Give a New Team Member Tool Access Without Sharing Logins

TL;DR — Do not send a shared username and password in email or chat. Instead, invite the new person from each tool’s admin area using their work email, give them the lowest role that lets them do their job, and turn on two-factor authentication (2FA, a second sign-in check) if the tool supports it. Reading time: ~5 min

Goal

When you finish, your new team member will be able to sign in to each required tool with their own work email and password, their access level will match their job, and you will not need to share any existing login.

Prerequisites

• An admin or owner account in each tool you need to grant access to
• The new team member’s work email address
• A list of the tools they need, for example: project management, code repository, hosting, analytics, billing, support inbox, or DNS
• The role they should have in each tool, for example: Viewer, Member, Developer, Admin, or Billing
• Your company’s preferred 2FA method, usually an authenticator app on the new team member’s phone
• If your company uses single sign-on (SSO, one login across multiple tools), access to your identity provider dashboard, such as Microsoft Entra ID, Google Workspace, or Okta

Steps

Step 1: List the exact tools and access level needed

Create a short access list before you invite anyone. Use this template and fill in one row per tool.

What you should see when this step succeeds: you have a completed list with one role per tool, not a vague note like "full access".

Step 2: Check whether you use SSO first

In each tool, look for a sign-in or security area that mentions SSO, SAML, or "Sign in with Google/Microsoft". If your company uses SSO, add the person in your identity provider first, then assign them to the app there.

Use your provider’s dashboard, for example:

• Microsoft Entra ID: Entra admin center → Users → New user
• Google Workspace: Admin console → Directory → Users → Add new user
• Okta: Admin Console → Directory → People → Add person

Then assign the app:

• Microsoft Entra ID: Enterprise applications → [App name] → Users and groups → Add user/group
• Okta: Applications → Applications → [App name] → Assignments → Assign → Assign to People
• Google Workspace: Apps → Web and mobile apps → [App name] → User access

What you should see when this step succeeds: the new user appears in your identity provider and is assigned to the app.

Step 3: Invite the user directly in each tool that does not use SSO

In each tool’s dashboard, use the team, members, users, or organization area to send an invite to the new team member’s work email.

Common menu paths by pattern:

• Settings → Team → Invite member
• Organization → Members → Add user
• Admin → Users → Invite users
• Project → Settings → Access → Add member

Enter these literal values:

• Email: the new team member’s work email
• Role: the lowest role from your access list in Step 1
• Scope: only the workspace, project, repository, or environment they need

If the tool asks whether to copy another user’s permissions, choose "No" unless the roles are already documented and identical.

What you should see when this step succeeds: the tool shows "Invitation sent", "Pending invite", or the new user appears with a pending status.

Step 4: Turn on 2FA for admin-level access

If the new team member will have Admin, Owner, Billing, or production access, require 2FA before they start using the tool.

Typical menu paths:

• Settings → Security → Two-factor authentication
• Admin → Authentication → Require 2FA
• Organization settings → Security → Enforce 2FA for members

Set the literal option to one of these if available:

• "Require 2FA for all members"
• "Require 2FA for admins"
• "Enforce two-step verification"

If the tool only supports user-level setup, ask the new team member to open:

• Profile → Security → Enable 2FA

What you should see when this step succeeds: the security page shows 2FA as required or enabled, or the user status shows "2FA enabled".

Step 5: Share the invite link only through the tool’s email, not chat screenshots or passwords

Tell the new team member to open the invitation email from the tool and create their own password, or sign in with SSO if your company uses it.

Send them this exact message template:

Hi <name>,

I’ve sent your access invites to your work email: <email>.
Please open each invite email and finish setup using your own account.
Do not use anyone else’s login.
If prompted, enable 2FA with your authenticator app.

Reply when you can sign in.

What you should see when this step succeeds: the user accepts the invite and their status changes from Pending to Active, Joined, or Accepted.

Step 6: Remove any shared login that was being used before

If the team previously used a shared account, stop using it now.

In each tool, go to the user or security area and do one of these:

• Settings → Users → [shared account] → Deactivate
• Admin → Members → [shared account] → Remove
• Security → Sessions → Sign out all sessions
• Profile → Password → Reset password

⚠️ If the shared account is connected to automations, integrations, or billing, deactivating it can break them. Before removing it, check whether it owns API keys, webhooks, or subscriptions. If it does, move those to a service account (a non-human account for integrations) or to a named admin account first.

What you should see when this step succeeds: the shared user is removed or disabled, and no one is relying on that password anymore.

Verify it works

Check all three of these end-to-end results.

1. In each tool, the user status is Active, Joined, or Accepted.
2. Ask the new team member to sign in and confirm they can reach only the tools they need.
3. Confirm no shared login remains in use.

Use this checklist:

If your tool has an audit log (activity history), open it here if available:

• Settings → Audit log
• Admin → Activity
• Organization → Security log

You should see entries like "User invited", "Invitation accepted", "Role changed", or "2FA enabled".

Common pitfalls

Inviting their personal email instead of their work email

Mistake: you send the invite to a Gmail or Outlook address they already use.

Symptom: they sign in with the wrong identity, miss SSO, or lose access later when offboarding.

Fix: cancel the invite and re-send it to their work email only.

Giving Owner/Admin when Member/Viewer would do

Mistake: you choose the highest role because it is faster.

Symptom: the new person can change billing, delete projects, or edit production settings they do not need.

Fix: edit their role to the lowest level that matches the Step 1 access list.

Forgetting app assignment in the identity provider

Mistake: you create the user in Microsoft Entra ID, Google Workspace, or Okta but do not assign the app.

Symptom: the user can sign in to SSO but gets "You do not have access" in the tool.

Fix: go back to the app assignment page and assign the user or their group to that app.

Leaving the invite pending and assuming it is done

Mistake: you send the invite and move on.

Symptom: the user says they still cannot access the tool, and the dashboard shows Pending.

Fix: ask them to open the invite email, check spam, or use the tool’s "Resend invite" button.

Disabling a shared account before moving integrations

Mistake: you remove the old shared user immediately.

Symptom: automated deploys, webhooks, API calls, or notifications stop working.

Fix: create or use a service account for integrations first, update the keys, then disable the shared user.

Enforcing 2FA after the user is already blocked

Mistake: the tool requires 2FA but the user was not told to set it up.

Symptom: they get stuck in a sign-in loop or see a security prompt they do not understand.

Fix: send them the Step 5 message and ask them to open Profile → Security → Enable 2FA before trying again.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.