top of page
Search

Account Separation for Cyber Essentials: Don't Forget Your Cloud Services

Writer: The Assessor Team
The Assessor Team
6 days ago
10 min read

A common scenario is where the applicant has done a great job of separating admin and user accounts on their Windows laptops, only to fall down when we get to their cloud services. Their Microsoft 365 Global Administrator is also the account they use to read email every day. The person who manages the company Facebook page and Instagram account has full control and uses that same login to scroll their feed in the evenings. The domain registrar has one shared login that everyone knows.


This article explains why account separation applies to every cloud service in your Cyber Essentials scope, not just your devices, and walks through how to approach it in Meta (Facebook and Instagram), Microsoft 365 and Google Workspace. I'll finish with a simple method for finding the equivalent guidance for any other cloud service you use.


Important: please read before following any steps. This article has been written in response to client requests for guidance on this subject. The steps described below are taken from the providers' own published help pages and have not been tested by Get Cyber Certified. The article is provided for information only, and should be treated as part of your own research into how to apply account separation in your organisation. Cloud providers change their menus, role names and settings regularly, so always check the provider's current help pages, and speak to your IT support provider if you're unsure.


If you haven't already, you may also find our companion guide useful: Setting Up User Accounts for Cyber Essentials: A Complete Guide to Account Separation on Windows 11.


What does Cyber Essentials actually require?

The requirements are set out in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). Under the User Access Control section, your organisation must use separate accounts to perform administrative activities only, with no emailing, web browsing or other standard user activities carried out on those accounts. The aim is to avoid exposing administrative privileges to avoidable risks.


Two other parts of the v3.3 requirements make this directly relevant to cloud services:

  • Cloud services cannot be excluded from scope. v3.3 states that if your organisation's data or services are hosted on cloud services, those services must be in scope. It also defines a cloud service as something accessed via an account that stores or processes data for your organisation.

  • User Access Control is always your responsibility. The NCSC's shared responsibility table shows User Access Control as the job of 'your organisation' for IaaS, PaaS and SaaS alike. Your cloud provider can't do this part for you.


Put simply: if a cloud service holds your organisation's data and someone logs into it with an account that can manage users or settings, that account is an administrative account, and the separation requirement applies to it.


Why it matters

The NCSC explains the risk with a simple example. If someone opens a malicious link or attachment while logged in with administrative privileges, the malware typically runs with those same privileges and can do far more damage than it could with a standard account. In the NCSC's example, ransomware is able to encrypt far more data because the user was logged in as an administrator.


In a cloud service the same logic applies, and the stakes can be higher. An administrator in Microsoft 365, Google Workspace or a Meta business portfolio can typically add and remove people, change security settings and reach the organisation's data. If that account is also the one used for email and browsing, a single phishing email or malicious website could hand an attacker control of the whole service.


The cloud services applicants most often overlook

Most applicants remember Microsoft 365 or Google Workspace. Far fewer think about the rest. When you're building your list of cloud services for Cyber Essentials certification, look for any service that you log into with an account and that stores or processes your organisation's data. Common examples include:

  • Social media such as Facebook, Instagram, LinkedIn company pages and X.

  • Domain registrar and DNS portals. Whoever controls your domain can redirect your website and email.

  • Website builders and hosting such as Wix, WordPress hosting or Squarespace.

  • Cloud accounting and payroll such as Xero, QuickBooks or Sage.

  • CRM, messaging and collaboration tools such as HubSpot, Slack, Zoom, Dropbox or Mailchimp.

  • Line-of-business systems such as practice management, booking or ecommerce platforms.


Every one of these needs MFA, and every one of these needs administrative tasks to be carried out from an account that isn't used for everyday work. For more on getting the list right, see our guide on How to Scope Cyber Essentials and our article on MFA for Cyber Essentials.


Spotting the 'admin' role in a cloud service

Every provider uses different names for administrative access, which is one reason it gets missed. As a rule of thumb, treat a role as administrative if it lets the holder add or remove users, change other people's permissions, change security or billing settings, or take ownership of the service. Examples include:

  • Microsoft 365: Global Administrator, User Administrator and the other admin roles.

  • Google Workspace: Super Admin and the other admin roles.

