Best practices for making a business portfolio more secure in Business Manager

There are many ways to help make your business portfolios more secure in Meta Business Manager. Some security features only need to be set up once, while others should be used regularly. Try the following suggestions to help protect your business portfolios in Business Manager:

• View and manage inactive and active people: People with full control of the business portfolio can see who has access to work on your business assets and what permissions they have by going to the People tab, located under Users in Business settings. You’ll also be able to audit which people are active or inactive, based on people who haven't accessed Meta Business Tools or business integrations within the selected business portfolio in the past 90 days. Learn more about how to change someone’s access to a business portfolio.
• Export people permissions information and business history: People with full control of the business portfolio can download a spreadsheet that shows people’s permissions from the People tab in Business settings. You’ll see information such as what type of access people have to your business portfolio, when they were last active and whether they have two-factor authentication enabled. Note that invited people who have not yet accepted their invitation to join your business portfolio will be excluded from this report. We recommend that you remove inactive people from your business portfolio to ensure that only people you've given permission to have access to your business portfolio. People with full control of the business portfolio can also download a spreadsheet of important events that have occurred in your business portfolio to review at any time. Doing so can help you determine if there has been any unauthorised activity, such as changes in business portfolio details, assets and people. You can download your business history from the People tab or Business info tab in Business settings.
• Only invite people with trusted email domains to join: People with full control of the business portfolio can manage a list of trusted email domains to help make it easier for people to join your business portfolio. For example, if you have hired an agency to do marketing for your business, and you know multiple people from that agency will work on your business portfolio, you can add the agency’s email domain as a trusted email domain in the Security Centre in Business settings. People with full control of the business portfolio have permission to manage the list of trusted email domains, and approval by another person with full control of the business portfolio is required in order to invite someone without a trusted email address to your business portfolio. This can help create an extra layer of security for your business portfolio. Only company-owned email domains should be added to the Trusted emails list. Adding public email domains to the trusted emails list is discouraged.
• Require all people to set up two-factor authentication: If you signed up for a business portfolio in Business Manager less than 90 days ago, people with full control of the business portfolio can require that everyone in the portfolio turn on two-factor authentication. This is another feature that helps to ensure that only authorised people can access your portfolio and assets in business portfolio. Meta may require business portfolios older than 90 days to turn on two-factor authentication for safety and security purposes. Learn more about two-factor authentication and how to require it for people working in that business portfolio in Business Manager.
• Verify your business if eligible: Certain businesses are eligible for business verification status, and not all businesses need to go through this process. This is different from the verified badge on Facebook or Instagram and personal identity confirmation. For businesses that complete this process, it helps us ensure that your business is a legal entity and that you're an authorised representative of your business. It also allows you to access features and products such as certain developer features, News Page Index, WhatsApp Business API and more. Learn more about business verification.
• Make sure that two active people have full control of the business portfolio: We recommend that you have two active people with full control of the account at all times. That way, one person can have access to important, top-level permissions, especially in the event that one of your accounts shows suspicious activity. Additionally, two people with full control are required to manage trusted email domains and review credit line sharing requests for a business portfolio.
• Manage ad link editing permissions: You can edit your ad link editing permissions so that only trusted employees and partners can create and edit an ad that links to your domain. We recommend that you make a list of only the advertisers that you want to have link editing permissions to your domain. Learn more about how to manage your ad link editing permissions.
• Securely share lines of credit with multiple approvals: We recommend that you have two active people with full control of the business portfolio, because you’ll need an additional person to approve requests to share a credit line. This can help protect your business's line of credit from accidental or fraudulent access. Learn more about monthly invoicing line of credit sharing.

You can help protect your business portfolios from being accessed by unauthorised users by taking some steps to incorporate best security practices for Business Manager.

• How to turn on the two-factor authentication requirement in your Business Manager
• About business settings in Business Manager