Ending a relationship with a marketing agency or team member is one of the moments when account security matters most. If you don't properly remove their access, they can still post on your accounts, run ads with your money, or export your data for months or years after the relationship ends.
Here's exactly how to remove access from your social media accounts cleanly and completely.
Why This Matters
Incomplete offboarding is one of the most common security mistakes restaurants make. It happens because nobody thinks about it until something goes wrong.
The risks of leaving old access in place are real. A disgruntled former employee might post something damaging. An old agency might accidentally run campaigns that charge your account. A former freelancer might retain access to customer data. Even well intentioned people create confusion when they still have access to accounts they shouldn't be managing.
Proper removal takes about thirty minutes and prevents all of these problems. It's always worth doing immediately.
Step One: Make a List Before You Start
Before you start removing access anywhere, list every account and asset the person had access to. This prevents missing something important.
Common assets to check include your Facebook page, your Instagram account, your Facebook ad account, your Instagram ad setup if separate, your Meta Business Manager, your Google Business Profile, your TikTok account, any content tools or schedulers, your website backend if they had access, your Google Analytics, your reservation platform admin panel, and any email marketing tools.
Don't skip any. One missed tool can become the security gap that causes problems later.
Step Two: Start With Meta Business Manager
If you're using Meta Business Manager to manage Facebook and Instagram permissions, this is your main control panel for most removals.
Log into business.facebook.com. Go to business settings. In the left menu, click users, then people.
Find the person you're removing. Click their name to see all their assignments.
You'll see a list of every page, ad account, Instagram account, and other asset they have access to. You can remove their access to each individual asset or remove them from your Business Manager entirely.
For a clean offboarding, remove them completely from your Business Manager. This revokes access to everything at once. Click the remove button and confirm.
Step Three: Verify Page and Instagram Access Is Gone
After removing someone from Business Manager, double check that they no longer have direct access to your Facebook page or Instagram account.
Go to your Facebook page settings. Click page roles. Make sure their name isn't on the list. If it is, remove them directly from the page.
For Instagram, check the account access through Business Manager's Instagram section. If you don't use Business Manager for Instagram, check Instagram directly by going to settings, security, and looking at the third party apps with access. Remove anything associated with the former user.
Step Four: Remove Ad Account Access
Ad account access is managed separately from page access in Business Manager.
In business settings, go to ad accounts. Click on the specific ad account the person had access to. Click the people tab.
Find them in the list and remove them. Repeat for every ad account they had access to.
After removal, check your ad account's user list to make sure nothing is left. Also check your payment methods to ensure they haven't been changed recently.
Step Five: Pause Active Campaigns if Appropriate
When ending an agency relationship, you probably want to pause any campaigns they were running before fully cutting access. This gives you time to assess what's running and decide what to continue or stop.
Go to Meta Ads Manager. Review active campaigns. Pause anything you're not sure about. Once you understand what's running and what you want to keep, you can make informed decisions about each campaign.
Don't delete campaigns immediately unless you're sure. Paused campaigns preserve your data and can be resumed if needed.
Step Six: Remove Access to TikTok
TikTok's access management is less sophisticated than Meta's. If you've been sharing the account directly, you'll need to change the password and reconfigure two factor authentication.
Log into your TikTok business account. Go to settings, account, and change password. Create a new strong password. Save it in your password manager.
Review any third party integrations or connected apps. Remove anything you don't recognize or that was connected by the former user or agency.
If you were using Business Manager to manage TikTok access, remove the user from there as well.
Step Seven: Handle Google Business Profile
Google Business Profile uses its own permission system separate from Meta.
Go to business.google.com and sign in. Select your business. Click users from the menu.
Find the person you're removing. Click their name and select remove. Confirm.
Google might ask you to verify your ownership during this process. Follow the prompts. Once removed, they immediately lose access to your profile.
Step Eight: Check Content Tools and Schedulers
Any content tool or scheduler you've been using needs to be reviewed.
Log into each tool. Look at the user management or team section. Remove the former user from the tool's team if they had an account there.
If the tool was connecting to your social accounts on behalf of the user, make sure their connection is disabled. Most tools let you disconnect specific integrations individually.
Also review what the tool has access to. If you're unsure about any tool, it might be worth disconnecting it entirely and reconnecting later if you want to keep using it.
Step Nine: Review Third Party App Access
Both Facebook and Instagram let third party apps connect to your accounts. Over time, these connections accumulate, and former agencies or tools can retain access long after you think they're gone.
On Facebook, go to settings, security and login, and look for apps and websites. Review the list. Remove anything you don't currently use.
On Instagram, go to settings, security, and apps and websites. Review the active connections. Remove any that aren't clearly current and in use.
This is one of the most commonly overlooked steps and the source of many forgotten access problems.
Step Ten: Change Shared Passwords
If any accounts had shared passwords rather than proper role based access, change them immediately. This applies to any account where you know or suspect the former user had login credentials.
Create strong new passwords. Store them in a password manager. Enable two factor authentication if you haven't already. Update anyone who legitimately needs the new credentials.
This step is disruptive but necessary. Don't skip it if shared passwords were in use.
Step Eleven: Verify Billing and Payment Methods
After removing access, verify your payment methods haven't been changed and that no suspicious charges are appearing.
Check your ad account billing settings. Confirm the payment method is your own and hasn't been modified. Review recent charges for anything unusual.
Also check your subscription tools and services connected to your social media. Make sure no payment methods were changed and no new subscriptions were added.
Step Twelve: Document the Removal
Keep a record of what you removed and when. A simple note or entry in your permissions spreadsheet is enough.
This documentation protects you if questions come up later and helps you track your account security over time. It's a small habit that pays off when you need to prove what happened and when.
Common Mistakes
Several mistakes come up repeatedly when removing access.
Forgetting about ad accounts. People focus on pages and forget that ad access is separate and potentially more dangerous.
Missing content tools. Third party integrations often retain access after Meta access is revoked.
Leaving old admin roles in place. Sometimes people check the obvious access and miss secondary admin roles.
Not changing shared passwords. If passwords were shared, revoking role based access isn't enough.
Skipping two factor authentication review. Verify that any backup codes or authenticator apps connected to your account are still yours.
Not checking third party apps. These are the most commonly overlooked sources of retained access.
What to Do if You're Not Sure
If you're uncertain about anything during the removal process, err on the side of caution. Remove access even if you're not sure it's necessary. Change passwords even if you think they might still be secure. Disconnect third party tools even if you might want to reconnect them later.
You can always restore access to trusted partners or reconnect tools you need. You can't easily recover from a security incident caused by incomplete removal.
The Protective Habit
The best protection isn't perfect offboarding, it's a culture of good permission management from the start. If you followed best practices when granting access, revoking is straightforward. If you shared passwords and gave broad access, revoking is messy.
For every new person or tool you connect to your accounts, think about how you'll eventually disconnect them. Set them up with the minimum access they need, through proper role based systems whenever possible. This upfront discipline makes offboarding simple when the time comes.
The Final Check
After completing all the steps above, do one final check a week later. Verify that no unexpected activity has occurred on your accounts. Confirm that no unrecognized charges have appeared. Make sure all access changes stuck.
If everything looks clean after a week, the removal was successful. If you notice anything unusual, investigate immediately.
Proper removal of access isn't complicated, but it requires attention. The thirty minutes it takes to do it right are among the most valuable thirty minutes you'll spend on your social media security.