When the person who runs your brand accounts leaves, every dangling login and half-remembered password becomes a live risk. Here is a layered account handover checklist that closes every door — platform by platform — without losing the knowledge that walks out with them.
Your social media manager just handed in their notice — or was walked out this morning. Either way, you now own a problem most companies have no process for: social media offboarding. The person leaving holds Page permissions, inbox history, scheduled posts, maybe a shared password or two, and a head full of context nobody wrote down. This account handover checklist walks through every layer, in order, so that when the door closes behind them, every account door closes too.
The goal is two-sided: zero dangling access and zero lost knowledge. Doing only the first half gives you a secure account nobody knows how to run.
Brand accounts are most exposed in the days around a departure, for three reasons:
None of this requires bad intent. A former employee whose phone still receives your Instagram 2FA codes is a risk even if they never touch anything: their device is now part of your attack surface, outside your control.
The checklist below is the same in both cases — what changes is the order and tempo.
Planned departure (notice period). You have two to four weeks. Run the knowledge transfer first: the handover document, shadowing with the successor, a walkthrough of open campaigns. Revoke access completely on the final day — partial revocation "because they're helping out next week" is how dangling access is born. If help is genuinely needed afterward, treat them as an external contractor with fresh, scoped, temporary access.
Same-day exit. Reverse the order: revoke everything within hours, then reconstruct the knowledge from artifacts — the scheduler queue, the inbox, the shared drive, the audit trail of recent actions. It's slower and lossier, which is exactly why the handover document below should be a living file maintained before anyone resigns, not an exit-week scramble.
In a same-day exit, do the revocation steps in one sitting and in one written pass — not "as we remember things over the week." Every forgotten permission is an account your former employee can still act on, from a device you no longer manage.
Work top to bottom. Each layer is a different door, and they don't share keys.
Meta is usually the biggest surface, because access lives in more than one place (and Meta renames these menus regularly — the concepts are stable, the labels wander):
If your setup follows the partner-access model we described in how to give an agency access without making them admin, this layer is one or two removals. That article is, in effect, the structure that makes offboarding trivial: identity-based, per-task access means departure equals deletion, not archaeology.
For any account where people sign in with a shared username and password (it happens — especially on older or smaller channels):
Each remaining network has its own access system; the step is the same everywhere — find the roster, remove the name (menu wording varies by platform and changes over time):
Here's where a management platform earns its keep. If your team works through a platform connected to your channels via official authorization, the leaver's day-to-day access is one seat — and removing that one seat cuts their access to every connected channel at once. One removal instead of six platform audits.
In Octonity, that looks like: the person had a role with brand-scoped permissions (they could only touch the brands assigned to them), their drafts may have sat behind approval gates, and every action they took is in the audit log. Remove the seat and their access to all six connected channels ends in the same moment — while their scheduled posts, inbox assignments, and history stay behind for the successor. Layers 1–3 still matter, but the daily-work layer collapses to a single step.
The accounts are only half the perimeter. Sweep the rest:
Access is revocable; knowledge isn't. Capture at minimum:
Make the handover document a standing artifact, reviewed quarterly — not a leaving ritual. The version written in someone's final week is always the worst version.
Before you archive the departure, look backward. If your platform keeps a full audit log of who did what, review the leaver's final weeks: posts published or deleted, settings changed, conversations closed, anything bulk-exported. Almost always you'll find nothing — and now you know it's nothing, instead of hoping.
This is also where soft-delete policies quietly matter. In Octonity, deleted items keep a 30-day restore window, so even a rage-quit "delete everything" moment — or an honest last-day mistake — is reversible rather than final. Pair the audit review with the restore window and the worst realistic outcome of a bad exit is a half-hour of cleanup.
If this list felt long, that's the honest cost of scattered access. Team roles, brand-scoped permissions, and approval gates on Octonity's Free tier cost nothing to set up, and they turn the next offboarding into one removed seat plus a short native-platform sweep.
Depends on the scenario. Planned departure: start the handover document and knowledge transfer, then revoke access completely on the final day. Same-day exit: revoke access first — Meta, shared passwords, platform seats — then reconstruct knowledge from the calendar, inbox, and audit log.
Only for accounts that used shared credentials — but for those, always: reset the password, revoke active sessions, and rotate 2FA to a company-controlled device. Individual, identity-based access needs a removal, not a reset.
Remove them in two places: the Page's access list (both Facebook access and task access) and your Business portfolio's people list in Meta Business Suite — and check partner assignments too. Menu names shift as Meta updates its interface, but both surfaces must be cleared.
A short standing file the successor can run the accounts from: the content calendar's current state, open inbox conversations and promises made, a map of where every credential lives, and the location of brand guidelines and escalation contacts.
Plan, create, and publish across every channel from one workspace. Free plan available — no credit card.
قائمة عملية لتسليم وتأمين حسابات السوشيال ميديا عند مغادرة الموظف: سحب صلاحيات Meta، وتدوير كلمات المرور المشتركة، وتنظيف بقية المنصات في جولة واحدة، وإزالة مقعد منصة الإدارة، وتوثيق ملف التسليم، ومراجعة سجل آخر 30 يومًا.
A practical guide to giving a social media agency access to your Facebook Page and Instagram the safe way: Task Access for freelancers, Partner access for agencies, no passwords, no Full Control — and what to check before you approve any request.
دليل عملي لاسترجاع حساب انستقرام مخترق: البوابة الرسمية instagram.com/hacked، وخطوات مفصلة لثلاثة سيناريوهات حسب ما بقي بيدك من الحساب، وأنماط التصيد الشائعة في المنطقة العربية، وقائمة وقاية صادقة — من دون وعود زائفة بالاسترجاع المضمون.