  • Meta Business Suite: Full control (Meta notes this was formerly called the business admin role).

  • Other services: look for names such as Owner, Admin, Account Owner, Billing Admin or Manager.


Account separation in Meta Business Suite (Facebook and Instagram)

Facebook Pages and Instagram professional accounts are usually managed through a business portfolio in Meta Business Suite (previously known as Meta Business Manager). This is where you control who can access your Pages, Instagram accounts, ad accounts and other business assets.


Understand Meta's two access levels

According to Meta's help page About business portfolio and business asset permissions, there are two levels of access:

  • Full control. The highest level. People with full control can manage everything in the business portfolio, including people and settings. This is Meta's administrative role.

  • Partial access. The default when someone is added. It lets people work on the assets they've been given without managing the portfolio itself.


Meta also notes that someone can have full control of an individual asset, such as a Page, without having full control of the whole portfolio. That gives you a useful way to apply least privilege. Meta's own guidance is to assign only the level of access people need to do their work.


Adding people with the right level of access

The steps below summarise Meta's guide Add people to a business portfolio and assign a business asset. You need full control of the portfolio to do this.

  1. Open Settings in Meta Business Suite for your business portfolio.

  2. Under Users, select People, then choose to add or invite people.

  3. Enter the person's work email address.

  4. Choose the access level. For anyone who only needs to post content, reply to messages or view insights, choose partial access. Reserve full control for the small number of people who genuinely need to manage people and settings.

  5. Assign the specific business assets the person needs, such as your Facebook Page or Instagram account, and choose the task permissions for each one.

  6. Send the invitation. The person must accept it by email before they can access anything.


If you need to give existing team members access to more assets later, Meta explains how in Assign business assets to people in your business portfolio. When someone leaves or no longer needs access, remove them promptly using Meta's guide Remove people from your business portfolio. Removing access when it's no longer needed is a separate Cyber Essentials requirement in its own right.


Instagram

Once your Instagram professional account has been added to your business portfolio, you assign people access to it in the same way, choosing partial access or full control. Meta's permissions page notes that full control of an Instagram account can't be given to a partner business or when the account sits in a business asset group, so check how your portfolio is set up if the option isn't available.


Applying the Cyber Essentials separation principle in Meta

Here's the part many applicants miss. Access to Meta Business Suite is tied to each individual's own login, and that same login is often used for personal browsing on Facebook or Instagram. If that login holds full control, it's an administrative account being used for everyday activity. When you research how to apply separation in your own portfolio, think about:

  • Keeping everyday work, such as posting, replying to comments and checking insights, on logins with partial access only.

  • Limiting full control to the fewest people possible, and making sure the login that holds it is only used when an administrative task is needed, such as adding or removing people or changing settings.

  • Checking Meta's current terms and help pages on how logins and accounts work before creating any additional login, so that whatever approach you choose is permitted by Meta.

  • Turning on two-factor authentication for every login with access to your business portfolio. Cyber Essentials v3.3 requires MFA for authentication to cloud services.

  • Reviewing the People list regularly and removing anyone who no longer needs access, including former staff, freelancers and agencies.


However you choose to achieve this, be ready to describe the approach clearly in your assessment answers. Your assessor needs to understand how administrative access to your social media is controlled, not just that it is.


Account separation in Microsoft 365

Microsoft's guidance in Admin account security in Microsoft 365 for business lines up closely with the Cyber Essentials requirement. Key points include:

  • Use ordinary user accounts for regular work. Microsoft recommends that admins use non-admin accounts as their primary accounts for signing in to computers, checking email and using Microsoft 365 Apps, and only use the admin account when needed.

  • Keep admin sessions clean. Microsoft advises closing unrelated browser sessions and apps, including personal email, before using an admin account, using InPrivate or private browsing for admin tasks, and signing out afterwards.

  • Admin-only accounts don't need a licence. Microsoft notes that ordinary user accounts need Microsoft 365 licences, but admin-only accounts don't. An unlicensed admin account has no mailbox, which helps keep it away from email.

  • Apply least privilege. Microsoft's example: if someone only needs to create user accounts, give them the User Administrator role rather than Global Administrator. See About admin roles in the Microsoft 365 admin center.

  • Limit the number of admin accounts. Microsoft warns that too many admin accounts give attackers more opportunities.


