Give an Agency Access to Meta Business Portfolio Without a Password

How do you give an agency access to Meta Business Portfolio?

To give an agency access to Meta Business Portfolio means adding the agency as a partner and sharing only the assets it needs with partial access, instead of handing over a password. In Meta Business Suite, you open Settings, choose Partners, enter the agency's business portfolio ID, pick the assets, and click Assign assets.

The six steps below cover the fast fix for most businesses. Then the later sections explain each step in detail.

1. Confirm that you have full control of the business portfolio. If you cannot see the Partners option, your permission level may be too low.
2. Ask the agency for its own business portfolio ID. If the agency has no portfolio yet, it must create one first.
3. Open Settings in Meta Business Suite. Under Users, click Partners, then click Add.
4. Choose "Give a partner access to your assets." Enter the ID and click Next.
5. Select the Page, the Instagram account, and the ad account you want to share. If you choose partial access, switch on only the tasks the agency needs.
6. Click Assign assets. Another person with full control may need to approve the request.

Meta changes its interface often, so check the menu names against the help page. The current steps live on the Meta Business Help Center page about partner access. Also note that many older guides still call the business portfolio by its former name, Business Manager. Both names describe the same tool.

In practice, the logic is simple. A partner agency also works from its own Meta account and its own portfolio. Therefore it never needs your password, your verification code, or your phone. Better still, you close the access with a single removal when the relationship ends.

Why is sharing a password with an agency never the right way?

A shared password ties access to a person, not to your business. So when someone on the agency team leaves, that person still knows the password. In addition, you cannot tell who logged in or when.

Two-factor authentication breaks this model as well. With the feature on, Meta asks for a verification code when someone logs in from a device it does not recognize. The code reaches your phone, so the agency has to call you at every login. That slows the work down and often blocks it.

Passwords that travel through several channels also carry a leak risk. Moreover, a leaked password can lead to a hijacked account. If that already happened to you, read our guide on how to recover a hacked Instagram account. Instead, the right path is role-based and partner access. The agency works with its own login, and you take the permission back whenever you choose.

What do business portfolio, asset, and ownership mean?

A business portfolio, formerly called Business Manager, brings your Pages, Instagram accounts, ad accounts, and other business assets into one place. It also controls who can reach each asset and with which permissions.

• Asset: every item you manage, such as a Facebook Page, an Instagram account, or an ad account.
• Ownership: when you add a Page to your portfolio, your business owns that Page.
• Access: what other people can do with an asset. It stays separate from ownership, and you can take it back at any time.

This distinction matters most when you work with an agency, because you grant access but you do not hand over ownership. As long as your business holds ownership, your content archive, your followers, and your ad history stay yours, so the risk of losing them drops sharply.

Specifically, Meta defines two access levels: full control and partial access. Also, both levels apply to the portfolio itself and to the assets inside it. You can read the exact definitions on the Meta page about portfolio and asset permissions. Note that newer help pages sometimes say "full access" for the same level.

In addition, three permission levels exist for people inside a portfolio. Full control matches the old admin role. Basic access matches the old employee role, and Meta assigns it by default to every new person. Apps and integrations access matches the old developer role. So knowing these names helps you match old guides to the new interface.

What should you prepare before you give an agency access to Meta Business Portfolio?

Missing preparation causes most access problems. Therefore answer the questions below before you add the agency.

• Do you hold full control of the portfolio? If the menu shows no Partners or People entry, you may lack it.
• Do your Page, Instagram account, and ad account already sit in your own portfolio?
• Is two-factor authentication switched on for your own Facebook account?
• Does the agency have its own business portfolio and a portfolio ID ready?
• Did you write down which tasks the agency will do? For example content, message replies, ads, or reporting.
• Does another person besides you hold full control of the portfolio?

Above all, do not skip the last point. Meta's Security Center recommends more than one person with full control, because someone else can keep running things if one person leaves. See the Security Center help page for the details.

Should you add the agency as a partner or add people one by one?

First, Meta offers two separate paths. Partner access connects another business, such as an agency, to your portfolio. Adding people invites individuals one by one through their Facebook accounts. The two actions are different.

However, agency teams change over time. For that reason, partner access is usually the more durable choice. Also, the agency manages task assignment for its own team inside its own portfolio. In practice, you close all access by removing one partner record.

