A partner company that uses our infrastructure has been reusing one account for interns for years. When one intern leaves, the credentials are simply handed to the next person, sometimes without even changing the password.
I'm responsible for IT and have said this must stop. Every intern should receive an individual account, just like any other user. Shared accounts undermine accountability, make onboarding and offboarding difficult, complicate access reviews and incident investigations, and can expose the next user to data left behind by the previous one in mailboxes, cloud storage, or other services. They can also create problems with privacy and regulatory obligations.
The partner's main argument is that they have always done it this way without an obvious incident. The new IT policy prohibits the practice, but I don't have the authority to enforce it directly. I have warned my manager and hope management will support the decision.
Is it reasonable to insist on individual accounts for interns? If management formally accepts the risk and overrides the policy, should I simply document that decision and move on?
4 Answers
First find out what problem the shared account is solving. It may be licensing cost, slow account provisioning, access to a common mailbox, or the partner’s fear of having to contact support. Then remove that excuse: use a shared mailbox or service account where appropriate, transfer a license, and make intern account creation quick and predictable.
A shared account may be acceptable for a tightly limited technical function, but not as a general-purpose person account with mail, cloud storage, and broad access. If the process for creating intern accounts is easy, people are less likely to bypass it.
You’re justified in raising this, especially because the account can contain information from previous interns and could later become relevant to an HR or security investigation. However, don’t turn it into a personal battle. Explain the risks plainly, involve management or legal where appropriate, and let an authorized executive formally accept or reject the risk.
If they choose to continue, record the exception, its scope, who approved it, and when it will be reviewed. Your responsibility is to identify and communicate the risk; you should not silently become the person accountable for a decision you were not authorized to make.
Individual accounts are also important for onboarding and offboarding. Each intern should have a defined owner, access level, retention process, and deactivation date. Shared accounts make it much harder to know what data belongs to whom or whether a former user still has access.
Check the authentication setup too. If the directory account has no strong authentication or the second factor has to be repeatedly moved between people, that is another sign the design is unsuitable. A personal account with appropriate MFA is much easier to manage.
Yes, you’re right on the technical and security principles. A shared human account destroys reliable identity: the logs can show what the account did, but not which person did it. That affects accountability, least privilege, access reviews, offboarding, and incident investigations. “Nothing has gone wrong yet” is not a security control.
Document the risk, the recommended solution, and the business impact. If someone with the proper authority chooses to accept that risk, the decision belongs to them—not to you personally. Keep the approval and any instruction to continue sharing accounts in writing.
Make sure the written decision is stored somewhere you can access later and isn’t only kept by the people who overruled you. Once the risk is clearly documented and accepted by the right authority, you can enforce what you’re allowed to enforce and stop carrying the whole issue emotionally.
The likely motivation is saving on licenses, although the other issues can be solved with better provisioning. Their support process also adds friction, so I’ll focus on making the approved process clear and practical rather than only arguing about the policy.