A creative agency access and device handover checklist should make every client file, shared account and work device traceable to a named owner. It should also let the agency add a freelancer quickly, change a staff member’s access without guesswork, and remove access cleanly when a project or employment relationship ends.
This guide is for Singapore creative, design, video and digital teams. It focuses on operational control, not legal advice or a promise that one checklist will prevent every incident.
Why do creative teams lose control of access?
Agency work is deliberately collaborative. Designers move between accounts, editors pull large source files to local storage, freelancers join for a short production window, and client approvals arrive through several platforms. The same flexibility that keeps work moving can leave behind old links, dormant guest accounts, shared passwords and devices that nobody quite owns.
The practical goal is not to lock every folder. It is to give each person the access needed for current work, keep ownership with the agency, and remove temporary access when its purpose ends.
1. Start with a project access register
Keep a small register for active client projects. It can sit in your approved service-management, project-management or Microsoft 365 environment. For each project, record:
- the account or project owner;
- the approved location for working files and final deliverables;
- the internal team, external collaborators and client contacts with access;
- the systems used for storage, messaging, review, publishing and credentials;
- the date temporary access should be reviewed;
- the person responsible for closing the workspace.
Do not copy passwords or sensitive client material into the register. Its job is to show ownership and access paths, not become another secret store.
2. Give each person an individual account
Shared logins make it difficult to tell who changed a file, approved a campaign or removed an asset. Use individual accounts wherever the platform supports them. Grant access through groups or project roles rather than sending one password around a chat thread.
If a platform does not support separate accounts, record that limitation. Put the credential in an approved password manager, restrict who can retrieve it, enable multi-factor authentication where available, and define who changes the password after a collaborator leaves. Treat this as a managed exception, not the normal way of working.
3. Keep business ownership separate from personal identity
Client folders, design libraries, ad accounts, code repositories and publishing channels should remain under an agency-controlled tenant or business account. A staff member may administer them, but the company should not depend on that person’s personal email address, phone number or private cloud storage to recover access.
For every important platform, identify:
- the business owner who decides who should have access;
- at least one controlled administrative recovery path;
- the approved billing and renewal contact;
- where recovery codes and domain ownership records are kept;
- the support route if the normal administrator is unavailable.
4. Approve the device before client work begins
A laptop used for client work should have an assigned user, current operating-system support, disk encryption, endpoint protection, patch ownership and a recovery method. The agency should know whether the device is company-owned, personally owned under an approved arrangement, or supplied by a client.
Do not wait until the first urgent edit to decide whether a freelancer can download source footage to a personal device. Set the rule before access is granted. If personal devices are allowed for a particular engagement, define the permitted data, storage location, security controls, support boundary and removal evidence when work ends.
5. Use a standard project onboarding request
The project owner should request access with enough information for someone else to act correctly. A practical request includes the person’s identity, role, project, start and end dates, required applications, required folders, device arrangement, approver and any client-specific restriction.
Separate “can view”, “can edit”, “can publish” and “can administer”. A designer who needs brand files may not need to manage the client’s domain. An account executive who approves copy may not need to download raw video footage. Start narrow and add access when the work requires it.
6. Make freelancer access expire
Temporary access becomes permanent when no one owns the end date. Put a review date on guest accounts, shared links, VPN access, project folders and third-party tools. Where a platform supports automatic expiry, use it. Where it does not, create a dated removal task with an owner.
Extending access should be an explicit decision. The project owner should confirm the new purpose and end date rather than allowing an old invitation to remain indefinitely.
7. Control local copies and project exports
Large creative files often leave the shared workspace for rendering, review or transfer. Agree where local working copies may be stored, how they are named, which copy is authoritative and when they should be removed. Staff should not have to guess whether “final-v7-new” on a laptop is newer than the approved master.
For client transfers, use an approved business channel. Check the recipient, selected folder and permission before sending a link. Avoid public links with no expiry where a named guest account or time-limited link is suitable. Record unusual transfer methods as exceptions that need follow-up.
8. Treat device handover as a controlled change
When a laptop moves from one employee to another, do not simply rename the old profile. Record the return, preserve approved business files, remove the former user’s access, rebuild or reset the device through the agency’s standard process, apply current security settings, and verify the new user’s role-based access.
Check locally installed fonts, plug-ins, creative applications and licence assignments. A successful sign-in does not prove the new user can open the required project file or that the old user’s browser sessions have gone.
9. Run a complete leaver or project-close process
Account disablement is only one step. A close process should cover:
- Microsoft 365 or other primary identity access;
- active browser, mobile and application sessions;
- shared folders, guest accounts and project links;
- client platforms, publishing tools and code repositories;
- password-manager collections and shared credentials;
- company devices, removable storage and accessories;
- business-owned files, email and project ownership;
- licences that should be reassigned or retired;
- temporary client or vendor access created during the project.
Do not ask a colleague to keep using the departing person’s password. Transfer business ownership through the platform’s supported process and keep an evidence record of the changes made.
10. Review the exceptions, not every file
A useful monthly review looks for conditions that need action:
- guest accounts with no current project owner;
- links whose review date has passed;
- administrator access that does not match a current role;
- devices with no assigned user or patch owner;
- project files stored only on one laptop;
- former staff still listed in client platforms;
- shared credentials that were not rotated after a team change.
Assign each exception to a person and record closure. A spreadsheet of findings is not useful if nobody has to resolve them.
A practical creative agency access checklist
- Every client project has an owner, approved file location and close date.
- People use individual accounts where supported.
- Business platforms have agency-controlled ownership and recovery.
- Devices are inventoried, encrypted, protected and assigned.
- Project access states the role, approver and expiry date.
- Local copies and external transfers follow an agreed process.
- Device handover includes reset, configuration and functional checks.
- Leaver closure covers sessions, links, licences, devices and ownership.
- Monthly exception reviews have named follow-up owners.
When should an agency use managed IT support?
Outside support is useful when onboarding depends on one senior designer, devices have inconsistent configurations, freelancers are added directly by project staff, or nobody can produce a current list of administrators and shared links. The provider should turn those informal habits into a documented service process and help operate it consistently.
Speak with Sakal Network about managed IT support for a creative team if access, endpoint setup and staff handovers are consuming production time. For an example of a business productivity and device-management option, review Microsoft 365 Business Premium on Sakal Shop; suitability and configuration depend on your environment.