As the table shows, password sharing is the weakest option for both security and continuity. Partner access, on the other hand, lets you limit permissions task by task.

How does the process work when the agency requests access itself?

The agency can also start the process. For this, it uses the request flow in its own portfolio and also asks for your portfolio ID and your email address. You can find the ID in the business portfolio info inside Settings and send it over.

When the request reaches you, you have three options: approve it, deny it, or change which assets and permissions you share. However, you do not have to accept the request as written. For example, if the agency asks for ad account and payment permissions, you can grant only Page content tasks.

The side that sent the request follows its status in the Partners tab of its own Settings. Therefore check your notifications and your email. Then, after you grant access, the shared assets show up in the Settings of both portfolios.

Should you give a partner partial access or full control?

In practice, partial access is enough for most agencies. It allows specific tasks, such as creating content, managing ads, and replying to messages. Full control, on the other hand, lets the partner manage everything on the asset.

Even a partner with full control cannot share the asset with another business. Only the organization that owns the asset can do that. Still, full control brings broad powers, so choose it only when you truly need it.

With partial access, the agency can give its own people only the tasks you assigned to the agency. So the chain of permission stays inside the limit you drew. Who does what inside the agency remains the agency's responsibility. Still, write down which tasks you opened.

How do you apply the least privilege principle in practice?

The least privilege principle means giving everyone only the permission that the job needs. Meta gives the same advice in its help pages: assign only the level of access that people need to complete their work.

Example scenario: a local furniture store gives its agency Page content and message reply tasks. The store opens the ad account as a separate task, only during campaign periods. Meanwhile, the agency team has no reason to touch payment methods.

• Content agency: content creation and message replies for the Page and Instagram.
• Ads agency: ad management tasks in the ad account; remove the access when the work ends.
• Reporting support: permission to view insights only.
• Finance access: never give it to anyone who does not need invoice and payment details.

Also, apps and integrations access is a separate matter. It covers setting up the Conversions API, monitoring events, and creating access tokens. If the agency does not need these jobs, do not grant it. Meta also keeps finance access as an advanced option. Therefore never treat it as part of a default bundle. As the work grows, you add permissions; as it shrinks, you remove them.

How does the access model change for a freelancer?

First, a freelancer often has no business portfolio of their own. In that case the simplest path is to invite the person through their Facebook account. The person works with their own login, and you decide which assets they can touch.

If the freelancer does have a portfolio, you can use partner access instead. Then the freelancer can distribute tasks to a helper from their own portfolio. That flexibility helps, but control must stay with you. So pick partial access and limit the tasks one by one.

Example scenario: a small boutique hires a freelancer only to prepare photos and posts. The boutique gives the person the content creation task. Meanwhile, message replies and ad management stay closed. If the work grows, the boutique adds tasks later.

When does it make sense to add an agency team member as a person?

Adding a person makes sense when you work with a freelancer or one specialist, because a single login is easy to track. In Settings, you open People and click Invite people. You type the email address of the person's Facebook account, and it must match that account.

1. Enter the email address and click Next.
2. Select the business portfolio permissions for the person and click Next.
3. Choose the assets and permissions, then click Invite.

Then the person has to accept the invitation. Meta assigns basic access by default, and portfolio permissions override all other permissions. Moreover, people with full control of the portfolio can see the name, work email, and assigned assets of each new person.

A temporary access option exists for short projects; check the time limits on the help page. For the exact steps, read the Meta page about adding people to a business portfolio.

How do you give an agency access to an Instagram account?

The right way to open an Instagram account to an agency is to connect it to your business portfolio first. To assign an Instagram account to someone, you must be logged in to that account. Therefore open Settings, choose Instagram accounts, select the account, and log in.

After that, you assign the account to the agency as a partner or to a person. If the account does not connect to your Facebook Page, follow our guide on fixing Instagram not connecting to a Facebook Page. Also, collab invites are a different topic from agency access. If a collab invite does not show up, read about an Instagram collab invite not showing.

Build these connections inside your own portfolio. A connection built inside the agency's portfolio creates extra work for you when the relationship ends. Therefore, setting it up correctly from the start is the cheapest fix.

