The Complete Meta Business Suite Setup & Security Checklist for Agencies

Most agency security incidents on Meta start with a messy setup: Pages owned by a former employee’s personal profile, ad accounts shared through a personal login, or one admin who left years ago. This checklist walks through a clean, secure Meta Business Suite structure you can apply to your own business or to every client you onboard.

Meta has renamed several things, so older tutorials can be confusing. Business Manager is now the business portfolio, managed from Meta Business Suite → Settings. The old “admin” and “employee” roles are now full control and partial access.

Understand the hierarchy: portfolio, people and assets

Everything hangs off the business portfolio. People sign in with their own Facebook or Meta account and are then given access; they never share logins. Assets belong to exactly one portfolio and can be shared with partners.

An Instagram account can only belong to one business portfolio. Decide early which portfolio is the true owner, because moving assets later takes cooperation from whoever currently controls them.

Role-based permissions: full control vs. partial access

Meta applies the two access levels to both the portfolio and each asset. Full control of one asset doesn’t grant control of the portfolio.

For a Facebook Page, partial access is split into task-based permissions such as Content, Community activity, Messages and calls, Ads, Insights and Revenue. A community manager may need Content and Community activity but has no reason to see Revenue.

1. In Meta Business Suite → Settings, choose the asset type in the left menu and select the asset.
2. Click Assign people and choose who to add.
3. Select partial access tasks or full control, then click Assign and Done.

Sharing assets with an agency via business portfolio ID

Agencies should be added as partners, not as individual people. You need full control of the portfolio, and the agency needs its own portfolio and must tell you its business portfolio ID.

1. Open Settings → Partners and choose to give a partner access to your assets.
2. Enter the partner’s business portfolio ID.
3. Select the assets to share and the access level for each, then confirm.

To find an ID, a person with full control opens Settings → Business portfolio info, where the portfolio ID is shown under the portfolio name. Send yours by email or chat rather than in a screenshot of other settings. An ID on its own grants no access, because the asset owner still has to approve every share.

A partner with full control of an asset can manage everything on it but can’t share it with a third business. Only the owning portfolio can do that, which is exactly the safeguard you want.

Security Center: two-factor authentication and verification

Security Center sits in Meta Business Suite → Settings → Security Center. Security alerts that need attention also appear at the top of the portfolio’s home page.

Require two-factor authentication

Only people with full control can change the requirement. The options are Admins only, Everyone or No one. Meta automatically requires two-factor authentication for some portfolios older than 90 days, in which case it can’t be turned off.

Choose Everyone. Anyone affected must turn on two-factor authentication on their personal account before they can access the portfolio. Meta recommends an authenticator app over text messages, plus saved recovery codes.

Complete business verification

Verification is required for certain advertising, developer, billing and spending features. Click Start verification in Security Center, enter the legal business name, address, phone number and an HTTPS website, then confirm by email, phone, text, WhatsApp or domain verification. If Meta can’t match your details, you may need to upload official documents such as a business licence.

Meta says a decision can take up to 14 working days. Verification is not the same as the paid Meta Verified subscription and doesn’t add a badge.

The agency setup and security checklist

• The client creates and owns the business portfolio in their company name.
• Two named client employees hold full control of the portfolio.
• Two-factor authentication is required for Everyone.
• All Facebook Pages and Instagram accounts are added to the client’s portfolio.
• The ad account is owned by the client portfolio, with the client’s payment method.
• Pixels or datasets are created in, and owned by, the client portfolio.
• The agency is added as a partner using its business portfolio ID.
• Each person has only the partial access tasks they need.
• Business verification is complete, or its status is recorded.
• The domain is verified in Brand safety settings.
• The People list is exported and reviewed each quarter for leavers and missing two-factor authentication.
• An offboarding owner is named for when staff or agencies leave.

Run a quarterly access review

Setups decay as people change jobs and freelancers come and go. Meta’s best-practice guidance suggests downloading a permissions file from the People tab, which shows each person’s access, when they were last active and whether they use two-factor authentication.

1. Open Settings → Users → People and download the permissions file.
2. Flag anyone who has left, hasn’t been active for months, or has no two-factor authentication or passkey.
3. Remove flagged people, or downgrade them from full control to the partial access tasks they actually use.
4. Repeat the check under Settings → Partners and remove agencies you no longer work with.

Keep a dated copy of each review. If something goes wrong later, you’ll know who had access at the time, and the record helps with audits and handovers.

Troubleshooting common errors

“Instagram account already linked to another business”

Meta lists several reasons you might not be able to add an Instagram profile. The account may already be in a different business portfolio, you may lack full control, another admin may need to approve, or you may be connecting a personal profile instead of a Page.

• Find who controls the other portfolio, often a former agency or an old company account.
• Ask a person with full control there to remove the account under Settings → Accounts → Instagram accounts, or to share it with you as a partner instead.
• If nobody in your organisation has full control of a portfolio you own, use Meta’s request process for regaining full control.

“Asset restricted” or advertising restricted

Open Meta Business Support Home, select Account status overview, choose the restricted portfolio, ad account, Page or person, and read the stated reason. If you believe the decision is wrong and you’re an admin, select Request review under What you can do.

Fix the underlying issue, such as an unpaid balance or a policy violation, before requesting review. Don’t create new accounts or portfolios to get around a restriction; that can lead to further enforcement.

Once the structure is secure, schedule content with the Meta Business Suite Planner and set up Inbox automations. For a cross-platform view of offboarding, see the social media security and offboarding checklist. More guides are in our Meta Business Suite & Creator Tools category.

Official references: Business portfolio and asset permissions, Require two-factor authentication and Verify your business.