How a Law Firm Gives a Marketing Team Social Media Access

A law firm's social accounts are different from a shoe brand's in one way that matters. The inbox has prospective clients in it.

Someone DMs your Instagram at 11 PM about a charge, an accident, or a divorce. That message is a prospective client telling you about their matter. The duties you owe that person don't stop at the DM. And if the way your marketing team gets into that account is a shared password, a former employee, a former agency, and anyone they ever texted it to can still read that inbox.

So when a firm hires us, the first thing we set up is access, not logins. Here's how it works on each platform, who at the firm should own what, and how to get the inbox right.

Who owns the accounts

The firm does, through a firm-owned email that a partner or the office manager controls. Two things live under that owner: the Meta business portfolio (Facebook Page, Instagram account, ad account, pixel) and the TikTok Business Center.

Not an associate. Not the marketing intern who set up the Instagram three years ago. Not the agency. Everyone else, including us, gets assigned access underneath that owner, so when a person leaves or a vendor changes, the account doesn't leave with them.

If an employee or an old agency currently owns any of this, fix that first. It's the most common thing we find.

Facebook Page: Meta Business Suite

A Page in your business portfolio takes two kinds of access, and the choice depends on who you're adding.

An employee or a freelancer: add them to the portfolio by work email, then assign them to the Page. Meta's own steps: Business Suite, Settings, Pages, select the Page, Assign people, pick the person, choose the access type, Assign. Partial access (business tools only) lets you pick tasks: content, messages, community activity, ads, insights. Give the content team content and community activity. Give messages only to whoever runs intake.

An agency: add its business portfolio as a partner instead of adding its staff one by one. You'll need the agency's business portfolio ID, which they find under Settings, Business portfolio info. In your Settings, go to Partners, give a partner access to your assets, enter the ID, and pick the assets and permission levels. When the engagement ends, remove the partner once and every one of their people is out. Meta's page on adding partners covers it.

Full access on the Page belongs to the firm's owner account and nobody else.

Instagram: shared access, and the inbox decision

Instagram's shared access feature, run from the app, lets you invite someone without a password. Meta's description: invitees "can post, like and comment (and, from a professional account, run ads and view insights) all without sharing your password," and they can't change the password or remove you.

Profile, menu in the top right, Shared access, Invite people, pick the account, send. They have seven days to accept. You can review everything they did under Account activity and remove them from the same screen.

The part that matters for a firm is under Manage. Inbox access and Story access are off by default, per person. Leave inbox access off for the content team. Turn it on for the one person who answers prospective clients, and treat that person's DM replies the way you treat the phone: same questions, same speed, same record in the CRM. A DM that waits two days is a prospective client who hired somebody else. Here's why that matters.

If an agency runs your ads, use the portfolio route instead: connect the professional Instagram account to the business portfolio and assign the partner there, because ads need the Page, the Instagram account, and the ad account together.

TikTok: Business Center and a QR code

TikTok handles access through TikTok Business Center rather than in the app. A Business Center asks for your account, someone logged into the firm's TikTok approves it by scanning a QR code, and the Business Center admin assigns people from there.

TikTok's steps, done by the Business Center admin: Accounts, TikTok accounts, Add a TikTok account, Link an existing TikTok account, Send a QR code, choose Manage account as the permission level, and under Publish and manage new videos choose Show on TikTok profile and in ads if they'll post to the profile. Copy the QR code and send it to whoever holds the firm's TikTok login. In the app: Profile, the three lines, Your QR code, the scan icon, scan, approve. A personal account gets prompted to switch to a business account.

Then the admin assigns members under Accounts, TikTok accounts, View, the Members tab.

To take it back: in the TikTok app, Settings and privacy, Security and permissions, Apps and services permissions, TikTok Business Center, Remove Access. That switch stays with the firm no matter whose Business Center did the linking.

What to grant, by role

When someone leaves

The same day, not the next week:

1. Remove the person or the partner on each platform.
2. Change the firm's own passwords and confirm two-factor is on.
3. Check connected apps (scheduling tools, link-in-bio tools) and disconnect anything set up on the departed person's login.
4. Confirm the business portfolio and the Business Center still sit on the firm-owned email.

We run social for law firms, and access is set up this way on day one, with the inbox routed to whoever answers your intake. If your accounts are currently owned by the wrong person, tell us about your firm and we'll untangle it before we post anything.