TeamsMFA

TeamsMFA › Guides › For agencies

Shared 2FA for agencies

Stop scheduling calls to get a 2FA code off a client's phone. Give your team per-person access to the client accounts that only allow one login, and give the client an audit log of every code you used.

Updated November 12, 2026

Short answer: use each platform's agency access wherever it exists, such as Google Ads manager accounts and Meta business partners.3,4 For the client accounts that don't have it, like hosting, DNS, the domain registrar and single-login tools, have the client create a TeamsMFA team, add the 2FA code, and invite your staff. You get the code when you need it. The client keeps ownership, can remove anyone, and sees every code you revealed.

1. The problem

Agencies say the same things in every forum thread about this:

  • A web developer: launches stall because "the client's IT guy had DNS access, his phone number was on the 2FA, but he was off on vacation for a few days." They were "spending more time setting up meetings or calls to log into different services than actually coding."1
  • An account manager at an agency with about 15 clients: "Half our clients email us passwords in plaintext, some send them over Teams."2

Every one of these is a 2FA code stuck on one person's phone, or a secret passed around somewhere nobody can control.

2. Use the platform's agency access first

The big ad platforms are built for agencies, and using their agency access means you don't need the client's login at all:

  • Google Ads: a manager account lets you "use a single sign in to access all client Google Ads accounts."3
  • Meta: a client can give your agency partner access to the assets in their business portfolio.4

Many SaaS tools, hosting control panels and DNS providers also let a client invite you as a user. Ask for that first. It gives you your own login, and the client can see exactly what you did.

3. Where agencies still end up sharing 2FA

  • Domain registrars and DNS on the client's own account, especially smaller providers with one login per customer.
  • Hosting and site admin accounts where the plan includes one user, or the client set it up years ago under their own email.
  • Single-seat tools the client pays for: email platforms, form builders, scheduling and review tools.
  • Your agency's own shared accounts, such as stock libraries or test accounts, that your whole team uses.

If the service supports an authenticator app, switch its 2FA from the client's phone number to an authenticator code stored in TeamsMFA. TeamsMFA doesn't handle codes sent by SMS or email yet.

4. How to set it up

  1. The client creates a team for their accounts, for example "Acme: web accounts", and invites your account lead as a second owner. The client stays an owner, so they keep control.
  2. The client adds each 2FA code. They sign in to the service, add a new authenticator app, and scan its QR code into the team. The secret never leaves TeamsMFA after that. See moving a code into a shared vault.
  3. Invite your staff as viewers. Viewers can reveal codes but can't add codes or manage people. Invitations work by email, even for people who haven't signed up yet.
  4. Reveal a code when you need it. No call, no waiting. Every reveal is logged with who, when and the IP address, and both the client and your account lead can see the log.
  5. Keep the account's recovery codes with the client, outside TeamsMFA.

5. Staff changes and ending a client relationship

  • When someone leaves your agency, an owner removes them from each client team. Their access ends immediately. They never had the secret, so the client doesn't have to re-enroll anything.
  • When the engagement ends, the client removes your agency's people. Their accounts and codes stay exactly where they are, and the audit log shows everything your team revealed while you had access.
  • Hand-offs between agencies become a membership change, not a scramble to find who has the phone.

6. Plans

TeamsMFA is free. The free limits count teams you create (2) and people per team (10). Teams your clients create and invite you to don't count toward your limit, so an agency can work in as many client teams as clients set up. If your agency wants to run every client from its own workspace, with a separate database and encryption key, ask about a dedicated tenant.

Get your next launch off the waiting list

Free for up to 10 people per team, no credit card. Send this page to a client and ask them to create the first team.

Get started free

Sources

  1. r/webdev: How do you manage 2FA/MFA in a team? (May 2024)
  2. r/AskMarketing: How do you share passwords with clients/team members without it becoming a security risk? (May 2026)
  3. Google Ads Help: About Google Ads manager accounts
  4. Meta Business Help Center: Give a partner access to business assets in your business portfolio

Google Ads and Meta are trademarks of their respective owners. TeamsMFA isn't affiliated with or endorsed by either company.