How shared logins creep in
Nobody sets out to build a business on shared passwords. It starts with a reception computer that everyone uses, a single accounts@ mailbox that three people log in to, or a supplier portal where the first person to register set a password and wrote it on a sticky note. A few years later, half the team knows the login to the bank portal, the website editor and the main Microsoft 365 admin account, and nobody remembers how it got that way.
The other common source is cost. Paying for one licence and letting four people use it looks thrifty. In practice it usually breaches the software's terms, and the hidden costs arrive later: an account locked because four devices are signing in at once, a supplier asking who placed an order, or an ex-employee who can still sign in because nobody wanted to change the password and re-tell everyone.
What goes wrong
The first problem is accountability. If an invoice is changed, a file is deleted or a refund is processed from a shared account, the log simply shows the account name. You can't tell whether it was a mistake, a misunderstanding or something worse. That matters for internal disputes and it matters a great deal if you ever need to work out what happened after a scam or a breach.
The second is security. Multi-factor authentication is built around one person and one phone. With a shared account, people either leave MFA off, or register one phone that has to be passed around, or share the authenticator codes in a group chat. All three undo the protection. Shared passwords also tend to be weak and old, because changing them is a hassle for everyone. The third is departures. When someone who knows a shared password leaves, the only safe step is to change it and tell everyone else the new one. In busy offices that often doesn't happen, which means former staff keep working access to real systems long after they've gone.
What to use instead
Most shared accounts exist to solve a problem that already has a proper tool. If several people need to read and reply to accounts@ or info@, make it a shared mailbox in Microsoft 365 or a collaborative inbox in Google Workspace; each person opens it with their own login, and replies are recorded against the person who sent them. Shared mailboxes generally don't need their own paid licence, but confirm the current rules for your plan.
If people share a login to get at the same files, move the files to a SharePoint site, Teams channel or shared drive with group permissions. For a shared reception or workshop PC, give each person their own sign-in, or use a kiosk-style setup that only runs the one app needed. For third-party websites that genuinely allow only one login, store the credential in a business password manager and share it from there, so you can see who has access and remove them in one click.
Moving off shared accounts without chaos
List every shared login you know of, who uses it and what it is for. Your bookkeeper and office manager usually know most of them. Then rank them: admin accounts, banking and anything that moves money come first, followed by email and file access, then low-risk sites like courier booking. Tackle one or two a week rather than trying to change everything on a Monday morning.
For each one, create individual accounts where the system supports them, test that each person can sign in, then disable or change the shared credential. Tell people in advance what is changing and why. Most staff are relieved, because it means they are no longer blamed for something someone else did under the same name.
The admin account deserves special care
The one shared account that does the most damage is the main administrator login, often created by whoever first set up Microsoft 365 and then passed around ever since. Nobody should use a global admin account for daily work. Give the person or provider who manages IT their own named admin account with strong MFA, keep a separate emergency admin account whose details are sealed and stored safely, and remove admin rights from everyone else.
This is also a good moment to look at who has admin rights in Xero, the bank and your website. Admin rights should belong to named individuals who need them, with at least two people holding them so the business is never stuck if one is away. List those names somewhere the owner can see them, and check the list whenever someone joins or leaves.
In short
- Shared logins hide who did what and make MFA ineffective.
- Shared mailboxes, shared folders and a password manager replace most shared accounts.
- Start with admin, banking and payment logins.
- Never use a global admin account for everyday work.