Keep supplier portal access tied to current work

What this means for your practice

Give each external account an accountable internal sponsor and a review process. Access should follow the agreed business relationship and information boundary.

What to ask before you choose

Remove a fictional contact and test old shared links through the approved process. The result should match your access rules. Ask how an internal sponsor is replaced when they leave. An account without a current sponsor should prompt review rather than remain indefinitely by default.

Give external access a current internal owner

The internal sponsor should understand why the supplier contact needs access and which work they are involved in. That responsibility needs to move when the sponsor leaves or changes role. Otherwise an account can remain active without anyone in the practice being able to explain its purpose.

Ask the supplier to demonstrate the portal using a test contact. Check the workspace, documents and saved links the contact can reach, including what happens after their access is removed through the approved process. Include a replacement contact at the same supplier so the practice can see how work continues without sharing the departing person's login. Agree when accounts are reviewed and how the team learns that a contact no longer needs access. Keep exceptions visible with an approving person and a reason. The aim is an access arrangement that follows the current working relationship, not a growing collection of old accounts retained because nobody knows whether it is safe to change them.

How to check the result

Track accounts with no current sponsor.