Guide · Security · For the owner whose WhatsApp sits in a Meta portfolio
Locking down the Meta business portfolio behind your WhatsApp: Meta's security checklist for the owner
The business portfolio holds the WhatsApp account, the Facebook Page and the ad account, so whoever gets into it can reach all three. Meta's Help Center keeps a checklist for making a portfolio harder to break into. Here it is in plain words, with how to add people safely.
Published 8 October 2026
What Security Center asks you to fix
Meta says a person with full control of the portfolio can open Security Center to see which of these it recommends and track progress on each.
- People who have gone quiet
- Remove anyone who has not logged in to the portfolio in the past 90 days, especially those with full control. Meta says inactive accounts are a common way in.
- Ad accounts nobody uses
- Close or remove ad accounts that have not run ads in the last year. Meta notes ad accounts cannot be deleted from the portfolio, only closed or removed.
- People without two-factor sign-in
- Remove anyone without passkeys or two-factor authentication until they set it up. Meta describes passkeys as simpler and more secure than passwords and one-time codes.
- Personal email addresses
- Remove users whose email address is not related to the business, because anyone can get an address on a public email service.
- Too many people with full control
- Limit full control to those who need it, ideally 10 or fewer.
- Ads published by one person alone
- Turn on peer approval, so a trusted second person must review an ad before it is published.
- Devices with possible malware
- Remove people Meta detects may have malicious software on one of their devices.
- Shared credit lines
- Check which businesses your credit lines are shared with and remove any with suspicious activity.
Habits Meta adds
- Two-factor that does not lock you out. Use an authenticator app and back it up, set up more than one method and save the recovery codes, and update the phone number on your Facebook account when you change numbers.
- Two people with full control. Meta recommends, but does not require, two active people with full control. A second approval is then needed for sensitive actions, such as sharing a credit line or changing another full-control person's access, and someone can still get in if one account is compromised.
- An access audit. People with full control can export a file of everyone's permissions from People in Meta Business Suite's Settings, showing when each was last active and whether two-factor is on. Meta notes that people who have been invited but not yet accepted are not in it.
- The business history. A downloadable file of important events in the portfolio, such as changes to its details, assets and people, from People or Business info in Settings.
- Reporting. If you see suspicious or unauthorised activity, Meta says to contact its support team.
Where each of these lives in Meta Business Suite, from Meta's own step-by-step articles:
- Removing someone
- Settings, then People, then the person's name, then Remove. Meta says this takes away their access to the portfolio and to every asset they could reach, such as the Page, Instagram account and ad account. If another full-control person must approve it, they do so under Requests.
- The permissions file and the history
- Settings, then the People tab, then Export: choose People and permissions, or Business history with a date range, then create and download the file. Meta notes the two-factor column only fills in once the two-factor requirement is switched on in Security Center.
- Peer approval for ads
- Settings, then Security Center, then Peer approval, then Manage next to Ad account security. Default protection asks for approval only on suspicious ads; Extra protection on every ad, which Meta recommends when others advertise for the business or people have temporary access; Custom protection on ads above a budget you choose. Ads published by people with full control skip the review, and anyone inactive on the ad account for 90 days or more cannot approve.
- Passkeys
- A passkey replaces the password and codes with the phone's fingerprint, face scan or screen lock. Meta says it may be required for portfolios that advertise, use monthly invoicing or credit lines, pass certain spend or reach levels, or are in Advanced Protection, and that it may later remove text and email codes. Passkeys do not yet work in the Meta Business Suite or Ads Manager mobile apps.
Adding someone without opening a door
- Start from People. Only someone with full control can add people. In Meta Business Suite, open Settings, then People, then Invite people. If People is missing, you probably do not have full control.
- Use the right email. For someone joining with a Facebook account, the email must match the one on that account.
- Give the least access that works. Choose their portfolio permissions first, then the assets they may work on. Meta says people get basic access by default, and advises giving only the access the job needs.
- Wait for them to accept. The person must accept the invitation, and Meta says some features can take a few days to appear.
Meta also points out what everyone with full control can see: each member's name, work email and assigned assets. And when another business, such as an agency, shares an asset with you, you can only pass on the permissions it gave you. If an invitation will not go through, Meta suggests confirming your own email under Business info, checking that neither account is disabled or restricted, and looking under Requests if another full-control person must approve it.
Our reading: the people list is the WhatsApp's front door
Questions
What happens when we remove someone from our business portfolio?
Meta says removing a person takes away their access to the portfolio and to every asset they could reach, such as the Facebook Page, Instagram account and ad account. It is done from People in Meta Business Suite's Settings by someone with full control.
How many people should have full control of our business portfolio?
Meta recommends at least two active people, though it is not required, and ideally no more than 10. Two allows a second approval on sensitive actions and keeps access if one account is compromised.
Should we remove staff who have not logged in for a while?
Meta's checklist says to remove people who have not logged in to the portfolio in the past 90 days, especially those with full control, because inactive accounts are a common target.
How can we see who has access to our portfolio?
People with full control can export a permissions file from People in Meta Business Suite's Settings, showing each person's last activity and whether two-factor is on. Pending invitations are not included.
Can we delete an old ad account from the portfolio?
No. Meta says ad accounts cannot be deleted from a portfolio; close or remove the ones you no longer need, especially any that have not run ads in the last year.
Why can't we give a staff member full control of a Page an agency shared with us?
Meta says that when another business shares an asset with you, you are limited to the permissions it assigned, which may stop you giving anyone full control of that asset.
Sources
- Meta Business Help Center: Best practices for making a business portfolio more secure, read 8 October 2026.
- Meta Business Help Center: Add people to a business portfolio and assign a business asset, read 8 October 2026.
- Meta Business Help Center: Remove people from your business portfolio in Meta Business Suite, read 8 October 2026.
- Meta Business Help Center: Add another review of your ads with peer approval, read 8 October 2026.
- Meta Business Help Center: Download people permissions and business history, read 8 October 2026.
- Meta Business Help Center: About passkey setup for your business portfolio, read 8 October 2026.
More plain-language notes like this one are on the guides page.
Tidying up who can reach your WhatsApp?
We set up a business's WhatsApp number on a system its team runs, so every customer conversation sits in one place the business owns. A short call is the easiest way to see how that would work for you.
Book a demo