Topic starter
24/06/2026 11:34 pm
TL;DR: Social media accounts often sit outside enterprise IAM and IGA because platform standards, shared access patterns, and employee-owned credentials prevent central control, according to Cerby. The result is a governance gap that makes least privilege, MFA, lifecycle automation, and auditability difficult to enforce at scale across marketing-managed channels.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Securing Social Media: Why Applying Best Practices to Secure Social Media Accounts is So Darned Hard”.
Key questions
Q: What breaks when social media accounts stay outside IAM and IGA control?
A: Lifecycle management, credential governance, MFA enforcement, and auditability all become fragmented when social platforms cannot participate in standard identity workflows.
Q: Why do shared social media credentials create so much risk?
A: Shared credentials remove individual accountability, make least privilege hard to enforce, and complicate investigations because activity cannot be reliably tied to one person.
Q: How can organisations keep MFA in place on shared business accounts?
A: They need central custody of the credential and MFA factors, plus a workflow that preserves usability without giving users direct control over the secret.
Practitioner guidance
- Map disconnected social accounts as a separate identity class Inventory every business social media account, then record whether the account supports enterprise federation, automated provisioning, shared access, and business-owned recovery factors.
- Move account ownership to the organisation Use enterprise-controlled email addresses, phone numbers, and recovery methods so that no single employee, agency, or contractor controls continuity.
- Replace shared-password handoffs with tracked access governance Eliminate ad hoc sharing through email, spreadsheets, or chat, and require a documented process for granting and revoking access to each account.
Bottom line: Social media accounts create an identity governance gap because platform design often prevents normal enterprise IAM and IGA controls from reaching them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 8:33 am
Social media accounts expose a governance boundary that most IAM programmes still ignore: they are business identities without reliable federation, lifecycle automation, or individual accountability. That means the control model that works for SaaS, internal applications, and cloud platforms stops at the social platform edge. The practical conclusion is that organisations need to recognise disconnected identity surfaces as first-class governance scope, not as exceptions that marketing can self-manage.
A question worth separating out:
Q: How do teams apply least privilege to social media access?
A: They often cannot apply it cleanly with shared logins, so the first step is to stop treating the shared credential as normal user access. Teams should push toward individualised access, time-bound approval, and explicit removal when the business need ends, because the full account permission set is otherwise inherited by everyone.
👉 Read our full editorial: Social media identity gaps are breaking enterprise IAM controls
This post was modified 1 day ago by NHI Mgmt Group