A shared login often starts because it is easy. Someone creates an account, gives the password to two or three people, and the team gets on with the job.
The problem usually shows up later. More people get the password, MFA becomes awkward, nobody is quite sure who changed something, and when a team member leaves the business has to work out everywhere that shared credential was used.
Shared access is fine. Shared credentials are the problem.
There is an important difference between several people using the same business resource and several people signing in as the same user.
An accounts team may genuinely need one shared mailbox. A project team may need the same files. Reception may need a common calendar. None of that requires everyone to know one shared password.
Microsoft’s normal shared-mailbox model is a good example: users sign in with their own accounts and are then granted access to the shared mailbox. Microsoft specifically recommends keeping direct sign-in to the shared mailbox account blocked. Google Workspace similarly says accounts are intended for one person and points organisations toward shared inboxes and shared drives instead.
Photo by Annie Spratt via Unsplash.
You lose a useful audit trail
If six people all use the same username, logs can tell you what the account did but not necessarily which person did it. That becomes a problem when something is deleted, a setting changes, a suspicious login appears or the business simply needs to work out what happened.
Unique user accounts make the answer much clearer. They also make it easier to give each person only the access they actually need.
MFA gets messy very quickly
Multi-factor authentication works best when an account belongs to a person. That person signs in and approves their own authentication request.
With a shared login, businesses often end up registering one person’s phone, sharing one-time codes in chat, or weakening MFA because the normal process is inconvenient. At that point the convenience of the shared account has started working against the security control.
Team changes become harder than they need to be
With individual accounts, offboarding is fairly clean: remove the user, transfer anything they own and revoke their access.
With shared credentials, you need to remember every account that person knew the password for, change those passwords, update saved credentials and make sure nothing breaks. If the password has been shared for years, it can be surprisingly hard to know who still has it.
The same issue applies to shared file accounts
We still come across cloud-storage setups where an entire team uses one Google, Dropbox or other cloud account because that is where the files live.
Modern business platforms already have better ways to solve this. Google Workspace has shared drives, Dropbox team accounts use separate member access, and Microsoft 365 uses SharePoint and Teams for shared business files. The data can stay shared without making the identity shared as well.
Photo by Growtika via Unsplash.
What if a shared account cannot be removed yet?
Sometimes a legacy application genuinely only supports one login, or changing the workflow will take time. In that case, treat the shared account as an exception rather than the default.
Keep track of who has access, use MFA where the application supports it, store the credential in a proper business password manager, rotate it when team members change and give the account the minimum permissions required. The Australian Cyber Security Centre specifically recommends limiting shared accounts and securing any that still have to be used.
A simple example: accounts@
If three team members need to read and reply from accounts@yourbusiness.com.au, the clean setup is normally three individual Microsoft 365 accounts with permission to the accounts shared mailbox.
Each person signs in as themselves. Access can be removed individually. MFA remains tied to each user. The business still gets one shared email address without one shared password floating around the office.
This is usually worth cleaning up
Shared logins are rarely the biggest cyber risk in a business, but they are a good example of a small shortcut that gets harder to manage as the team grows.
If you are reviewing Microsoft 365 or the wider cybersecurity setup, shared accounts are worth checking alongside old user accounts, MFA coverage and excessive permissions. Our small-business cybersecurity guide covers the broader priorities.
The goal is simple: share the resource, not the identity.