Consolidating Three Brand Accounts After a Merger

Start by separating identity from ownership. Each social account should be connected through a brand-owned admin identity with documented recovery, not through a coordinator's personal profile. Otherwise a departure or password reset can break publishing and audit history.

Map permissions to jobs rather than seniority:

• Org admin: 2 people maximum, for SSO, billing and account connections.
• Content creator: can draft and schedule only the brand accounts assigned.
• Approver: can approve but not alter permissions or connect accounts.
• Responder: Inbox access only for assigned accounts.
• Analyst: read-only reporting access.

The agency gets content-creator access to the two acquired brands only, with no admin, billing or user-management rights. That is least privilege with a practical exception: they can still do bulk upload and scheduling for the work they were hired to do.

Use SSO for employees and named accounts for contractors so the audit trail shows a person, not a shared login. Group users by brand for reporting, but enforce permissions at the social-account level. In the 30-day window, this avoids a risky big-bang restructure: connect and label accounts first, assign pilot users, then migrate the rest before holiday freeze.

A workable sequence:

1. Days 1-2: inventory and ownership. List every profile, URL, current admin, recovery email, phone number and two-factor method. Confirm a business owner for each.
2. Days 3-4: secure the accounts. Move recovery to brand-controlled mailboxes, enable strong 2FA, and remove unexplained admins. Do not connect anything until this is done.
3. Days 5-6: connect and label. Connect accounts in Social OS using brand-owned identities and apply a consistent naming convention, for example NW-Flagship-IG and NW-AcquiredA-FB.
4. Days 7-8: create permission sets and pilot. Onboard two employees and one agency user. Test publishing, approval, Inbox routing and reporting.
5. Days 9-10: migrate in waves and freeze shared logins. Disable shared credentials after each wave, not all at once.

The step I would not skip is confirming business ownership and recovery before connecting. Connecting an account whose recovery sits with a former employee creates a lockout risk that no permission model can fix. It is also the cheapest step to do early and the most expensive to discover late.

I would decline the request and explain the blast radius. Admin rights typically include changing user permissions, connecting or removing social accounts and altering organization settings. A one-week admin grant creates a window in which the agency could accidentally disconnect an account, expose another brand or change audit settings. The risk is not proportional to the upload task.

Instead, I would offer a scoped alternative:

• Content-creator permissions on the two acquired brand accounts only.
• Access to the bulk-upload or content-import function if their role supports it.
• A named internal approver for their scheduled posts.
• A shared naming convention and a 24-hour approval cut-off so their uploads do not sit unpublished.

If a technical limitation truly requires temporary elevation, I would make it time-bound, approved in writing by the account owner, limited to the specific accounts, and logged. I would also review activity afterward. The principle is simple: grant the smallest permission that completes the task, and make the exception visible.