Guide
Account management basics
Last reviewed: · by TaxProsRated editorial
Account vs. listing
Accounts are individual user logins; listings are firm profiles. One account can have access to multiple listings (e.g., a marketing director managing listings for a multi-location firm), and one listing can have multiple authorised accounts (e.g., partner plus marketing manager plus admin assistant). The relationship is many-to-many.
The first user to claim a listing becomes the listing owner. Listing owners can add, remove, and modify the access of other accounts on the listing. Removing all accounts orphans the listing back to "claimed-but-no-active-managers" status; the editorial team de-claims orphaned listings after 90 days of no activity.
Adding team members
From the firm dashboard, the "Team" section lets you invite additional accounts by email. Invitees receive an invitation email with a one-time link valid for 14 days; clicking the link prompts the invitee to either log in to an existing directory account or create one. After acceptance, the invitee gets the access role you assigned (Owner, Editor, or Viewer).
Owner role: full control including billing, tier upgrades/downgrades, listing deletion, team management. Editor role: can edit profile content, respond to reviews, view analytics; cannot change billing or team. Viewer role: read-only access to dashboard analytics; useful for non-management staff.
Single-sign-on
Premium-tier listings can request SSO integration with the firm's identity provider (Okta, Azure AD, Google Workspace, OneLogin). SSO setup requires the firm's IdP administrator to configure the directory as a SAML or OIDC application and to provide the directory's editorial team with the IdP metadata. Setup typically completes within 5 business days from initial request.
SSO accounts cannot be used for billing actions; tier upgrades and payment-method changes still require the password-based authentication path with the original Owner-role account, for fraud-prevention reasons.
Two-factor authentication
2FA is available for all accounts and required for accounts with Owner role on Featured or Premium listings. Supported methods: authenticator app (TOTP), SMS, security key (WebAuthn). Authenticator-app and security-key methods are recommended over SMS due to the SIM-swap fraud vector.
Recovery codes are generated at 2FA setup and shown once. Save them in a secure location (password manager, sealed envelope in firm safe). The directory cannot retrieve recovery codes after generation; loss of all 2FA factors plus recovery codes requires the documentary-verification path described in the claim-verification-process article to regain account access.
Password policy
Minimum 12 characters with a mix of upper, lower, digit, and symbol. Passwords are checked against the Have I Been Pwned breached-passwords list at registration and on every password change; reused breach-list passwords are rejected.
Password rotation is not automatically enforced (NIST SP 800-63B no longer recommends time-based rotation), but the system flags passwords that appear in newly-published breach data and prompts the affected user to rotate at next login.
Session management
Default session duration: 30 days from last activity. Active session list is visible in the account-security dashboard; you can revoke any active session immediately. New-device login triggers an email notification to the account's primary email; you can disable this notification but doing so removes a fraud-detection signal.
Account deletion
Account deletion is initiated from the account-settings page and requires email confirmation plus 2FA. Deletion of an account that owns one or more listings does not delete the listing; the listing reverts to "claimed-but-no-active-managers" status and other Editor-role accounts retain access. To delete a listing entirely, see the cancelling-or-pausing-listings article.
Account deletion is logical (account is marked deleted and personal data is purged within 30 days under the data-retention policy); review submissions made by the account remain attributed to the original display name unless the user requests review-deletion separately under GDPR/CCPA rights.
Important disclaimer
Informational only — not tax advice. This page summarises publicly available information about tax as of August 2026. Tax laws change, individual circumstances vary, and the application of any rule depends on your specific facts.
TaxProsRated does not provide tax, legal, accounting, or financial advice. Before acting on anything you read here, consult a qualified tax professional licensed in your jurisdiction . TaxProsRated, its operators, and its contributors disclaim all liability for action taken in reliance on this page.