Organising Shared Credentials

Name logins by function, not by guesswork

One of the easiest ways to reduce confusion is to name shared credentials by job function, not by the person who first created them. A login called “marketing1” tells you very little. A login called “social-media-admin” is clearer and easier to manage when the team changes.

Use names that describe what the account does and where it sits in the business. If several people use different portals for the same department, keep the naming pattern the same. That way staff in Gqeberha, Durban, or remote teams inland can recognise the right account without phoning around for confirmation.

Good naming also helps during audits and quarterly access reviews. If you can understand the purpose from the name alone, you spend less time checking through old notes and more time confirming whether access is still needed.

• Use plain English
• Keep the same format across departments
• Avoid names based on staff surnames
• Include the business function where useful

Group access by team, then by sensitivity

Not every shared login needs the same level of access. Some accounts are low risk, such as a scheduling tool. Others, like banking or payroll, need tighter control. The cleanest setup is to group accounts by team first, then separate them again by sensitivity and approval level.

For example, the operations team might need access to supplier portals and logistics software, while finance handles payment platforms. Sales may need CRM access, but not billing. If everyone gets everything, the business ends up with more risk than is necessary.

In a small company this can feel like extra admin, but it saves time later. A well grouped system makes it easier to see who should have access, who should not, and which logins need stronger controls. It also helps when someone leaves suddenly and you need to adjust access before the next business day.

Write down who approves access and who removes it

Shared credentials often cause problems because nobody is sure who is allowed to say yes or no. Put that responsibility in writing. Every login should have a named approver and a person responsible for removing access when roles change.

This matters even in smaller teams where people know each other well. A verbal arrangement is fine until the operations manager is on leave, the bookkeeper is working from home in Stellenbosch, and a new contractor needs access by 2 pm. At that point a clear process keeps things moving.

A practical approval structure can look like this:

• Business owner approves high risk accounts
• Department lead approves team specific accounts
• Operations or systems lead updates the password manager record
• HR or management flags exits and role changes

When everyone knows the chain, there is less back and forth and fewer gaps.

Use folders or vaults the same way every time

Once you have names and ownership sorted, organise the logins into folders or vaults that match the way the business works. The structure should be easy enough for a new staff member to follow after one training session.

A practical setup for a South African small business could be:

• Executive and owner access
• Finance and payroll
• Sales and client systems
• Operations and logistics
• Marketing and social accounts
• Supplier and compliance portals

Keep the structure stable. If people have to relearn where things live every month, the system becomes hard to trust. A good vault structure should match the business, not the moods of the person setting it up.

Make offboarding part of the naming system

Shared credentials are not only about daily use. They also need to work when somebody leaves, changes roles, or stops using a system. If your naming and grouping is done well, offboarding becomes a simple checklist instead of a scramble.

As soon as a staff member moves on, you should know which accounts they used, which groups they belonged to, and whether their access was personal or shared. If shared access is linked to the team rather than the person, the business keeps running. If not, you may lose time on a Friday afternoon trying to recover a login while clients wait.

Good offboarding also helps avoid confusion in places where teams are split between Cape Town, Johannesburg, and remote work. The less guesswork involved, the easier it is to protect client data and keep records clean.

A local example: one login map for three branches

Imagine a small business with an office in Woodstock, support staff in Johannesburg and a couple of people working remotely from home. At first, each branch keeps its own list of passwords. The result is duplicated accounts, old logins still in use, and no clear way to tell which team owns what.

After a proper setup, the business has one shared system. Finance access sits in one vault, client tools in another, and supplier accounts in a third. Each login has a clear name, one owner, and a review date. If the Durban support team needs access to a new portal, the request follows the same route every time.

That kind of order is not complicated, but it does require discipline. Once it is in place, the business spends less time hunting for passwords and more time getting work done.

If you need help setting up password management, SSO, onboarding training, or quarterly access reviews for a small team, 1Pass works with businesses across South Africa from our Woodstock, Cape Town base. Enquiries come through the form on our contact page.