Cyber Essentials Shared Accounts: Are Shared User Accounts Allowed?
Published 10 November 2026
Why individual accounts matter
The user access control requirements are about knowing who has access, giving each person only what they need, and removing access when they leave. A shared login breaks all three: you cannot tell who did what, you cannot remove one person without changing the password for everyone, and MFA tied to one phone does not fit several users.
Shared mailbox vs shared login
| Set-up | Typical position |
|---|---|
| Shared mailbox (for example accounts@) that staff open using their own signed-in account | Fine. Access is through individual, MFA-protected accounts. |
| "accounts@" with its own password that the team shares to sign in | A shared login. Convert to a shared mailbox and block direct sign-in. |
| One "reception" Windows login used by everyone at the front desk | A shared login. Move to individual accounts, or a properly locked-down kiosk configuration where appropriate. |
| One login to a supplier portal used by the whole team | If the portal holds organisational data, it is an in-scope cloud service. Ask the supplier for named users and MFA. |
Service and technical accounts
Not every non-personal account is a shared login. Systems often need service accounts to run backups, integrations or scheduled tasks. Do not oversimplify these. Ask:
- Is a human typing in the credentials? If people use it to sign in interactively, treat it as a shared user account and replace it.
- What can it access? Give it only the permissions the task needs, not full admin by default.
- Who owns it? Name an owner responsible for its credentials and review.
- Can interactive sign-in be blocked? If the account never needs to log in like a person, stop it doing so.
Separate admin accounts
People who carry out administrative tasks should have a separate admin account and use it only for admin work. Everyday email and web browsing happen on a standard account. Shared admin accounts, such as a single "admin" login known to the whole IT team, should be replaced with individual named admin accounts. More detail is in our Cyber Essentials access control guide.
Contractors and third-party IT
- Each contractor gets their own account, not a borrowed staff login.
- Managed service providers use named accounts or delegated admin access, with MFA, not a generic "itsupport" login shared across their engineers.
- Accounts have an end date or a review point so they are removed when the work ends.
Practical migration examples
Office manager mailbox: "office@" was a full licensed account with a shared password. Convert it to a shared mailbox, give three staff access through their own accounts, and block sign-in to the original account.
Warehouse PC: one Windows login for all shift staff. Either give each person a login, or configure a locked-down kiosk mode that only runs the warehouse app, with no access to email or files.
IT admin login: a single domain admin account used by two internal staff and the MSP. Create named admin accounts for each person, enforce MFA, then disable the shared one.
Password rules still apply to any account that uses a password. See Cyber Essentials password policy.