Facebook Business Manager and Ad Account Setup You Fully Own

Most Facebook advertising problems are not caused by the ads. They are caused by the accounts underneath them: a Page that belongs to a former employee, an ad account that sits on someone’s personal profile, an agency that still has full control two years after the contract ended, or a single admin whose login was stolen. This guide explains how ownership, access and security fit together in a Facebook Business Manager setup, so you can check your own accounts or decide what to hand over to someone else.

Business Manager, business portfolio, Meta Business Suite: one thing, three names

Meta has renamed its business tools several times, which confuses a lot of business owners. What used to be called Facebook Business Manager is now called a business portfolio, and you manage it inside Meta Business Suite at business.facebook.com. The idea has not changed. A business portfolio is a container that belongs to your company, not to any one person. Your Facebook Pages, Instagram accounts, ad accounts, pixels and catalogs are added to it as assets, and people are given access to those assets through roles. In this guide we use Business Manager and business portfolio for the same thing, because people still search for both.

Ownership: who your assets really belong to

Every asset in Meta’s system has an owner, and the owner is the one business portfolio that can remove everyone else. If your ad account was created from your agency’s Business Manager, your agency owns it, even if your card pays for it. If your Page was created years ago by a freelancer on their personal profile, it may never have been moved into a business at all. Ownership matters most on the day something goes wrong: a partnership ends, a person leaves, or an account is restricted. The owner can act; everyone else has to ask.

A clean setup has one business portfolio in your company’s legal name that owns your main Page, your Instagram account, your ad accounts and your pixel or dataset. Agencies and freelancers are then given access to those assets as partners, which means they can work on them without ever owning them.

Access: roles, partners and why passwords never change hands

There are two kinds of access in a business portfolio. People are individual profiles added to your business, each with either full control or limited access. Partners are other businesses, such as an agency, that you share specific assets with. When you share an ad account with a partner, you choose what they can do with it, for example manage campaigns or only view performance, and you can take it back at any time. Meta’s own help page on adding partners to your business portfolio walks through the screens.

Because of this system, nobody who works on your accounts should ever need your password or your login codes. If a service asks for them, that is a warning sign. Shared passwords cannot be limited, cannot be audited and are the most common route to a stolen account, because the person you shared them with may store them somewhere unsafe.

A good rule is the smallest access that gets the job done. A designer who only posts to your Page does not need access to your ad accounts. A media buyer does not need full control of the whole business portfolio. And at least two people you trust inside your own company should have full control, so that one lost phone or one resignation never leaves the business without an admin.

Security: the settings that stop a takeover

Most account takeovers start with one weak personal profile that has admin access. Securing the business therefore starts with securing the people. Every profile with access should use two-factor authentication, preferably with an authentication app rather than text messages; Facebook explains the options in its guide to two-factor authentication. Each profile should also have an up-to-date recovery email and phone number, login alerts switched on, and no old sessions left open on devices nobody uses anymore.

Inside the business portfolio, you can require two-factor authentication for everyone or for admins only. It is worth doing, even though it means helping a few colleagues set it up. It is also worth reviewing your people and partners every few months and removing anyone who no longer needs access. Former freelancers, old agencies and test profiles are easy to forget and easy to misuse.

The setup mistakes we see most often

Some mistakes come up again and again. Ad accounts created on a personal profile instead of inside a business portfolio, so they are hard to share and easy to lose. A business portfolio with only one admin. Agencies given full control of the whole business instead of access to specific assets. Several business portfolios created by accident, each owning part of the setup, so nobody can see everything in one place. A Page and an Instagram account owned by two different businesses. And ad accounts with a currency or time zone that does not match how the business actually reports its sales, which usually cannot be changed afterwards and means starting a new ad account.

None of these stop ads from running on day one. They become expensive later, when someone needs to remove a person, recover a login or prove who owns what.

A ten-minute ownership check you can do today

Open Meta Business Suite and go to your business settings. First, look at Accounts: every Page, Instagram account, ad account and dataset you rely on should appear there, and next to each one you should see your own business as the owner, not a partner. Anything you use but cannot find has probably never been added to the business, or belongs to somebody else.

Next, open People. Count how many people have full control; it should be at least two, and all of them should be people inside your company. Remove anyone who has left. Then open Partners and read the list slowly. For each agency or freelancer, check which assets they can reach and whether they still work for you. Finally, check whether two-factor authentication is required for the business. If any of these checks surprised you, write the problems down before you change anything, so you fix them in the right order and do not remove the one admin who still has access.

Doing it yourself, or getting help

You can do all of this yourself. Meta’s Business Help Center documents every setting, and a careful owner can finish a basic setup in an afternoon. The advantages are clear: it costs nothing and you learn your own system. The disadvantages are time, the risk of a choice that cannot be undone, and the fact that it is hard to spot problems in a setup you built yourself.

A setup service makes sense when you are short on time, when an existing setup has become tangled across several people and businesses, or when you want an agency to start work and need ownership and access sorted first. If you use a service, check three things before you start: that they never ask for your password, that everything is created in your business’s name, and that they explain in writing what they changed. You can compare all seven of our setups and prices to see what each one covers.

What a setup can and cannot promise

A correct setup removes the most common causes of lost access and ownership disputes. It does not control Meta’s review systems, and no one can promise that an account will never be restricted. We are honest about that, and you can read more about how we work and what we refuse to do, or find quick answers in our full FAQ.