If a staff member or agency needs to publish a post, you do not need to hand over your personal Facebook password. Meta's business tools let portfolio owners add people and assign business assets such as a Facebook Page, Instagram account or ad account.
That separation matters when someone changes role or a contract ends. You can remove their access without changing your personal login, and people can work through their own accounts.
Assign access for the task
Before inviting someone, write down what they need to do. A person scheduling approved posts may need content permissions but not full control of the portfolio or access to billing. An agency running ads may need an ad account, while a photographer only needs the approved assets they are responsible for publishing.
Meta's interface and permission labels can change, so use the current Business Suite help centre. As a general process:
- Open the business portfolio settings.
- Add the person's own work account.
- Select only the relevant Page, Instagram account or ad account.
- Grant the permission required for the agreed tasks.
- Confirm the person has enabled two-factor authentication.
- Test that they can complete the job without expanding access unnecessarily.
Do not let a contractor be the only person with full control. Keep at least one trusted owner able to manage access, recovery and billing.
Review and remove access
Check the access list after an agency contract ends, a staff member leaves or a role changes. Remove permissions that are no longer needed and confirm connected tools or scheduled content still have an accountable owner.
Avoid sharing passwords in email, text or a group chat. If someone asks for full control, ask which task requires it and whether a narrower permission is enough.
See Meta's guide to adding people and assigning business assets and its explanation of Page access. For account recovery and login protection, see our Meta security checklist.