If an Instagram account stays outside your portfolio, you can still manage its shared access on the Instagram side. However, you then have two places to check on the day the agency leaves. Managing permissions in two places also raises the risk of mistakes. So connect the account to the portfolio whenever you can.

Why does keeping ownership with your business matter so much?

When you add a Page to your portfolio, your business owns it. If another person or business owns a Page, the owner must first remove it from their portfolio, or you can request access instead. Consequently, if the agency opened the Page inside its own portfolio, the agency holds the control.

The first question to ask is simple: which portfolio holds this Page? If the answer is the agency's portfolio, the agency owns it. That causes trouble when the relationship ends, because the owner decides what happens to the Page. If you already lost access, read our guide on recovering a Page after losing access to a Meta business account.

In addition, the same logic applies to ad accounts and catalogs. According to Meta, only the organization that owns an asset can share it with another business portfolio. Business-level setups, such as domain verification, belong in your portfolio too. Our guide on how to verify your domain in Meta Business covers that setup.

Finally, one more detail matters. People who had access to a Page before you added it to a portfolio keep their access afterward. So clean up former admins and former agency contacts separately.

Why does two-factor authentication matter for agency access?

Meta asks you to switch on two-factor authentication for your portfolio before you add a partner. You can also require it for everyone who reaches the portfolio. That way, even if an account on the agency team falls into the wrong hands, a password alone does not open the door.

1. Open Settings in Meta Business Suite.
2. Then select Business portfolio info and scroll to Business options.
3. Open the dropdown next to Two-factor authentication.
4. Choose Admins only, Everyone, or No one, and confirm.

For agency access, we therefore recommend the Everyone option. Meta requires the setting automatically for some portfolios, and in that case you cannot turn it off. People who have not set it up yet must finish the setup at their next login. If you use a third-party scheduling app, it asks for a verification code at the first login too.

Device recognition also matters. If you browse in a private window, or your browser clears history on close, Meta cannot remember the device and asks for a code every time. For a strong, unique password on your own account, try our password generator. For setup details, read the Meta page on requiring two-factor authentication.

Why does it fail when you give an agency access to Meta Business Portfolio?

First, work through the causes from most likely to least likely. In our field experience, the first three are the most common ones.

1. The menu shows no Partners or People entry. You may lack full control. Ask someone who holds full control to do the step.
2. The agency ID is missing or wrong. Adding a partner requires the agency's business portfolio ID, so a personal profile ID will not work.
3. The asset does not sit in your portfolio. If the Page or account lives in another portfolio, that portfolio's owner controls sharing.
4. An approval is pending. Another person with full control may need to approve the step. That request waits in the Requests section of Settings.
5. The person did not accept, or the email does not match. The email must match the one on the person's Facebook account. After acceptance, all features can take a few days to open.
6. One of the accounts is restricted. If your account or the invitee's account is disabled or restricted, you cannot add the person.
7. You have not confirmed your email address. The Business info section may then show a confirmation request; follow the on-screen instructions.
8. You are logged out of Instagram. Log in under Instagram accounts before you assign the account.

If none of these fits, open the troubleshooting section of the help page. However, do not rush. Repeating the same step again and again rarely adds new information. First verify your permission level, then check which portfolio holds the asset.

Which symptom points to which problem?

The table below maps common symptoms to a cause and a fix. As a result, you can quickly find the step worth repeating.

If your symptom is missing, read the troubleshooting section on the matching help page. Managed Meta account rules in larger organizations can also affect invitations.

Why should your portfolio have more than one admin?

First, a single full control holder is a single point of failure. If that person leaves, loses a phone, or gets restricted, nobody can manage the portfolio. For that reason, Meta's Security Center recommends several people with full control.

Also, the same principle holds for Facebook Pages. Meta recommends adding more than one admin to a Page. Then, if you lose access, someone you trust can help you get back in. A backup admin works like insurance, and you notice it only when something goes wrong.

Pick the backup admin with three criteria in mind. The person should work inside your business, should have two-factor authentication on, and should have no tie to the agency. In a dispute with the agency, that person then becomes your safety net.

How do you check that the access works after you grant it?

Run a short verification round after you grant access. First check that the shared assets appear in the Settings of both portfolios. The same Page, Instagram account, and ad account should appear on both sides.

