How many user accounts should you have for yourself on your Macbook?

I always had only one user account on my Macbook, which of course has the admin role.


Now I thought, I finally would put in the effort to follow best practices and create an additional account with the standard role to separate normal daily work from rare critical administration tasks.


After creating the new additional user account I of course wanted to login to this account with the same existing AppleID as in my existing user account, which unfortunately didn’t work for me.


After reaching out to Apple, they told me, that it is not recommended to have more than one user account connected to the same AppleID, so now I am wondering, what is the recommended best practice regarding account security for your Macbook?


Should you have only one single user account for yourself with the admin role, which you will use for everything - daily work as well as rare critical administration tasks - which is logged in to your AppleID on your Macbook and there is no recommended separation of user accounts between these activities? Or what is the best practice approach?

MacBook (2017)

Posted on Oct 19, 2023 1:56 AM

Reply
Question marked as Top-ranking reply

Posted on Oct 19, 2023 5:39 AM

I understand your intentions by following the Principle of Least Privilege that is taught in most IT and Computer Science courses. The theory being that if someone gained access to a standard users password, they would not be able to change higher level administrator settings. This does work in a business environment where you do have an IT department for Admin tasks and you do not want standard users to mess up settings on the device that only the Admin should change and usually involve multiple networked computers. I see this as more of a protection from letting employees screw up settings that would have a negative impact on the network, than from preventing an outside hack.


Using a Mac as a single user I recommend sticking with the single Admin user. There really is not even a need for a second backup admin account.


Similar questions

8 replies
Question marked as Top-ranking reply

Oct 19, 2023 5:39 AM in response to RogerMiller90

I understand your intentions by following the Principle of Least Privilege that is taught in most IT and Computer Science courses. The theory being that if someone gained access to a standard users password, they would not be able to change higher level administrator settings. This does work in a business environment where you do have an IT department for Admin tasks and you do not want standard users to mess up settings on the device that only the Admin should change and usually involve multiple networked computers. I see this as more of a protection from letting employees screw up settings that would have a negative impact on the network, than from preventing an outside hack.


Using a Mac as a single user I recommend sticking with the single Admin user. There really is not even a need for a second backup admin account.


Oct 19, 2023 5:08 AM in response to RogerMiller90

There is no benefit to having more than one User Account. If you want to create more, that's perfectly ok.


... create an additional account with the standard role to separate normal daily work from rare critical administration tasks.


The practical effect of creating a separate "standard" Account lacking Admin privileges is that there will be such a frequent need to provide your Admin Account credentials that you are likely to become inured to providing them to the point of complacency. At the very least it will be annoying. But if that's what you want to do, fine.


Regarding Apple ID account security: Security and your Apple ID - Apple Support. An Apple ID account is obviously separate from a Mac's User Account. You can have as many of them as you please also, but just like a Mac User Account having more than one will just complicate matters. Make sure that each family member has a unique Apple ID - Apple Support has more on that subject.

Oct 19, 2023 5:41 AM in response to John Galt

That’s what the Apple Support has meanwhile told me, too. That you should have only one user account on your Macbook, if you are the only user, and that this user account would just have the admin role.


Now I am wondering, what to do, if for example my wife would use the same laptop with her own account and I would in this case correctly have to setup 2 standard users for me and for her and one additional admin user. I guess, in this case, the standard users would be connected to the corresponding AppleID’s, but what would I do with the admin user account in this case?


Would it get it’s own AppleID or would it just stay independent of any AppleID? And aren’t there circumstances, where the Admin user account would need access to data from my AppleID (although I can’t think of anything from the top of my head)?

Oct 19, 2023 6:05 AM in response to RogerMiller90

Both of you can have Admin accounts, assuming of course you trust one another to make changes to that Mac. Otherwise decide who wants the responsibility for maintaining it, and relegate the other Account to Standard.


You can each use your own Apple IDs as well, although certain features (such as Find My) may only be linked to one Apple ID. The idea is that a Mac should have only one owner, despite the fact multiple people may be authorized to use and administer it. Should you attempt to make conflicting changes macOS will inform you.


If you have even the slightest concern about the possibility of one User Account becoming corrupted, that would imply you don't have a contingency plan for that. It goes without saying if you care about the information on your Mac, use Time Machine: Back up your files with Time Machine on Mac - Apple Support. The converse is also true — if you don't use Time Machine then the prospect of spontaneously and irretrievably losing all the information on your Mac does not concern you. Not everyone does.


If you should even encounter a circumstance in which you suspect something amiss with a User Account just create another temporary one for the purposes of testing, as Apple suggests in Use safe mode on your Mac - Apple Support when discussing the effect of Login Items.

Oct 19, 2023 8:39 AM in response to RogerMiller90

Would I in this case be able to correctly configure the hardware and all kinds of external software correctly for those 2 standard users with my admin user account, although the admin is unrelated to both standard user Apple ID’s?


Yes.


What if for example, there is a software I would need to install as the admin user, which both standard users need to use, but they need to connect the software each to their personal AppleID (save configuration on iCloud from within the software or something like that)? Do these sort of things happen and would it be a suitable way to handle it (so general installation on laptop from admin user, individual configuration independently for each standard user)?


Yes. They can do that. Each user will have his or her own documents, preferences, apps (unless you want to approve them for all users), app settings... etc and be responsible for maintaining them. If they should make a mistake none of its effects will propagate to other users.


In your role as that Mac's Administrator, you will have an occasional need to approve actions with the potential for altering various settings and options. In other words you will become the "IT department" with all rights and privileges pertaining thereto 🙂

Oct 19, 2023 5:37 AM in response to Firebase14

OK, but that would mean, you still one have one account for all types of usage. The other one would basically be benched, just in case it needs to substituted into the game.


But in this case, it doesn’t even make sense to have a backup admin account from my point of view, because when the main admin account gets corrupted, the one with access to the account can just delete the alternative account anyway.

Oct 19, 2023 7:38 AM in response to John Galt

Thanks, I’d just like to understand a working admin/standard approach in general on a conceptual basis to be prepared, if I ever had an actual problem. Maybe assuming, that I bought a Macbook for joint use for my 80 year old Grandma and my elementary school child, which both are prone to clicking on stupid links, you should not click at or accidentally going in setting and doing bad things unintentionally or whatever scenario you might come up with.


In this case, they both have their own standard users linked to their own Apple ID’s and I would have an additional admin account on this laptop.


Would I in this case be able to correctly configure the hardware and all kinds of external software correctly for those 2 standard users with my admin user account, although the admin is unrelated to both standard user Apple ID’s?


What if for example, there is a software I would need to install as the admin user, which both standard users need to use, but they need to connect the software each to their personal AppleID (save configuration on iCloud from within the software or something like that)? Do these sort of things happen and would it be a suitable way to handle it (so general installation on laptop from admin user, individual configuration independently for each standard user)?

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

How many user accounts should you have for yourself on your Macbook?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.