Social account migration: keep control across every platform

The handover can look complete while access stays behind

Imagine a handover: the new agency has the content calendar, the merged brand has approved its identity and the regional team has announced the launch. Then someone discovers that the outgoing agency still controls an ad account, a former employee is the only owner of a YouTube channel, and nobody can say which business owns the campaign's Instagram account. The public change happened; the account migration did not.

This is why a migration across Facebook, Instagram, TikTok, YouTube, LinkedIn and X is more than changing profile pictures and handles. It is a transfer of operational control: the people, businesses, roles and recovery routes behind every account. A single-account Instagram move needs its own plan; an enterprise-wide move also has to reconcile business managers, ad accounts, connected assets and agencies across platforms.

What are you actually moving?

Make one register for the estate before deciding what moves. For each official profile or Page, record its handle and URL, the business or Brand Account that controls it, named owners, people and partners with access, linked ad accounts and assets, recovery details, and the decision: retain, rename, transfer where supported, retire or investigate. Include dormant regional and campaign accounts. An unknown handle is a question to resolve, not automatically an asset you own.

• Identity and audience: profile names, handles, biographies, links, followers and content plans. A handle change is not the same thing as transferring account ownership; do not assume audiences or account histories can be merged.
• Business control: Meta business portfolios for Facebook Pages and Instagram accounts, TikTok Business Centers, YouTube Brand Accounts, LinkedIn Pages and the owning identities behind X accounts.
• Commercial assets: ad accounts, payment and billing responsibility, pixels or datasets, catalogues, audiences and linked tools. Check the owner and permissions for each asset separately.
• People and recovery: employees, agencies, delegated users, personal sign-ins, backup owners, MFA and recovery routes. Record who can act now and who should be able to act after cutover.

What can a former employee or agency still do?

It depends on the exact permission they retained. A directory account being disabled does not, by itself, prove that a platform role or a separate personal sign-in has been removed. Nor does every analyst or contributor have owner-level powers. Review the live role and the asset it reaches rather than treating every remaining name as the same risk.

• Meta (Facebook and Instagram): Facebook Page access with full control can manage settings and other people's access, and can delete the Page. Task access is narrower; the permissions of a Page inside a business portfolio may differ. Check the Page, its business assets and the Instagram account separately. Meta's Page-access guide.
• TikTok: Business Center permissions are set at both member and asset level. TikTok says an ad-account Operator can create and edit ads but cannot manage ad-account settings; an Analyst can view reports but not create ads. A separate TikTok-account role may permit content or user-management actions. TikTok's asset-permission matrix and TikTok-account roles.
• YouTube: channel permissions distinguish owners, managers, editors and viewers. A Manager can publish and manage permissions but cannot delete the channel; an Editor can publish but cannot manage permissions; a channel Owner can delete it. If you must change a Brand Account's primary owner, Google requires the incoming person to have been an owner for at least seven days. YouTube channel permissions and Brand Account ownership.
• LinkedIn: a Page Content Admin can publish as the Page, while a Super Admin can also manage admins and deactivate the Page; an Analyst is limited to analytics. Paid-media roles and Campaign Manager access are separate checks. LinkedIn's Page-role matrix.
• X: a Delegate Contributor can post and delete posts, while a Delegate Admin can also invite and remove delegates. Only the owner manages the account password and login-verification settings. X says changing the owner's password does not remove delegates, so review the delegate list directly. X's Delegate guide.

The practical exposure is not just a hostile takeover. A well-meaning former agency might publish an outdated campaign, change a destination link or spend against the wrong account. A leaver with an over-privileged role might be able to alter ownership or remove the incoming team. What is possible depends on the role, the connected asset and the platform's current rules. Shared credentials and recovery methods need their own review because role lists will not reveal every way in.

A staged migration that keeps the brand in control

1. Discover and assign an owner

Bring marketing, IT, legal and the current agency around the same register. Reconcile known business managers with regional, campaign and acquired-brand accounts. Name a decision-maker for every unresolved asset. Confirm which organisation controls the account in the platform, not simply who has its password or appears on a handover spreadsheet.

2. Map authority and plan the cutover

List every current user, partner and role against the work they still need to do. Separate publishing, paid media, financial and owner permissions. Decide which accounts stay under the original business, which can be transferred through the platform, and which need a new account or an official support route. Check waiting periods early: Google's seven-day Brand Account owner rule is one example, not a timetable for every platform.

3. Grant and test incoming access

Where the platform permits it, give the receiving business or named people the minimum roles they need before removing the outgoing team. Test publishing, moderation, paid-media access, billing visibility and recovery with the new owner. Keep a second trusted owner where the platform supports one. For a suspected compromise, contain access immediately under the incident plan rather than waiting for a routine handover sequence.

4. Change the public face, then retire old access

Coordinate handle, bio, link and creative changes with the announcement. Check scheduled posts, live campaigns, tracking and destination URLs. Once the new team has verified control, remove or narrow former employee and agency roles, revoke partner access where appropriate, review sessions and recovery methods, and rotate any shared credentials. A password change alone may leave delegated access intact on X.

5. Recheck the native platforms

Capture the post-cutover owner, business association, permissions and linked assets from the platform itself. Compare that state with the approved plan, assign remaining exceptions, and recheck after the next agency or personnel change. Keep the evidence and the date of verification; a signed handover document is not proof that a role was revoked.

Where Pulse fits

Pulse gives the migration team a connected view of the social estate it can observe: business accounts, assets, users and platform roles. It compares collected access with connected directory and HR context to surface leavers, dormant or over-privileged users, and unclear ownership. Its risk report ranks findings by severity and gives the platform owner a place to start. That makes the before-and-after review more repeatable than a spreadsheet built for one cutover.

Pulse does not make a native transfer eligible, move an audience, or automatically remove every permission. Someone with the right platform authority still has to make and verify the change. For a repeatable cutover plan, see the social account migration solution; for the discovery of accounts outside your current inventory, see an estate no one has mapped.