Access groups and team members in the agent services account

Q: How might a practice set up its groups?

Illustration only. A practice with 12 staff has three teams: personal tax, business tax and payroll. Two partners act for a well known client whose affairs only they should see. The practice: appoints two administrators, both partners, so the account is not left with one person; gives every member of staff their own sign in and removes the shared login once used by the office; creates a group for each team and adds its clients and staff, finishing each group before moving on; creates a restricted group containing only the two partners and the sensitive client; and mirrors the same allocation in the online services account for Self Assessment and PAYE clients. Each new client is added to a group at onboarding, and each change of team is reflected the same week.

Administrators add team members to the agent services account from “Manage account”, giving each person their own Government Gateway sign in and a role as administrator or standard user. Access groups go a step further: once switched on, an administrator puts team members and clients into groups, and only the people in a group can work on its clients. HMRC has run access groups as an opt in feature, tested in private beta since September 2022 and opened to larger firms in 2025, so a practice should check whether it is enabled on its own account.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

Who can add team members, and what roles are there?

HMRC’s guidance on giving staff access to online agent accounts says the first person to set up the account is automatically an administrator. Administrators can set up other administrators and standard users. In the agent services account, the steps are:

Select “Manage account”, then “Add or remove a user”.
Enter the person’s full name and email address and choose their role.
To change access for an existing team member, choose “Manage who can use your agent services account” from the same page and select “manage” beside their name.

Administrators can use every service the firm is signed up for, enrol for services and remove them, add or delete users and assign services to them. Standard users can only use the services an administrator has assigned. Changing the firm’s own registered details needs more: HMRC’s guidance on updating agent contact details says only an admin user who is, or is authorised by, a director, company secretary, sole trader, proprietor or partner can make those changes.

Why does every member of staff need their own login?

The Tax Agent’s Handbook says HMRC recommends that each member of staff who needs access to the agent services account or the online services for agents account has individual sign in credentials. The HMRC standard for agents expects agents to keep online access and account credentials safe from unauthorised use and to access client data only through their own agent registration, and HMRC’s security guidance for agents tells firms not to let other people use their sign in details but to set up administrators and standard users instead.

Multi factor authentication makes shared logins impractical as well as risky. The Handbook says administrators can remove a team member’s authentication options but cannot set up new ones for them, and it recommends that firms with several staff appoint more than one administrator so that resets can be handled internally. The wider security picture is in cyber security for practices.

Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.

From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.

See my price in 2 questions or call 01795 841 310.

★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews

What are access groups?

Without access groups, everyone with access to a firm’s agent services account can reach every client. HMRC’s briefing on the feature, published by ICAEW in 2022, explained the problem: all staff could see all client records and tax services if they knew the right client identifiers, which concerned firms with high profile clients.

Access groups change that. According to the briefing:

only administrators can create groups, from “Manage account”;
an administrator selects team members and clients and adds them to the same group, and only team members in that group can access its clients;
clients can be searched and filtered by name, tax reference and tax service when building groups;
the feature is off until an administrator turns it on, and can be turned off and on again; and
groups that were fully set up are kept if the feature is turned off, but groups not finished at that point are lost.

Access groups control who can reach a client, not what they can do once there. The briefing says the feature does not allow read only, edit only or submit only permissions. Anyone in the group can make changes, save and submit.

Agent Update issue 107 described a client list that comes with the feature. Administrators can search, sort and filter it, see which authorisations are in place for which tax services, add their own client references and see which groups each client belongs to. Income Record Viewer clients are not shown on it.

Is the feature available to every firm?

HMRC has introduced it in stages. Agent Update issue 102 said testing had begun with firms of up to 1,000 clients. Agent Update issue 128, published in February 2025, said testing with those firms had run since September 2022 and that the private beta was being opened to firms with more than 1,000 clients. It said HMRC would enable access groups on a firm’s account when it joined, and asked firms to email mtdgpvolunteers@hmrc.gov.uk with their organisation’s name and agent reference number. HMRC’s 2021 staff access guidance still says that allocating clients and services is not available in the agent services account; that page predates the feature, so check the account itself to see what is switched on.

How does this compare with the older online services account?

The HMRC online services for agents account, used for Self Assessment, Corporation Tax and PAYE, has long allowed allocation. Its administrators use “Manage who can access taxes and schemes” to give users specific services or clients, and HMRC’s guidance says that once users are set up, clients sit in an unallocated pool until an administrator assigns them. Agent Update issue 147 said HMRC is developing a way to assign several clients to a team member at once in that account, and aims to start testing before the end of 2026.

A firm that wants consistent internal controls therefore has two systems to manage. A junior who cannot see a client in the agent services account may still have access to the same client’s Self Assessment record in the older account unless allocation is set up there too. If authorisations have been copied into the agent services account, the same clients appear in both.

How might a practice set up its groups?

Illustration only. A practice with 12 staff has three teams: personal tax, business tax and payroll. Two partners act for a well known client whose affairs only they should see. The practice:

appoints two administrators, both partners, so the account is not left with one person;
gives every member of staff their own sign in and removes the shared login once used by the office;
creates a group for each team and adds its clients and staff, finishing each group before moving on;
creates a restricted group containing only the two partners and the sensitive client; and
mirrors the same allocation in the online services account for Self Assessment and PAYE clients.

Each new client is added to a group at onboarding, and each change of team is reflected the same week.

What happens when someone joins or leaves?

The Tax Agent’s Handbook says firms should remove access for staff who leave or no longer need it. Agent Update issue 140 gave the procedure for a departing administrator: a remaining administrator removes the leaver and can add a replacement. If the only administrator is leaving, they should first add a new administrator, who then removes them once they are sure their own access works. Where that is not possible, HMRC’s online services helpdesk treats it as an absent administrator case and resets access after security checks, and HMRC asks firms to keep a record of who their administrators are. Leaving former staff with access is also a data protection failing; see data protection for accountancy practices.

What mistakes come up most often?

One administrator for the whole firm, so a holiday or resignation locks everyone out.
Shared logins, which break the HMRC standard for agents and hide who did what.
Assuming access groups can make a user read only.
Switching the feature off while a group is half built and losing it.
Restricting access in one account but not the other.
Forgetting to put new clients into a group.

How the agent services account fits into HMRC’s wider systems is covered in the agent services account and authorising an agent.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.