Shadow IT With Customers Inside: Identity Lifecycle Management for Business WhatsApp Group Portfolios
The asset that is missing from your IAM
On an employee's last day, offboarding runs like a pipeline: badge disabled, SSO account suspended, laptop collected, SaaS seats reclaimed. The WhatsApp groups that person created with customers, resellers and distributors are not in that pipeline, because they were never provisioned through it.
Ivan Schroll's report calls this a portfolio problem. Sales, support and marketing each open groups informally. A few years later the company holds a set of customer-facing channels that nobody can list completely. Research on shadow IT explains the origin: Abbas and Alghail (2021) found staff using tools such as WhatsApp without IT approval, mainly because the organisation offered no suitable alternative.
Five risks, one root cause
- Ownership by creator. The Help Center states the creator cannot be removed and remains admin until they exit. If that account is a personal number, the company depends on the person to leave voluntarily, or must recreate the group from a company number and ask every customer to rejoin.
- Privileges that outlive the role. Admin rights are not tied to HR records. Former staff, agencies after contract end and partners who changed jobs may still post as admin to the brand's customers.
- Device and account sprawl. Shared accounts on linked devices with no attribution.
- Brand impersonation. Customers cannot easily tell an official group from a copy.
- No organisational record. Ordinary groups provide no organisation-wide log of admin actions.
There is also a failure mode in the platform's succession logic: if the only admin leaves, WhatsApp picks another member at random, possibly a customer.
Architecture comparison
| Aspect |
Ordinary group |
WhatsApp Business app group |
Cloud API Groups API |
| Maximum size |
1,024 members |
1,024 members |
8 participants |
| Joining |
Added, or invite link |
Same |
Invite link only, optional approval |
| Creator removable |
No |
No |
Group belongs to the business number |
| Admin roles |
Unlimited |
Unlimited |
Managed through the API |
| Staff on one account |
Up to 4 linked devices |
Up to 10 with multi-agent plans |
API integration |
| Attribution of staff messages |
None documented |
Documented for chats, not groups |
Business's own systems |
| Organisation-level record |
Manual export |
Manual export |
Through the integration |
No option gives you large customer groups and native organisational control at the same time. That trade-off is the core design decision.
Engineering conclusion: run joiner, mover, leaver on groups
The paper translates standard access governance into proposals, explicitly not tested standards.
- Portfolio register. One entry per group or Community: purpose, business owner, creating account and whether it is company-controlled, admin accounts and the person behind each, membership type, settings, records rule and last review date.
- Creation rule. New business groups only from company-controlled numbers, registered at creation.
- Minimum admin set. At least two company-controlled admins per group, so the random-admin rule never fires. The mechanics are covered in what happens when a WhatsApp group admin leaves.
- Joiner, mover, leaver. Grant admin rights on request with a reason, review on role change, revoke in every registered group on the same day as other access. Agency and partner rights end with the contract.
- Hygiene. Two-step verification and app lock for every admin account, and periodic review of linked devices.
- Customer safeguards. Admin-only messaging in announcement groups, and official numbers and payment methods stated in the description.
- Records decision. Each class of group is either a channel of record, exported on schedule, or ephemeral, with disappearing messages and no commitments made there.
- Annual reconciliation. Compare the register with the groups company accounts actually belong to.
Automation can execute parts of this at scale, as described in WhatsApp group automation for business, with one constraint: a tool acts with the permissions of the connected account and cannot remove a group's creator.
Source: Ivan Schroll (2026), Governance and Operational Security of Business WhatsApp Group Portfolios: Administrator Lifecycle, Employee Offboarding, Brand Impersonation and Recordkeeping. DOI 10.17605/OSF.IO/G6HF9
Author: Ivan Schroll (ORCID 0009-0007-0680-5570)