A partner company that uses our infrastructure has been passing the same user account from one intern to the next for years. They typically do not change the password, and the account may provide access to services such as email, OneDrive, and Active Directory resources.
I believe every intern should receive an individual account, just like any other user. Shared credentials make it impossible to reliably identify who performed an action, complicate onboarding and offboarding, weaken access reviews and incident investigations, and could expose data left behind by a previous intern. They also create potential privacy and compliance concerns, including under GDPR. MFA may be configured for some cloud services, but I still need to verify how the underlying account is protected.
The partner's main argument is that they have always done it this way without a known incident. I have explained that the practice violates our IT policy, but I do not personally have the authority to enforce it. I have documented the concern and raised it with my manager. If the partner's leadership formally accepts the risk, should I stop arguing and proceed, or am I right to keep pushing for individual accounts? What is the best way to handle this professionally?
5 Answers
You are right from a security and operational perspective. A shared human account destroys reliable accountability: the logs can show what the account did, but not which person actually did it. It also makes least privilege, access reviews, offboarding, incident response, and data ownership much harder. “Nothing bad has happened yet” is not a security control.
Document the risk, the policy requirement, and the recommended fix. If someone with the proper authority wants to accept the risk, that decision belongs to management. Your responsibility is to make sure the risk and the consequences are clearly recorded rather than silently taking ownership of it yourself.
A shared account is not automatically unacceptable in every situation, but it should be limited to a specific non-personal function and should not be used as a general-purpose mailbox or workstation login. If the account can access email, cloud storage, or broad internet-connected resources, the exposure is much greater.
At an absolute minimum, credentials would need to be rotated between users, access would need to be tightly restricted, and activity would need to be attributable through another reliable control. Even then, individual accounts are the cleaner solution for interns.
Once you have explained the risk and obtained a written decision from someone authorized to override the policy, stop treating the outcome as your personal responsibility. Keep the documentation somewhere you can access for normal business and audit purposes, note who accepted the risk, what controls remain in place, and when it should be reviewed.
Do not frame the issue as a personal argument with the partner. Present it as a documented risk decision: individual accounts are the required control, the exception creates specific risks, and management must either fund the fix or explicitly accept those risks.
There may be a practical reason they keep sharing the account, such as licensing costs or avoiding delays when an intern starts. Find that reason and remove the friction. Individual accounts should be easy and quick to provision, and alternatives such as shared mailboxes, delegated access, role-based permissions, or license reassignment may solve the business need without sharing credentials.
Also define a proper onboarding and offboarding process. Intern accounts should have an owner, an end date, appropriate access, and a clear process for preserving or deleting work when the intern leaves.
If cost is the issue, make the licensing impact explicit and compare it with the cost of an investigation, privacy incident, or compromised account. Often the “cheap” legacy process is only cheap because the risk has been ignored.
This is ultimately both a policy and a people problem. IT should explain the technical risks and provide a workable process, while management or HR should handle repeated violations of an established policy. Make account creation fast enough that teams do not feel forced to bypass IT, especially when interns start with little notice.
You are not wrong for raising the issue, but you also do not need to carry the frustration alone. Escalate it through the proper chain, record the decision, and focus on implementing whatever controls your organization has formally approved.
MFA does not solve the identity problem by itself. If the same account and authenticator are transferred to each new person, you still cannot prove who performed an action. Verify both the cloud MFA setup and the underlying directory account.