Microsoft explains how to create a separate admin account and assign it a role in Add an administrator. In outline, you create a new user in the Microsoft 365 admin centre (Users > Active users), give it a name that doesn't advertise admin privileges, and assign only the admin role it needs. You then move the admin role off the person's everyday account.


A note on emergency access accounts. Microsoft also recommends at least two emergency access, or 'break glass', accounts and suggests these may need to be excluded from MFA. Cyber Essentials v3.3 states that authentication to cloud services must always use MFA, so if you use emergency access accounts, discuss how they're protected with your Certification Body before you submit your assessment rather than assuming an MFA exclusion will be accepted.


For more on limiting access to what people actually need, see our article on the principle of least privilege.


Account separation in Google Workspace

  • Give each super administrator two accounts. Google recommends that each super admin has their own super admin account and a separate account for daily activities. Google's own example uses naming such as admin-maria@example.com for admin and maria@example.com for everyday work.

  • Only sign in to the super admin account when needed. Google advises against staying signed in, as it increases exposure to phishing. Sign in for the specific task, then sign out.

  • Delegate everyday admin tasks to limited roles. Google suggests using accounts with limited admin roles, rather than super admin, for routine administration, following a least privilege approach. See About administrator roles.

  • Don't share admin accounts. Each administrator should have their own identifiable admin account so activity can be traced. Shared accounts also conflict with the Cyber Essentials requirement for unique credentials.

  • Use 2-Step Verification on admin accounts, with Google recommending security keys as the most secure option.


Google explains how to give a dedicated admin account its role in Make a user an admin.


How to find account separation guidance for any cloud service

You won't find a step-by-step guide for every cloud service in one place, but almost every reputable provider publishes help pages on user roles and admin security. Here's a simple method:

  1. Start with the provider's own help centre or knowledge base. Look for a link labelled Help, Support, Knowledge Base or Documentation, usually in the footer of the provider's website or in the account menu.

  2. Search using the right terms. Useful search phrases include: 'user roles and permissions', 'admin roles', 'add a user', 'invite a team member', 'least privilege', 'security best practices for admins', 'two-factor authentication' and 'remove a user'.

  3. If the help centre search doesn't help, use a search engine. Search for the provider name plus one of the phrases above, for example 'Xero user roles' or 'Wix site roles and permissions'. Prefer results on the provider's own website over third-party blogs.

  4. Work out which roles are administrative. Look for the role that can invite users, change permissions, change security settings or manage billing.

  5. Check whether a separate admin login is possible. Can you invite a second email address with the admin role and give your everyday login a standard role? Many services allow this. If not, record what the service supports and how you limit the risk.

  6. Confirm MFA is available and switched on for every account, admin and user.

  7. Record what you find in your list of cloud services, including who has admin access and how it's controlled. This makes your Cyber Essentials assessment answers much easier to write.


Writing it up for your assessment

When you describe account separation in your assessment, explain how it works rather than simply stating that it's in place. For example: 'Our Microsoft 365 Global Administrator role is held by a dedicated, unlicensed admin account used only for admin tasks. Staff use standard accounts for email and day-to-day work. Our Facebook Page and Instagram account are managed through our Meta business portfolio, where staff who post content have partial access only, and full control is restricted to two named people.' Our guide on writing a compliant process for Cyber Essentials explains how to approach this.


Quick checklist

  • I have listed every cloud service that stores or processes our organisation's data, including social media, domain registrar and website.

  • For each service, I know which roles are administrative and who holds them.

  • Administrative tasks are carried out from accounts that aren't used for email, web browsing or everyday work.

  • Everyday users have only the access they need.

  • MFA is switched on for every account on every cloud service.

  • We have a process to remove access when people leave or change role.

  • I can describe how all of the above works in my assessment answers.


Need a hand?

Account separation across cloud services is one of the most common areas where applicants need extra support. If you'd rather not work through every provider on your own, our Supported Service includes a gap analysis of your answers before anything is submitted for marking, so issues like this are picked up early. You can find out more about how to get Cyber Essentials with us at getcybercertified.co.uk, or browse more Guidance for applicants.


Sources and further reading

Comments

Get Cyber Certified Logo

0333 339 0383

bottom of page