One shared login for the whole office feels convenient for exactly one week. Then someone leaves, and you discover you cannot lock them out without locking out everyone — and you never knew who was inside anyway.
Remote access accounts are keys to the office. You would not cut one master key, hand copies to every employee and keep no record — yet that is exactly what a shared VPN login is. This page covers the two halves of account discipline: how accounts are given (one person, one named account, MFA on) and how they are taken back (the same day someone leaves, in a fixed order, with nothing left behind).
A named account gives you three things a shared login never can. Identity: the logs show which person connected, at what time, from which device — priceless on the day something goes missing. Control: you can disable one person's access in a minute without disturbing anyone else. Responsibility: people treat access more carefully when it carries their own name. Every serious remote-access tool supports individual accounts even on free tiers, so cost is not an excuse for sharing.
A password alone will eventually leak — written on a diary, reused from a hacked site, guessed by a patient attacker. Multi-factor authentication means the login also needs a code from the person's phone app, so a stolen password by itself opens nothing. Turn MFA on for the admin account the day the network is created, and make it a condition of access for every member: no MFA enrolled, no invite accepted. It takes each person five minutes, once.
Modern mesh VPNs show every device signed in under each account. Review it monthly: a phone that was replaced, a laptop that was sold, a test machine from six months ago — remove devices that are no longer in that person's hands. A forgotten device signed in under a valid account is a door nobody is watching. This two-minute review catches more real risk than most paid security tools.
Do this on the last working day, with HR or the owner informed — not next week when it is remembered. Most small-office data leaks are not hackers; they are ex-employees whose access was simply never switched off.
Sometimes a machine, not a person, needs access — for example a backup server that connects to another branch. That is a service device, and it should still get its own identity in the tool (many tools offer tags or keys for unattended devices), restricted to only the routes it needs. What it should never get is a human's login, and no human should ever borrow its route either. Machines get machine identities; people get named accounts; the twain never share.
The video shows the account and device screens where these settings live.
▶️ Watch Full VideoYes, for one practical reason: you cannot remove one person from it. When anyone leaves, the choice is changing the password for everybody (which rarely happens) or leaving the door open for the person who left (which usually happens). Named accounts make removal a one-minute, one-person job.
Use an authenticator on their computer, a hardware security key, or have them work only from the office until the owner arranges an option. What you should not do is waive MFA for that one person — the exception quietly becomes the way in for an attacker.
No. Keep the admin login for administration only, and give the owner a normal named account for daily remote work. If the daily account is ever compromised, the attacker gets one person's access — not the keys to add new users and approve new routes.