What access do you need to my ad account and page, and is it safe?

Access, not ownership

Five of the 67 sales calls in my backlog asked this, and it never sounds like a technical question. It sounds like "that would just be your email for partner access?", "do they need to approve anything now?" and, on one call, "how quickly could they get into all of our stuff?" Getting burned by an agency came up on 21 of those 67 calls, so handing a stranger the login is the last thing these owners want to do. Good. Don't.

Meta gives you two ways to let someone work in your account. You can add a person, by email, inside your own business. Or you can share specific assets with another business, which Meta calls partner access. I use the second. Your business stays the owner of the ad account, the page and the pixel. Mine gets permission to work in them. Nothing is transferred, and you can end it without asking me.

What I check before any ad

When an account lands on my desk, I don't open Ads Manager first. I open the security settings and the list of people. Who has admin on the page, and do they still work there? Is two-factor authentication on for each of them? On the last account audit I ran, that came before anything about creative or audiences, and it became step one of the plan: two-factor on every login, with an authenticator app rather than a text message.

The reason is simple. The ad account has a card attached and the page is the public face of the clinic. Partner access is only as safe as the weakest login that can reach those two things. A former employee who is still a page admin, or a shared login with no second step, is a bigger risk than any partner you add on purpose.

What I ask for, and what I don't

• The ad account. Enough to build, launch and pause campaigns and read the results. The payment method stays yours, and ad spend goes straight from your card to Meta.
• The Facebook page, and the Instagram account connected to it. Enough to run ads from it and see the leads and messages those ads produce.
• The pixel, which Meta now calls a dataset. This is the tracking. Without it I can't see whether a lead became a booking, or fix it when it didn't.

What I don't ask for: your Facebook password, your personal profile, or ownership of anything. If someone wants you to share a login so they can "just get in quick," that's the moment to slow down.

How you grant it

You do it from your own Business settings, under Partners. I send you a business ID, which is a number, not an email address. You enter it, pick the ad account, the page and the dataset, and choose the level for each one. When you add the partner yourself, there is nothing left for anyone to approve. If a partner sends the request instead, it waits for you, and you should read exactly what it asks for before you say yes.

If you can't find a Partners screen at all, the ad account or the page probably lives under a personal profile and not a business. That's worth fixing anyway, and we sort it out together on a call.

Two-factor goes on every login

One owner asked, "do I enable 2FA on all four accounts?" Two-factor lives on a person's login, so every person who can reach the business turns it on for their own profile. Meta also lets the business require it, so nobody gets in without it. Use an authenticator app. A text-message code is better than nothing, but a phone number can be taken over, and an app on the phone in your hand can't be redirected the same way.

That also answers "how quickly could they get into all of our stuff?" With a password and no second step, about as fast as they can type. With an authenticator app, the password alone gets them nowhere.

What about the AI?

The AI roles I install connect the same way I do: through permissions you grant and can pull. I scope them to marketing. They reach the ad account and the marketing side of the CRM, not patient records, and patient information is stripped out before anything reaches a model. The HIPAA page covers that part. They also work inside limits you set before launch: a maximum cost per lead, rules for when to pause, and a notification on your phone each time something runs. Control comes from those guardrails, not from watching the account all day.

Taking it back

Same screen. Remove the partner and the access ends. Do it whenever an engagement ends, with me or with anyone else, and read down the list of people while you're there. You own the accounts either way. If Meta has already flagged your account as healthcare, this access check is the first step of that fix too. If you'd like to walk through it together, book a call and have your Business settings open.