Before your first Meta ad exists, you set up three things in this order: a business portfolio as the roof, the Facebook page and Instagram account the ad appears under, and the ad account that pays for it. Ahead of all that sits one step that takes under two minutes: two-factor authentication on the personal account you build it all from. You create the business portfolio at business.facebook.com, it is what many people still call Business Manager, and according to Meta's help centre, as of September 2026, you can personally create up to two of them. A business asset can only be assigned to one business portfolio, so an ad account always sits in exactly one. Meta's help centre carries one sentence you want to have read before the first click: an ad account created there is permanently part of that portfolio and can neither be deleted nor moved out of it. And service providers do not need an account of their own from you, they need access: an agency is added as a partner with its own business portfolio and gets rights to individual assets, which you can withdraw at any time.
I run my business with a workforce of AI employees, each with their own role and their own personnel file. One of them, Susi, does nothing but Meta ads, and she works inside my account with exactly the permissions her job requires. If you want to see the whole team: My AI Workforce. Everything on the topic lives on the AI employees page.
The roof is the business portfolio, not Ads Manager
Ads Manager is a tool, not a container. The thing that holds the assets together is the business portfolio. Meta describes it as the place where an organisation brings together its Facebook pages, Instagram accounts, ad accounts, catalogues and other business assets, and manages them along with the people who have access to them.
That is an assignment on the platform, not ownership in the legal sense: the portfolio decides who may see and control what on Meta. Who owns the creatives, the copy, the source files and the data is settled alongside it, in your contract and in law.
The order you set things up in
The order is not a matter of taste. It follows from the fact that each asset can only sit in one portfolio. Create the ad account before the portfolio and you will be sorting it out afterwards.
- Secure your personal account. Turn on two-factor authentication, set up the recovery route, no shared logins. Meta names two-factor authentication in its best practices and lists it among the prerequisites for sharing assets with a partner. That it comes first here rather than last is my order, not Meta's: it is the build that wants protecting, not just the running.
- Create the business portfolio. Sign in at business.facebook.com, use the dropdown under Home in the top left, choose Create a business portfolio, enter the name and business email address, confirm it. Meta says the name should match your organisation's public name, because it is visible across Meta. Whoever creates it has full control afterwards.
- Add the Facebook page. Claim an existing one or create a new one. The page is later the identity the ad runs under.
- Add the Instagram account. Meta requires you to be logged in to that account if you want to assign it to someone.
- Create the ad account. Settings, Accounts, Ad accounts, + Add, Create a new ad account. You enter the name, time zone and currency, and choose whether the account is for your own business or used on behalf of another.
- Add the payment method. Either straight afterwards via Add payment info, or later under Billing and payments.
- Add people and partners. Only now, because permissions attach to assets that do not exist before this point. And with two people holding full control, so nobody sits alone on the access.
Only after that does the campaign itself make sense. It is built in Ads Manager across three levels, and each of them draws on something this setup produced: the ad set on budget and payment method, the ad on page and Instagram account as its identity, and both on the permissions of the person creating them. Which decision belongs on which level and what happens once you publish is covered in How to Run Ads on Meta: A Guide.
Ad account: create, claim or request access
Meta names three ways to get an ad account into a business portfolio. They look similar in the menu and have entirely different consequences.
The third route is the one an agency should take when it advertises for you. Meta describes it in exactly those terms: the account remains in the client's portfolio, what gets shared is access. One practical limit on top: without full control of the portfolio you cannot add an ad account at all.
Page, Instagram account and ad account belong together
The ad appears under an identity, meaning your Facebook page and your Instagram account. Both therefore belong in the portfolio and assigned to the person doing the work. Meta explicitly points out that missing page access or missing Instagram permissions can produce error messages that stop you creating or editing ads in Ads Manager.
For pages in a business portfolio there are three access levels: partial access for business tools only, partial access for business tools and Facebook, and full control. Creating, managing and deleting ads for the page works on all three levels.
One sentence from that help article is the most important one in this whole topic: at least one person must have full control of a Facebook page in a business portfolio for the page to stay active. If nobody has it, Meta says the page is automatically deactivated and scheduled for deletion. So if the intern or the former service provider was the only one with full control, what hangs on that is not just access but the page itself.
Payment: kept separate from access
You can attach the payment method to the portfolio rather than to a single ad account. You add it in Settings under Billing and payments and share it from there with existing ad accounts. According to Meta, only people with full control of the portfolio or with access to manage finances are allowed to change it.
That finance access is a separate, additional option in Meta's permission system, on top of the normal access level, and it is not included by default. That is why someone can build campaigns without being able to touch the card.
Grant access instead of sharing accounts
Meta distinguishes three kinds of users in a business portfolio: people, meaning individuals you add, partners, meaning other businesses such as agencies or clients, and system users, meaning servers or software working through the API. For people there are two levels of access, full control and partial access, and they apply to the portfolio as well as to individual assets inside it.