1. First, ask the agency to confirm that it sees the Page, the Instagram account, and the ad account in its own portfolio.
2. Then try each task the agency will perform. For example, draft a post, open the message inbox, and view the ad account.
3. Also check that tasks the agency should not perform stay closed. For example, test whether it can reach payment settings.
4. Finally, write down the result with a date and the scope.

Specifically, this test catches permissions that are too wide or too narrow early. A missing permission slows the work, while an excess permission raises the risk. Therefore review the setup once more at the end of the first week.

How do you take access back when the agency relationship ends?

First, if you added a partner, one record closes all agency access. Second, if you added people, you remove each person separately. The two actions differ, so check both.

1. Open Settings in Meta Business Suite and select Partners.
2. Then click Options at the top right and select Remove from business portfolio.
3. Finally, click Remove partner to finish.

You can read the details on the Meta page about removing partners. To remove a person, open People in Settings, click the person's name, select Remove, and confirm. Also, removal revokes the person's access to the portfolio and to every assigned asset.

To close access to a single asset, open the person's page and click Manage next to that asset. There you can change the permissions or select Remove access. If another person with full control must approve the change, the request waits in the Requests section.

Next, ask the agency for written confirmation. Then test for yourself that the agency team can no longer reach your Page, Instagram account, and ad account. That way you spot a forgotten permission right away.

What belongs on an offboarding checklist?

Removing access is not a one click job, because access can sit in several places. The list below collects the items you tick off on the day the agency leaves.

• Remove the partner record.
• Also remove agency employees you added as people.
• Check direct Facebook Page access and shared access on Instagram outside the portfolio.
• Review the people in the ad account inside Ads Manager.
• Then check the connections of third-party scheduling and reporting apps.
• Review people with finance access and your payment methods.
• Confirm that two-factor authentication still applies to Everyone.
• Finally, archive a written note with the date and the scope of the offboarding.

Also, record every access change with a date and a name. That way you have a ready list at the next agency change. The record also helps with internal audits and handovers inside your own team.

What should you write into the agency contract about access?

In practice, a written frame matters as much as the technical permissions. Put the topics below into the contract or a working note. This is not legal advice; ask your legal counsel for binding wording.

• Who owns the accounts and assets? Ownership should stay with your business.
• Which tasks can the agency reach, and which can it not reach?
• That nobody shares passwords and that you grant access through a partner record.
• How quickly you will remove access when the work ends.
• Which people work on the account and how the agency announces team changes.
• In which format the agency delivers content and creative files.

These points clear up the relationship from the start. Moreover, nobody has to guess on the day the work ends, because the plan already exists in writing.

Do LinkedIn and Google Ads carry the same access risk?

Yes, the same structure also applies on other platforms. If the only admin of a LinkedIn Page leaves the company and nobody else holds admin rights, you lose access. For the fix, read our guide on how to regain access when a LinkedIn Page admin left.

In Google Ads, you also grant an agency access through the platform's own access method instead of a password. Our article on how to give an agency access to Google Ads explains it. The shared principle stays the same: tie access to the business, not to a person, keep several admins, and grant permission task by task.

What should you do when someone offers to recover your Page for money?

Decline and do not give any access. Meta's help pages advise you to deny access requests from people you do not know, because scammers create fake accounts to trick businesses.

• A request that claims to come from Facebook is not legitimate, because Facebook never asks for access to your Page.
• Third parties who promise to get you verified are scammers. Business verification does not require Page access.
• Do not work with strangers who sell "account recovery" for money. Nobody can guarantee a recovery.
• Do not try to get around the system with a new account, forged documents, or someone else's login. Meta treats these as circumvention, and they make the situation worse.

If you face a real reputation crisis, read our guide on how to handle a social media crisis. If you receive a suspicious request, use Meta's reporting option. Add only people you know, and only under a clear agreement, to manage your Page.

How does access setup work for social media management?

We, Talha Aslan and team, prefer to connect to a client's portfolio as a partner, leave ownership with the business, and take permission task by task. We never ask for passwords, and if anyone else does, do not hand them over.

During setup, we first map which asset sits in which portfolio. Then we agree on the required tasks with you, check two-factor authentication, and write the offboarding scenario at the start. If you want to discuss the scope, request a quote for social media management.