Ask an IT department if they allow shared accounts, and you'll probably hear:
"No. Everyone has their own account."
Fair enough. But let me ask a different question.
Who has access to your root account?
What about your local Administrator account? Your emergency break-glass account? That service account created five years ago?
Still confident you don't have shared accounts?
Most organizations have shared, privileged, or non-personal accounts. The concern isn't necessarily their existence. It's whether we've established expectations around their use.
A shared account isn't automatically a security failure. An unmanaged shared account is a security risk.
Consider a few questions:
🔹 Ownership: Who is responsible for the account?
🔹 Purpose: Why does it exist? Is the justification documented?
🔹 Access: Who is authorized to use it?
🔹 Authentication: Is MFA enforced where supported? Are credentials secured?
🔹 Accountability: Can we identify who used it and what they did?
🔹 Expiration: Is access time-limited?
🔹 Review: When was the account last evaluated?
That last one deserves attention.
Should shared accounts be time-limited?
My perspective is that access should be time-limited whenever practical, even when the account must exist indefinitely.
A root account might exist for the lifetime of a system. That doesn't mean five administrators need permanent access.
A break-glass account must remain available for emergencies. That doesn't mean its use should go unnoticed.
A service account might support an integration for years. That doesn't excuse unnecessary privileges or missing ownership.
And here's an important distinction.
Not every privileged account is a shared account.
Root, Administrator, and service accounts can be privileged or non-personal identities. Whether they're shared depends on how access is managed.
But all deserve governance.
As IT leaders, we establish password policies, MFA, conditional access, and identity lifecycle processes for individual users.
Yet some of our most powerful accounts can exist outside those everyday controls.
That's a governance gap worth examining.
A shared account policy shouldn't simply say "shared accounts are prohibited."
It should define justified exceptions, approval, access controls, accountability, and periodic reviews.
Because the objective isn't to pretend shared accounts don't exist.
It's to ensure no account exists without ownership, accountability, and oversight.
When was the last time your organization reviewed its shared and non-personal accounts, including those used by IT?