Start with a responsibility list
List each person’s work: campaign editing, reporting, payment reconciliation, asset administration or support. Include outside providers only where their role requires access. A job title such as “media buyer” is less useful than a clear description of the actions that person must perform.
For each role, nominate the business owner who can approve permissions. Record a backup contact for operational continuity, but do not give everyone broad control just because someone might be absent.
Map the actual assets
Separate the advertising account, Page, Instagram account, dataset and catalog. Note which business owns each asset and which person or partner needs to use it. Meta’s portfolio training distinguishes managing users and accounts from security decisions; your handover should make those responsibilities visible.
Use the authorized invitation or sharing options available for the specific business and asset. Verify the current interface rather than copying an old sequence of screenshots. Do not assume that an asset belongs to the customer merely because a supplier granted campaign access.
Move carefully from a shared arrangement
If the team currently relies on shared credentials, ask the legitimate owner to assess the supported transition to individual access. First verify that the owner can still administer the assets. Then agree the intended permissions, issue authorized invitations and confirm that each recipient can perform the required task.
Remove obsolete access only after checking business continuity and the owner’s instructions. Never use the transition to impersonate another person, acquire somebody else’s identity or conceal an unresolved platform restriction.
Keep login protection separate from sales support
Meta recommends account protections such as two-factor authentication and warns that attackers target people connected to business assets. Treat passwords, login codes and recovery codes as private security material, not routine onboarding documents.
Confirm unexpected access requests through a known channel. A familiar logo or Telegram display name is not proof that a request came from the supplier you normally use.
- Authorized person and role confirmed.
- Correct assets and required permissions listed.
- Recovery owner and backup contact recorded.
- Access verified without exchanging secret login codes.
Review access when the relationship changes
Recheck permissions when someone leaves, a supplier changes or a new brand joins the operation. Keep a simple record of approvals and removals. The goal is accountable access that continues to match the work.
Elite Ecom account offers can involve different arrangements. Ask what access the chosen offer actually provides before payment; this guide does not promise that every package has the same delivery method.
Sources & further reading
- Meta Blueprint — Setting up a business portfolio ↗Accessed October 18, 2026
- Meta — How We Protect Businesses From Malware ↗Accessed October 18, 2026