What is Facebook agency access? (And why a manager never needs your password)

What is Facebook agency access?

It's the permission system Meta built so more than one person can work on a Page. Each person signs in with their own Facebook account and gets only the access you grant. You stay the owner, and you can see who has access and take it away.

There are two ways to set it up, and agencies use both:

• Page access. You add a person straight from your Page's settings. Good for one manager working on one Page.
• Partner access in Meta Business Suite. Your Page sits in a business portfolio (the thing Meta used to call Business Manager), and you share it with the agency's own portfolio. The agency then decides which of its staff work on it, inside the limits you set.

Meta renames these menus often. "Business Manager" became "business portfolio", and "Page roles" became "Page access" in the newer Pages experience. If a step below doesn't match your screen, the feature is usually still there under a nearby name.

What's the difference between Facebook access and task access?

In the newer Pages experience, Facebook splits Page access into two types.

Facebook's own help page is blunt about full control: it gives someone the same access as you. Keep full control for yourself and anyone you'd trust with the Page outright. A manager doing the day-to-day work doesn't need it.

How do I give a manager access to my Facebook Page?

Pick one of these routes. You need full control of the Page, or of the business portfolio it sits in, to do either.

From the Page itself (newer Pages experience):

1. Switch into your Page and open Manage, then Page access.
2. Next to People with Facebook access, or People with task access, click Add new.
3. Search for the person, choose what they can do, and confirm.
4. They get an invitation and have to accept it before the access starts.

Through Meta Business Suite, as a partner:

1. Ask the agency for its business portfolio ID.
2. In Meta Business Suite, open Settings, then Partners (under Users), then Add, and choose to give a partner access to your assets.
3. Paste in their ID, pick the Page (and any linked accounts), and choose full control or partial access.

Meta's guide for partner sharing says to turn on two-factor authentication for your portfolio first, and that if you can't see Partners you probably don't have full control of the portfolio.

Often the agency starts it instead. They request access to your Page from their own Meta Business Suite, choosing full or partial access, and the request goes to whoever has full control of the Page or its portfolio. Nothing happens until you approve it. Meta describes this as asking to do tasks on the Page, not taking ownership of it.

What can a partner do with my Page, and what can't they?

It depends on the level you choose. Meta's partner help page describes partial access as covering specific tasks, such as creating content, managing ads and responding to messages. With full control a partner can manage everything, but Meta says they still can't share your Page on to another business.

What a partner never gets, at any level:

• Your password, or the login to your personal Facebook account.
• Your two-factor codes. Those stay on your phone.
• Ownership of the Page. It stays in your name and your portfolio.
• Access that lasts after you remove it.

Our rule is to grant the lowest level that covers the job. If someone is only scheduling posts and reading insights, task access or partial access is enough.

How do I see who has access and remove someone?

Check this every few months, and every time you stop working with someone.

• On the Page: open Manage, then Page access. You'll see People with Facebook access and People with task access. Click the three dots next to a person and choose Remove from Page. Facebook emails them to say their access has gone.
• In Meta Business Suite: open Settings, then Pages, select the Page and review the people and partners listed against it. Remove anyone you don't recognise or no longer work with.

A few limits Facebook builds in: a Page must always keep at least one person with full control, so add someone else before removing yourself. Removing another full-control admin can need their approval, and a new admin may have to wait 7 days before removing an existing one. These are there to stop a hijacker throwing you off your own Page.

Do I need two-factor authentication?

Yes, turn it on. Two-factor authentication means anyone logging in to your account from a new device needs a code as well as your password. On Facebook it's under Settings, then Accounts Centre, then Password and security, then Two-factor authentication. You can use an authentication app, a security key or text message codes.

Meta also lets portfolio admins make two-factor authentication compulsory for everyone in a business portfolio. If your Page sits in one, switch that on too, so a manager's weak login can't become your problem.

Why shouldn't I just share my password?

Because Meta's rules say not to, and because it hands over more than any manager needs.

• It breaks Meta's terms. The Meta Terms of Service say you must "not share your password, give access to your Facebook account to others, or transfer your account to anyone else" without Meta's permission.
• It gives away your whole account, not one Page. Your password opens your personal profile, your messages, your payout details and every Page you run.
• It fights your two-factor authentication. A login from someone else's device asks for your code, so you either keep sending codes or switch protection off. Both leave the account easier to steal.
• You can't see what they did or take it back cleanly. With agency access each person works under their own name and you can remove them in a click. With a shared password you have to change it, and hope nothing else was changed first.

If a manager tells you agency access "doesn't work" for what they do, ask them which task needs your login. We haven't found one.

How do I spot a fake manager or a fake Meta message?

Login scams aimed at creators come in two disguises: a manager or brand who needs your details to "set things up", and a message from "Meta" saying your Page will be disabled unless you act now.

• Anyone asking for your password or a login code. Meta says its representatives will never ask for your password over chat, text, email or phone.
• A deadline threat. Meta warns that phishing messages often say your account will be banned or deleted if you don't follow their instructions.
• A lookalike sender. Meta says its email comes from a short list of domains, including facebook.com, facebookmail.com and metamail.com, and that scammers use misspelled versions.
• A link to "verify" or "appeal". Don't click it. Check your account status inside Facebook or Meta Business Suite instead, where real notices appear.
• A request for money or payout details in Messenger. Meta says it never asks for money over chat or email.

If you've already typed your password into a page you don't trust, reset it, log out of devices you don't recognise and check who has access to your Pages. Meta takes reports of phishing emails at phish@fb.com.

How does this work on Instagram and TikTok?

• Instagram through Meta Business Suite. If your Instagram professional account is connected to Meta Business Suite, it can be shared with a manager through the same settings as your Facebook Page.
• Instagram shared access. Instagram also has its own shared access for eligible accounts: you invite someone from the app (Menu, then Shared access) and they can post, like and comment without your password. You can manage and remove their access at any time. Invites are sent and accepted in the app, not on instagram.com.
• TikTok Business Center. A manager's Business Center can ask to link your TikTok account by sending you a QR code. You scan it in the TikTok app and approve the permissions. No password changes hands, and sharing your account on to their partners needs a separate permission you have to grant.

These screens change even more often than Facebook's. The principle doesn't: you approve access from your own app, and you can take it back.

How we do it at TBC

TBC Creator Network is the management division of TBC Viral Media. We manage creators with 1,000 to 1,000,000 followers across Facebook, Instagram, TikTok and YouTube, and Mel manages every creator on the roster.

• We never need your passwords. Not at sign-up, not later.
• We work through official agency access on Facebook and Instagram. You approve it, and you can remove it at any time.
• Posts are scheduled through SocialPilot, and you can flag any post before it goes out.
• Your content and your accounts stay yours, always.
• If you leave, pages and channels we built for you are handed over once final payments clear.

The agreement summary sets this out in plain words, including what happens if you leave.

Questions creators ask