Why sharing one login between staff causes problems

It is one of the most common setups we walk into: two or three people all signed in as "office@" or all using the same Windows user, because it was quick to set up and it seemed to work. It does work — right up until it does not. Here is what actually breaks, and the setup that fixes it without losing the convenience.

What actually breaks

Multi-factor authentication stops making sense. MFA assumes one account belongs to one person with one phone. Share the account and MFA becomes either impossible to turn on, or a group chat where people forward codes to whoever is signing in — which defeats the entire point of it, and trains staff to hand codes over on request. That last habit is exactly what scammers rely on.
You cannot tell who did what. When an email goes out that should not have, a file disappears, or money moves, the audit trail says the same name for everyone. That is uncomfortable in an ordinary mistake and genuinely serious in a dispute or an insurance claim.
Leavers become an emergency. When one person who knows the password leaves, the only safe move is changing it — which locks out everyone else at once, usually mid-morning on a busy day. With individual accounts, offboarding is one clean switch — see the offboarding checklist.
Settings fight each other. Email signatures, inbox rules, read/unread status and calendar entries all belong to the account, not the person. Two people in one mailbox mark each other's mail as read, overwrite each other's signatures, and quietly file things where the other one cannot find them.
It is usually against the licence terms anyway. Microsoft's business licences are per person, not per seat at a desk — see who counts as a user.

The right shape

Everyone gets their own login, and the shared thing becomes a shared mailbox — a mailbox like accounts@ or office@ that has no password of its own, which each person's individual account is given permission to open. Everyone sees the same mail, replies come from the shared address, and when someone leaves you remove their access without touching anyone else. Setting one up is quick, and sharing a mailbox or calendar covers how it works day to day. If this is your current setup, do not try to untangle it yourself in one afternoon — tell us who currently uses the shared account and what for, and we will plan the switch so nobody loses mail or access mid-week.

Two things not to do. Do not share an existing password to get a new starter going "just for now" — temporary shared access never gets unwound, and in a month it is simply how things work. And do not run the business banking from a login several people know. Banking access should be tied to named individuals, each with their own credentials and their own MFA, full stop.

Why this happens

Shared logins are not a character flaw — they are what happens when a business grows faster than its IT. One account was cheap and easy on day one, and every day since, changing it has looked like hassle for no visible gain. The gain shows up on the bad days: the day someone leaves on poor terms, the day a scam email goes out, the day the insurer asks who had access. The fix is straightforward, keeps everything people actually liked about the shared setup, and costs far less attention than the first bad day will.

Still stuck?

Log a ticket at portal.yougrowit.com.au or email support@yougrowit.com.au. If it is stopping you working right now, call 03 9028 4358.

Support hours are Monday to Friday, 8:30am to 5:30pm Melbourne time, excluding Victorian public holidays.

Not a client yet?

This help centre is free to read and we would rather you fixed it yourself. If it has not worked, or you would rather someone just dealt with it:

The first call is free. Tell us what’s happening and we’ll tell you what we think it is, what fixing it involves, and what it’ll cost — before anything is charged. If it turns out to be a five-minute thing, we’ll usually just sort it out on the call.