Agency multi-account security: how to manage 50+ client ad and seller accounts without shared logins or cross-client risk

An agency that manages dozens of client accounts carries their risk. One leaked password, one ex-employee who still has access, or one compromised laptop can expose every client at once. Platforms also notice when one person logs into many unrelated businesses with the same credentials. The fix isn't hiding that activity. It's structuring it the way the platforms intend, so every access is attributable, limited and revocable.

Principle 1: use platform delegation, not client passwords

Every major platform has a way for an agency to work in a client's account with its own identity. Use it everywhere it exists.

If a client insists on handing over their own password, note the risk in writing and move them to delegated access during onboarding.

Principle 2: one person, one identity, least privilege

• Every staff member and contractor gets their own named login on each platform. No shared "agency@" accounts.
• Assign the lowest role that does the job: analysts get read-only, media buyers get advertiser access, only leads get admin.
• 2FA on everything, with authenticator apps or hardware security keys. Agency-wide accounts (MCC, Partner org, Business Manager) should require security keys for admins.
• Keep a single access register per client: who has what, on which platform, approved by whom.

Principle 3: isolate client sessions

Even with delegated access, working on 50 clients in one browser causes real problems: the wrong pixel installed on the wrong store, an ad launched in the wrong account, cookies from one client's tools leaking into another's. Isolate them:

• A separate browser profile per client. For a small team, Chrome profiles are enough. For larger teams, a multi-profile team browser such as AdsPower or Multilogin lets you create a profile group per client, share it with specific staff, revoke it centrally and log who opened what. Comparison: AdsPower vs Multilogin vs GoLogin.
• Only that client's extensions and bookmarks in each profile, and no personal browsing.
• Name profiles clearly (client name, platform, region), so nobody launches the wrong one at 11 p.m.

Principle 4: known, consistent network locations

Logins from changing, unfamiliar locations trigger security checks and are a sign of account takeover. Give the team predictable egress:

• Remote staff connect through the agency's business VPN or a dedicated static IP, not consumer VPN servers shared with strangers.
• Where a client wants their account accessed from their own country, a dedicated static ISP IP in that country assigned to that client's profile keeps logins consistent. Providers like Proxy-Seller rent dedicated IPs by the month. Document the IP in the access register so the client's security team recognizes it.
• Where platforms support it, add IP allow-listing or login alerts for the agency's addresses.

Principle 5: onboarding and offboarding as a checklist

Client onboarding

1. Send delegation requests (Meta partner, MCC link, Shopify collaborator, Amazon user invite).
2. Create the client's browser profile group and assign staff.
3. Record every access in the register, with the client's approval.
4. Agree in the contract who owns ad accounts, pixels, data and creative. The client should own them.

Staff offboarding (same day)

1. Remove the person from the MCC, Business Manager, Partner org and the team browser. That removes most client access at once.
2. Remove any direct user access listed in the register.
3. Rotate any shared secret they could have seen (API keys, shared vault items).
4. Review recent activity logs for unusual changes.

Client offboarding

1. Remove your partner access yourself. Don't leave dormant access.
2. Delete the client's browser profiles and stored sessions.
3. Hand over documentation and confirm in writing that access was removed.

Containing a problem client

If one client violates platform policy, delegated access limits the blast radius. The client's own assets are affected, and your agency identity isn't the asset under review. You can reduce risk further:

• Refuse or offboard clients in prohibited or high-risk categories. Your agency Business Manager and MCC reputation is shared across all clients.
• Don't create new ad accounts for a client whose previous account was disabled. Platforms treat that as circumventing enforcement, and it can put your agency accounts at risk.
• Keep written policy reviews for sensitive categories (health, finance, supplements).