For the ad account the split is fine-grained enough to take seriously:
Anyone brought in gets basic access by default and can only work on the assets they have been assigned. In its best practices Meta advises keeping the number of people with full control small, ideally no more than ten, and at the same time making sure there are at least two, so nobody sits alone on the access. For fixed-term collaboration there is temporary access: basic only, a minimum of three and a maximum of 75 days, after which permissions are automatically revoked and the person is removed from the portfolio and any assigned assets. For a standing collaboration the same rule applies more slowly: grant only the permissions someone needs for their job, and go through the list regularly. In those same best practices Meta advises removing inactive users and inactive ad accounts.
Partner access comes with a limit that is easy to miss: even a partner with full control of an asset cannot pass it on to a third business, because according to Meta only the organisation that owns the asset can share it.
When the collaboration ends
The clean case is unspectacular. If you remove a person from your business portfolio, their access to the portfolio and to every asset they had is revoked. Partners you remove separately, through the Partners section. In both cases what was created inside your portfolio stays with you: the ad account, the campaign history, the reports, the audiences, the pixel data. What sits on the agency's machines stays there.
The messy case is the one where your account was never your account. If you let an agency advertise for you inside their own ad account, at the end there is no account to hand over, because according to Meta it cannot be moved out. What you take with you is whatever the agency exports for you. So put the handover in the contract before you need it: ad account, pixel or dataset, audiences, creatives, source files, export format and retention period, each one named.
In between sits the case where the account does belong to you, but nobody in your house has full control. There is an application to Meta for that, and Meta explicitly names as a possible reason that the person with full control is a former employee or contractor with no ownership rights. The application asks for three documents: an accepted identification document, proof that you own the business the portfolio belongs to, such as a business licence, a tax certificate or a utility bill, and a signed certification letter on letterhead with address, phone number, logo or seal and a handwritten or certified signature, all unedited and in a non-editable format. It is doable, but it is a procedure, and it takes time. Anyone who sets up their own portfolio on day one never needs it. How you settle those rights in detail is a contract matter, and not something I give legal advice on.
In my business Susi works inside my account
Susi, my AI employee for Meta ads, works to exactly this logic. She has no ad account and no portfolio of her own. She works inside my Meta account with the permissions her job requires, and builds finished campaigns there: competitor research in the Ad Library, an audience map made of real audience wording, copy following a fixed four-step, images as static HTML plus an AI image layer.
The boundary sits in one word. Every campaign the Meta ads connector creates starts out paused, enforced technically. Not as an agreement, but as a state. Susi spends no money of her own, budget and go-live decisions stay with me, and nothing goes live until I have read the ad. She has worked this way since 17 July 2026, with 44 documented reports on file as of 19 September 2026.
That is the same idea as the permission model in this article, one level further down: whoever does the work needs access, not ownership.
Frequently asked questions
Do I need a business portfolio, or is a personal ad account enough?
For a single ad a personal ad account is enough. For several things Meta names the business portfolio as an explicit requirement: Meta Business Suite, monthly invoicing, domain verification, ads about social issues, elections or politics. And it is the place where you grant permissions instead of handing out login details.
Can I move an existing ad account into my business portfolio later?
Only if, according to Meta, it is not in another portfolio. If it sits elsewhere, your route is shared access. If the account belongs to someone else, that person has to approve the claim.
What do I give an agency so it can advertise for me?
Not access to your account, but partner access. The agency tells you its business portfolio ID, you share exactly the assets it should work on through the Partners section, and you grant either partial access with selected tasks or full control of that individual asset. What the agency charges for that and which billing models set which incentives is a question of its own.
Does that give the agency my payment details?
Only if you arrange it that way. According to Meta, only people with full control of the portfolio or with finance access may change payment methods, and finance access is an additional option that is not included by default. Building campaigns does not automatically come with access to the card. Seeing the payment details and spending money are two different things, though: anyone allowed to switch a campaign live triggers costs without ever seeing the card. The brake for that is not finance access, it is who gets to publish.
How many ad accounts can I create?
A new business portfolio can create one ad account to begin with, according to Meta. That goes up to three once a campaign has delivered and been paid for. Beyond that there is a limit per portfolio that rises with your advertising spend and that you can view in Settings.
How to take it further
Do one thing today: check which business portfolio your ad account sits in and who has full control there. If the name you find does not belong to your business, that is this week's job, not the next campaign. Once the account is sound, carry on with Audience Analysis for Ads: A Guide and Creating Meta Ads With AI: A Guide. And if you want to make this a permanent role instead of doing it from scratch every time, Susi is available as a ready-made template in my community Claude Practitioners, along with the rest of the workforce. If you get stuck on the permissions check, ask there or in one of the calls instead of guessing for a week.
