Shared Admin Accounts Are the First Thing to Remove

When a technician leaves your firm and you're rotating credentials for a week, you've already found the problem with shared admin accounts. Nobody can tell you exactly what that person touched, because the login doesn't say "Dave". It says "admin", and four other technicians used it too. You're not doing an offboarding task at that point. You're doing an investigation with no evidence.

Most owners rank this below client-facing fixes: MFA rollouts, EDR coverage, the things a prospect asks about in a security questionnaire. Shared admin accounts stay lower on the list because they're internal, and internal problems don't lose you deals the way a failed audit does. But a shared account is the one credential that touches every client tenant you manage, and it's usually the least monitored login in the building. Nobody reviews activity on an account when four people have a legitimate reason to be logged into it right now.

The fix isn't a policy memo asking people to stop sharing the password. It's removing the account, giving each technician their own, and accepting that this takes longer than writing the rule. That ordering (credential first, behavior second) is why this belongs at the start of a hardening effort instead of the end. You can't audit what one login did across six clients. You can audit what one technician did across six logins.