You have found someone to run your Facebook and Instagram ads. They ask you to “add them to your Business Manager”, or worse, for your Facebook password so they can “set things up quickly”. You are not sure what you are agreeing to, who will own what afterwards, or how you would get things back if the arrangement ends badly.
This post explains Meta Business Manager access in plain words: what your business portfolio is, how ownership of the ad account, Page and Instagram account works, the safe way to give an agency access to Facebook ads, how to keep admin control in your own hands and how to remove access cleanly when someone leaves.
The business portfolio, in plain words
Meta’s business tools are organised around a business portfolio. This used to be called Business Manager, and many people still use that name. It is a container that belongs to your business and holds its assets:
- Facebook Pages
- Instagram accounts
- Ad accounts
- The Meta Pixel and other datasets
- WhatsApp Business accounts, product catalogues and verified domains
People are added to the portfolio with their own personal Facebook or Meta accounts and given roles. Partners, such as an agency’s own business portfolio, can be given access to specific assets without becoming members of your business.
You manage all of this in the business settings area, which you can reach from Meta Business Suite.
Ownership versus access
This is the single most important idea. Each asset has one owner, and any number of people or partners can have access.
| Owner | Has access | |
|---|---|---|
| Who it is | The business portfolio the asset belongs to | People or partner businesses you have granted permissions to |
| Can remove others | Yes | No |
| Keeps history when a partner leaves | Yes | Access ends; nothing moves |
| Can be taken away | Not without the owner’s admins | Yes, by the owner at any time |
Your business portfolio should own your Page, Instagram account, ad account and Pixel. An agency should have access to them through their own portfolio. If the agency’s portfolio owns your ad account, it is their ad account, and the spend history, audiences and learning stay with them when you part.
The same principle applies to Google Ads. Our post on keeping ownership of your Google Ads account explains the equivalent setup there.
Setting up your own portfolio first
- Create a business portfolio in your business’s name, using the personal Meta account of the owner or a senior person.
- Add your Facebook Page. If you created the Page yourself, you can add it as owned.
- Connect your Instagram account.
- Create an ad account inside the portfolio, with your business’s currency and time zone, and add your own payment method.
- Create the Pixel in Events Manager inside this portfolio.
- Add a second trusted person as a full-control admin, so you are never locked out if one profile has a problem.
- Turn on two-factor authentication for every admin.
Only then invite an agency or freelancer.
How to give an agency access to Facebook ads safely
The clean way is partner access, not adding the agency’s staff as people in your business and certainly not sharing a password.
- Ask for the agency’s business portfolio ID. A genuine agency will have one and can find it in their business settings.
- In your business settings, add a partner using that ID.
- Choose which assets to share: the ad account, the Page, the Pixel, and the Instagram account if they will manage Instagram ads.
- Choose the level of access for each. For an ad account, the agency typically needs to manage campaigns and view performance. For the Page, they may need advertising access but not full control.
- Let the agency assign their own staff within their portfolio. When their staff change, they handle it, and your settings stay tidy.
The agency may instead send you a request for access from their side. That is fine, as long as it is a request for access, not a request to take ownership of an asset. Read the notification carefully before approving.
What permissions to give
Meta lets you choose between full control and more limited, task-based access for most assets. For an outside partner, give what they need to do the job and no more. An agency running ads rarely needs full control of your business portfolio, the ability to add or remove people, or access to your payment settings beyond what the ad account requires.
Red flags when someone asks for access
- They ask for your password or login codes. Never share them. Proper access is granted through roles.
- They want to create the ad account in their own portfolio “because it is easier”. It is easier for them to keep it.
- They ask to move your Page into their portfolio as owner.
- They insist on paying Meta from their card and invoicing you, with no visibility of the actual spend. Some arrangements work this way legitimately, but you lose control of the account.
- They cannot tell you their business portfolio ID or explain what access they need.
Meta Business Manager access: keeping admin control safe
Most lock-outs happen because one person held every key. A few habits prevent that:
- Keep at least two full-control admins from inside your business, both with two-factor authentication.
- Use real personal accounts for admins, not shared or fake profiles. Meta is wary of fake profiles and may restrict them.
- Keep the email and phone on those accounts up to date.
- Review the people and partners lists every few months.
- Be cautious about messages claiming to be from Meta that ask you to log in through a link. Check notifications inside Business Suite instead.
If an account does get restricted, having a second admin and tidy permissions makes recovery much easier. Our post on what to do when an ad account is restricted covers that situation.
Removing access when someone leaves
When an agency relationship ends, or an employee leaves, remove access promptly.
- In business settings, open the partners list and remove the agency, or remove their access to each asset.
- Open the people list and remove any individuals who no longer work with you.
- Check the Page and Instagram account directly for any separate access granted outside the portfolio.
- Check the ad account’s payment methods and remove any card that is not yours.
- Check that the Pixel and any connected apps or integrations still belong to your portfolio.
- Note the date, so you can trace any later activity.
The same habit applies to your website when staff change; our checklist for removing access when an employee leaves covers that side. The starting guide to advertising on Facebook and Instagram places account setup at the beginning of a first campaign, and our digital marketing guide applies the same ownership rule across every channel.
Frequently asked questions
Can I take back an ad account that my old agency created?
If the agency’s portfolio owns the ad account, you cannot simply move it to yours. Ask the agency to give your portfolio access so you can at least see the history, and plan to create a fresh ad account you own. The Page and Instagram account can usually be recovered if you are an admin on them.
Does the agency see my payment card details?
Partners working in your ad account can see spend and billing information depending on their permissions, but they do not see your full card number. You can keep payment settings managed by your own admins and give the agency only campaign and reporting access.
Should the agency have full control of my business portfolio?
Almost never. Full control lets someone add and remove people, change ownership settings and manage every asset. An outside partner only needs access to the specific assets they work on. Keep full control for people inside your business.
When we run ads for a client, it is always from the client’s own portfolio with partner access that can be removed at any time. Our Facebook and Instagram ads service page explains how that works in practice.
