Facebook Page access explained — who should hold what on a student-run page

Short answer. Give full control of the Facebook Page to two or three people — never one, and never everyone — and give everybody else task access limited to what they do. Full control is the only level that can add or remove people, or delete the page.

Almost every story of a community page being lost comes down to access. One person created the page, one person held the only login that mattered, and then that person graduated, lost their phone, was locked out of their account, or fell out with the rest of the team. Nothing about the page's content went wrong. The permissions did.

Facebook's access model is not complicated, but its labels have changed over the years and the settings are several screens deep. This guide explains the current model in plain terms and suggests how a volunteer team should use it. Meta renames things from time to time, so treat the exact labels as a guide and check Settings → Page setup → Page access on your own page.

The two kinds of access

Facebook separates the people who help run a page into two groups.

People with Facebook access can switch into the page and act as it directly on Facebook — post, reply, comment and change settings from inside the page itself. Within this group there are two levels:

• Full control — everything, including giving and removing other people's access, removing the person who created the page, and deleting the page.
• Partial control — the day-to-day work (content, messages, comments, ads, insights) without the power to manage access or delete the page.

People with task access cannot switch into the page. They work on it from Meta's other tools, such as Meta Business Suite, and only on the tasks you have ticked for them.

What each task covers

Task access is granted one area at a time:

A person with only the Insights task can look at the numbers and do nothing else. A person with Content and Community activity can publish and moderate comments but cannot read the inbox. That granularity is the point: give each person what their job needs and no more.

Why "full control" needs to be rare — but never single

Full control is the only level that can remove other people or delete the page. Two rules follow.

Never have exactly one person with full control. If their personal account is disabled, hacked or simply abandoned, nobody else can add a replacement. Recovery through Meta's support channels is slow and uncertain for small pages. Two people is the minimum; three is comfortable.

Never hand full control to everyone. Anyone with full control can remove everyone else. On a volunteer team, where membership changes and disagreements happen, that is a risk you take on with every extra person.

The people who hold full control should be the ones least likely to disappear and least likely to act on impulse — typically the two or three who run the team — and, if your page is attached to a club or society, a long-term figure such as a staff advisor if one is willing.

A sensible split for a team of five

If you publish through a third-party scheduling or submission tool, the person who connects it will be asked to grant that tool permissions over the page. Do this from an account with full control, read the permission list rather than tapping through it, and note down which account made the connection — if that person later leaves and their access is removed, the connection can break with them.

Instagram is a separate problem

An Instagram account has a single username and password. There are no per-person permission levels in the consumer app, so teams tend to share the password in a group chat — which means it is known to everyone who has ever been in the chat.

You can reduce the damage:

• Link the Instagram account to the Facebook Page. People with the right access to the page can then manage Instagram content and messages through Meta Business Suite without ever knowing the Instagram password.
• Register the Instagram account to an email address the team controls collectively, not a personal inbox.
• Turn on two-factor authentication with an authenticator app, and keep the backup codes with the two people who have full control of the page.
• Change the password whenever someone leaves the team. Put it on the leaving checklist so it is not forgotten.

Protect the personal accounts behind the page

A page is only as secure as the weakest personal account with full control over it. An attacker who gets into one admin's Facebook profile gets the page along with it. Every person with full control should have:

• two-factor authentication on their personal account, using an authenticator app;
• a current email address and phone number on the account, so they can recover it;
• login alerts switched on;
• the habit of never entering their password on a page reached from a link in a message — the "your page will be unpublished for a violation, click to appeal" message is the most common way pages are stolen.

That last scam deserves emphasis. Meta does not send policy notices as direct messages from accounts with names like "Page Support Team". Real notices appear in the page's own notifications and in Page Quality or Account Status in the page's settings. If in doubt, open Facebook yourself and look there; never follow the link.

Reviewing access

Open the Page access screen once a term and read every name on it. Ask of each: is this person still on the team, and do they still need this level? People who have left should be removed the same week they leave, however amicable the departure. Access that lingers "just in case" is how a page ends up with a dozen former admins, any of whom could act as it.

When the people at the top change, do it in the right order: add the new person with full control first, confirm they can see the access screen, and only then remove the outgoing one. Our handover guide covers the rest.

Common questions

What is the difference between full control and partial control of a Facebook Page?

Both let a person switch into the page and act as it on Facebook. Full control covers everything, including giving and removing other people's access and deleting the page. Partial control covers the day-to-day work — content, messages, comments, ads and insights — without the power to manage access or delete the page.

What is task access on a Facebook Page?

Task access is for people who do not switch into the page. They work on it from Meta's other tools, such as Meta Business Suite, and only on the tasks ticked for them: Content, Messages, Community activity, Ads or Insights.

How many people should have full control of a Page?

At least two and at most three. With only one, nobody can add a replacement if that person's account is disabled, hacked or abandoned. With everyone, any one person can remove all the others.

How can a team share an Instagram account safely?

Link the Instagram account to the Facebook Page, so that people with the right page access can manage Instagram through Meta Business Suite without knowing its password. Register it to an email address the team controls together, turn on two-factor authentication with an authenticator app, and change the password whenever someone leaves.

Is the "your page will be unpublished" message real?

Treat it as a scam. Meta does not send policy notices as direct messages from accounts with names like "Page Support Team". Real notices appear in the page's own notifications and under Page Quality or Account Status in its settings. Open Facebook yourself and look there; never follow the link.

A short checklist

• At least two, at most three, people with full control
• Everyone else on task access limited to what they do
• Two-factor authentication on every personal account with full control
• Instagram linked to the page, registered to a shared team email, backup codes stored
• A note of which account connected each third-party tool
• Access reviewed every term; leavers removed the week they leave