In this guide · 7 sections
Short answer
Let clients own every account and give your agency partner or user access: Meta partner access, Google Ads manager links, Shopify collaborator accounts and named website logins. Keep remaining shared logins in a vault per client, and remove access the day anyone leaves.
Platform by platform: how to get proper access
| Platform | Right way for an agency | Source |
|---|---|---|
| Facebook and Instagram, Meta ads | Client shares Pages and ad accounts with your business portfolio as a partner | Meta Business Help Center |
| Google Ads | Link the client's account to your manager account by request | Google Ads Help |
| Google Analytics and Search Console | Client adds your staff as users with the role needed | Google help |
| Google Business Profile | Client stays primary owner; agency staff as managers | Google Business Profile Help |
| Shopify | Collaborator account requested with the store's request code | Shopify Help Center |
| WordPress and other CMSs | Named user per staff member with the lowest role that works | Your CMS settings |
Meta: partner access, not a staff login
Meta's help page on giving a partner access to business assets explains that someone with full control of the client's business portfolio can share Pages or ad accounts with the agency's portfolio, with either full control or partial access for specific tasks such as creating content or managing ads. Even with full control, a partner cannot share the asset onwards; only the owning business can. Ask clients to create ad accounts in their own portfolio and share them, so the account and its history stay with the client.
Google Ads: manager account links
Google's help on linking accounts to a manager account shows the flow: from your manager account you send a link request using the client's customer ID, and the client accepts it in their own account under Managers. Either side can unlink later.
Shopify: collaborator accounts
Shopify's collaborator accounts are for Shopify Partners. The store owner gives you a request code, you submit the request, and the owner chooses your permissions. Collaborator access expires automatically after 90 days without a login, and store ownership cannot be transferred to a collaborator.
When agency staff leave
A staff departure in an agency touches many clients at once. Run it as one checklist on the last day:
Disable their agency email and SSO first
If client access is through your Meta portfolio, Google manager account and agency Google identity, disabling the person's agency account cuts most access in one move.
Remove them from your Meta portfolio and manager accounts
Remove the person from your business portfolio and Google Ads manager account so client assets are no longer reachable through them.
Remove named CMS and Shopify logins
Any WordPress user or Shopify collaborator created for that person on client sites must be removed client by client.
Remove vault access and rotate what they saw
Take them out of client vaults, then change the passwords of any shared credentials they could see.
Record it
Keep a dated note of what was removed for each client, which also answers clients who ask.
Our employee offboarding IT checklist covers the agency's own accounts and devices.
Clean client handover checklist
When a client relationship ends, a professional handover protects your reputation and avoids disputes. Clients will judge you on this more than on the last campaign.
Client handover
From the client's side, our website ownership check shows what they should verify, and our guide to getting access back from an agency shows what happens when handovers go wrong.
Do it yourself or get help?
Moving clients onto partner access is mostly admin: ask each client to share assets with your portfolio and manager account, then remove the old shared logins. Plan a few weeks for a large client list.
If you want it done in one go, our Password Manager Rollout (S$290) sets up Bitwarden or 1Password with vaults per client and onboards up to 10 staff. The Access Review & Leaver Tool (from S$1,200) lists who has access to what across your agency's Microsoft 365 or Google and other apps, with a one-click leaver checklist. For the agency's own email and admin accounts, our Microsoft 365 / Google Security Lockdown is S$590.
Frequently asked questions
No. The safer setup is for the client to create the ad account in its own Meta business portfolio and share it with the agency as a partner, with full control or partial access. The client then keeps the account, its history and its audiences if the relationship ends, and removing the agency is one step.
Avoid it where the platform supports named users or partner access. For the rest, use a business password manager with a separate vault for each client, give access only to staff on that account, and keep 2FA codes in the vault rather than on one phone. Never share passwords in chat, email or spreadsheets.
The store owner can remove your collaborator account at any time. Shopify also expires collaborator access automatically if it has not been used to log in for 90 days, though the owner can reactivate it. Ownership of the store can never be transferred to a collaborator.
Disable their agency email and single sign-on first, remove them from your Meta business portfolio and Google Ads manager account, delete any named logins on client websites and stores, remove their password-vault access and change any shared credentials they saw. Keep a dated record per client.
Usually the agency processes that data on the client's behalf, which makes it a data intermediary with duties to protect the data and to delete or return it when no longer needed. The client remains responsible overall. Check your contract for data handling clauses and get advice for specific situations.