File 05 · Business accounts
Securing a brand or business X account shared by a team
Most brand account takeovers start with a shared password that too many people know. X Delegate lets your team post without ever holding the login.
A company X account usually starts with one person and one password. Then an agency needs access, an intern covers weekends, a scheduling tool gets connected and the password ends up in a shared doc. By the time someone clicks a phishing link, nobody knows exactly who has the login.
The fix is to separate posting from owning. A small number of people control the account itself. Everyone else gets access through X's delegation feature or through approved tools, and never learns the password.
Pick an owner and protect the login
Decide who owns the account. This should be a role in the company with a backup person, not whoever happened to create it.
- Email. Register the account to a company address that belongs to a group or role (for example a social@ alias your IT team controls), with its own strong password and two-factor. Don't use a personal Gmail or a former employee's mailbox.
- Password. Generate a long random password and keep it in your company's password manager, shared only with the owner and the backup owner.
- Second factor. Use security keys owned by the company. Enroll at least two, kept by different people or one in a safe. An authenticator app inside the company password manager is a reasonable addition. Avoid SMS, and avoid tying the account to one employee's personal phone number.
- Backup code. Store it in the password manager with restricted access.
- Password reset protect. Turn it on under Settings and privacy > Security and account access > Security.
Our 2FA guide covers the setup.
Give everyone else access with X Delegate
X Delegate lets the account owner invite other X accounts to act on behalf of the brand account. The people you invite use their own logins and their own two-factor; they switch into the brand account from theirs.
X describes two roles:
| Can do | Admin | Contributor |
|---|---|---|
| Post, repost, send DMs, like | Yes | Yes |
| Schedule and delete posts, create lists and collections | Yes | Yes |
| View post analytics | Yes | No |
| Invite and manage other delegates | Yes | No |
| Change password, phone number, login verification | No (owner only) | No (owner only) |
To invite someone, sign in to the brand account on x.com and go to Settings and privacy > Security and account access > X Delegate, then choose Invite a member, enter their username and pick a role. They accept the invite from Delegate on x.com. Delegation works on x.com and X Pro, but you have to set it up on x.com. If an invite fails, the person may have the setting that allows others to delegate to them switched off.
Keep the admin role small. Most people who post only need contributor access.
Make every delegate secure too
Delegation moves the risk to the delegates' own accounts. If a contributor's personal account is phished, the attacker can post as your brand. So set a minimum standard:
- Every delegate account must have two-factor turned on, ideally a security key or passkey.
- Delegates should use a password manager and a unique password for X.
- The machines they post from should be work devices with updates on and a short list of browser extensions. Session-stealing malware on one laptop is enough to reach the brand account.
- Agencies get their own delegate accounts per person, not one shared agency login.
Control third-party tools
Scheduling, listening and analytics platforms connect through X's app authorization. Each one is a door into the account with whatever permissions you granted. Keep a short list of approved tools, connect them from the owner login, and review the connected apps list every quarter. When you stop using a tool, revoke it in X, not just in the tool. The connected apps guide walks through the review.
Offboarding checklist
When someone leaves the team or an agency contract ends, do this the same day:
- Remove them in X Delegate under Members you've delegated to. A password change does not remove delegates.
- If they ever knew the password or had access to the second factor, change the password, generate a new backup code, and remove any authenticator or security key they held.
- Review Sessions and log out anything you don't recognize.
- Remove their access to the scheduling tools and to the company password manager entry.
- Check the email account behind the X account for new forwarding rules.
Prepare for a bad day
Write a one-page plan before you need it: who can lock the account, where the backup codes are, who talks to followers, and how to reach X through the help center if the owner login is lost. Keep a list of your official handles and link to them from your website, which makes it easier for customers to spot impersonators and helps when you ask X to act on one.
If something goes wrong anyway, follow the first-hour plan and include checking the delegate list in step one.
It also helps to agree in advance what happens if a delegate's own account is compromised. The owner removes that delegate first, then checks recent posts and DMs sent from the brand account for anything the team didn't write. Once the person has secured their personal account, add them back.
Quick audit for brand accounts
Once a quarter, the owner should spend fifteen minutes on this:
- Who is in X Delegate, and does each person still need access at that role?
- Which connected apps are authorized, and are they all still in use?
- Which sessions are open, and do you recognize all of them?
- Do the backup code, the security keys and the email login all still work?
Run the homepage security check on the owner login as well. It covers the account-level settings in one pass.
Source: X Help Center, How to use the Delegate feature.
Questions
What can an X Delegate admin do that a contributor can't?
According to X, admins can invite and manage other delegates and see post analytics. Both admins and contributors can post, repost, send DMs, like, schedule and delete posts, and create lists. Neither can change the password, phone number or login verification settings.
Does changing the password remove delegates?
No. X says a password change doesn't remove delegate access, so remove delegates separately when someone leaves.
Should the brand account use the social media manager's personal phone for 2FA?
Avoid it. Use a security key and an authenticator owned by the company, so access doesn't leave with one employee.
TweetAttacks is independent and not affiliated with X Corp. Settings names can change when X updates its apps; if a menu has moved, search its name in X's settings.