MFA method, such as Microsoft Authenticator or a passkey. Conditional Access, available on some Microsoft 365 plans, lets you require MFA across the organisation and set rules for where and how people sign in. When one person loses a phone, you reset their method and nobody else is affected.
When a login really has to be shared
Some older applications, devices and supplier portals only offer one login, and replacing them takes time. For those few accounts:
- Keep the password in a business password manager, never in email, chat or a spreadsheet.
- Make each person sign in to the password manager with their own account and MFA. Some business password managers also record who viewed or used a password.
- Limit access to the smallest group possible and review it when anyone changes role.
- Give each shared account a named owner who knows who has access, what it controls and where its recovery details are kept.
- Change the password whenever someone leaves the group.
Our article on how password managers protect your accounts explains how these tools work.
Service accounts are a separate case
Some accounts are used by software rather than people, such as a backup system reaching a server. Each should have only the permissions its task needs, a documented purpose and owner, and credentials that staff do not see. Identify them before any clean-up, so nobody disables one and quietly stops a backup or an integration.
Offboarding without loose ends
Leavers are where shared logins do the most damage. With individual accounts, a clean exit in Microsoft 365 looks like this:
- Block sign-in for the person's account and use "Revoke sessions" in Entra ID to end their existing sessions.
- Remove their access to shared mailboxes, Teams, SharePoint sites and any admin roles.
- Check their mailbox for inbox rules and forwarding in the Exchange admin centre.
- Change any shared passwords they knew and remove them from the password manager.
- Check other systems, such as accounting software and supplier portals, for accounts in their name or recovery details pointing to their personal phone or email.
Our managed IT service handles joiners, movers and leavers with the same checklist every time.
How to replace shared logins step by step
- List them, with who uses each one and why. Old messages and browser password stores reveal forgotten ones.
- Create named accounts where the system supports them, with only the permissions each role needs and MFA for each person.
- Test, then switch off the old login, or move it into the password manager with an owner if it must stay shared.
- Build the check into onboarding, role changes and offboarding, so shared logins do not creep back.
Frequently asked questions
Is a shared login acceptable if MFA is turned on?
MFA makes a stolen password less useful, but it does not tell you who did what. Use separate accounts wherever the system allows it.
Is it safe to have a shared email address like info@?
Yes. The address is not the problem; the shared password is. Set the address up as a shared mailbox that staff open through their own accounts, with direct sign-in blocked.
Do we need to replace every shared login at once?
No. Start with admin accounts and anything holding client, financial or staff data, then work through the rest.
Sources and further reading
- Microsoft: About shared mailboxes
- UK National Cyber Security Centre: Creating separate user accounts
- UK National Cyber Security Centre: Password policy, updating your approach
- Cyber Security Agency of Singapore (CSA)
- HKCERT
If you'd like us to find the shared logins in your business and replace them with named accounts, talk to our team or read more about our cybersecurity services.
