How to Audit Who Has Access to Your Facebook Page
A repeatable way to see exactly who can touch your Page and ad account — every person, partner, and system user — and remove anyone who should not still be there.
Access piles up quietly. Meta never reminds you that a freelancer from last year still has Page access, or that an old agency is still a partner, or that a system user token created for a one-off integration is still live. A periodic audit across all the places access lives — Page access, Business Portfolio people, partners, and system users — is the only way to keep that list honest.
The principle: scheduled, scoped, recorded
Audits work when they are a habit, not a panic.
- Principle 1
Cover every layer
Page access and Business Portfolio people are the obvious ones. Partners and system users are the ones people forget — and the ones that cause the most damage.
- Principle 2
Least privilege on every pass
Do not just remove the obviously wrong; downgrade anyone who has more access than their job needs.
- Principle 3
Record the result
Write down who has what and a next review date, so the next audit is a quick diff rather than a fresh investigation.
Review cadence: Quarterly, plus immediately whenever a person or agency relationship ends.
Run the access audit
What audits usually miss
Only checking Page access
The Page settings show people, but partners and system users live in Business Settings. An audit that stops at the Page leaves the riskiest access untouched.
Already happened: Find old partners and system users
Forgetting system user tokens
A system user token keeps working long after the person who set it up has gone — it does not expire on its own. Removing a person does not revoke the token they created.
Why it happens: System user tokens are long-lived and decoupled from any individual's employment.
Delvia
Access issues are easier to prevent when roles, owners, and responsibilities are recorded clearly
Most access problems trace back to the same gap — no clear record of who has access, what role they hold, and what should happen when that changes. Delvia helps you keep that record so problems are visible before they become incidents.