# Meta Business Portfolio Setup: Secure It Before the First Ad

> The Meta business portfolio setup I run on every onboarding: real two-factor, the right people, one ad account, and a $1 warm-up before any real spend.

- Canonical: https://rodrigonask.com/meta-business-portfolio-setup-before-first-ad
- Published: 2026-09-25
- Author: Rodrigo Nask (https://rodrigonask.com/)

---

## Key takeaways

- The creative is not the bottleneck on a new account. Trust is, and it takes about two weeks you cannot skip.
- A passkey is not two-factor authentication to Meta. Add a real second factor, and back it up to the cloud.
- Set the portfolio's two-factor requirement to Everyone, then confirm the business email a second time, because the first link does not stick.
- Invite your operator with full control and no finance. Assets are connected to each person one by one.
- A new portfolio can create one ad account. Warm it up at $1 a day until the limit reaches three, because three accounts is three strikes.

A Meta business portfolio is the holding company for your advertising: it owns the Page, the ad accounts and the payment method, and every person in it is an employee who gets access asset by asset. Setting it up safely means real two-factor on every login, an operator with full control and no finance, and a warm-up before real spend.

You have the offer, the landing page and forty ads ready to go. The one thing between you and launch is a Facebook login that belongs to one person, protected by a password somebody wrote down in 2019.

That is where I start every onboarding. Not with the ads. I can have every creative and every page live in 72 hours. What I cannot do in 72 hours is make Meta trust an account it has never seen spend money.

So the first call with a new client is what I call bulletproofing: making sure we do not lose the account after we start. What follows is that call, step by step, from two real onboarding sessions I ran in September, with screenshots taken off the recordings. Names, emails and IDs are replaced.

> **Figure (animated on the web version):** Two portfolios lose the same ad account. The one with an ad account creation limit of 1 has nothing left. The one with a limit of 3 keeps two accounts running.
>
> A new portfolio is allowed one ad account. **One ad account is one strike, and three is three strikes.** That number is the real reason to wait before spending.

## What you are building

Seven steps across two calls, about an hour of clicking in total, and two weeks of waiting you cannot compress.

By the end you have a personal login with a real second factor, a business portfolio with a confirmed email and two-factor enforced on everyone in it, a Facebook Page, your operator invited with full control and no finance, one ad account with a Page and a card attached, and a warm-up campaign spending a dollar a day.

The first call is the plan and it builds nothing. The second call is the build, with the owner driving and sharing the screen while I direct. That split is deliberate: on the first call you find out who actually holds the password, and it is rarely the person on the call.

## Why the ads are not the bottleneck

The obvious move is to open Ads Manager on day one and launch. Meta lets you. You can run ads without a business portfolio, straight off a profile or a Page.

It is the wrong move for anyone planning to spend real money. A new portfolio starts with an **ad account creation limit of 1**. One ad account means one strike. If that account gets disabled, and new accounts in regulated or competitive verticals get disabled for reasons nobody explains, you have no account left to run anything from. You are out of the game, not waiting on an appeal.

Once Meta starts trusting you, the limit goes to 3. In my experience that is usually less than two weeks: sometimes one, occasionally three. As soon as it hits three I create the other two ad accounts, so one ban becomes an inconvenience instead of the end of the engagement.

So the order is: secure the login, build the structure, and let the account age while the creative gets made. Nothing about the creative is waiting on the account, and nothing about the account can be rushed by the creative.

## Step 1: put a real second factor on the personal login

Everything in a portfolio hangs off a personal Facebook login, so that login gets protected first. Two-factor authentication is mandatory on every account I run. When a client tells me they trust me and do not care, my answer is that I know they trust me, but what if I get hacked?

Go to **Accounts Center**, then **Password and security**, then **Two-factor authentication**. The order I prefer, best first:

1. **A physical security key.** Instead of typing a code, I press my finger on a key. I showed mine on camera and the client had never seen one.
2. **An authenticator app, backed up to the cloud.** The backup is the part people skip. I dropped a phone in the sea once and lost everything on it. If your authenticator app is not cloud saved, you lose access to the accounts with the phone.
3. **SMS to a phone somebody trusted holds.** It is the weakest of the three, and it is better than nothing.

> **Figure (animated on the web version):** Four login protections rising as bars. A passkey alone stays flat and is tagged as not counting as two-factor. SMS to a trusted phone rises a little, a cloud-backed authenticator app higher, and a physical security key highest.
>
> Meta flagged a passkey-only login as having no two-factor at all. **Pick a real second factor, and back it up somewhere that survives the phone.**

Here is what happened on the live call. The owner had set up a **passkey** the day before, which is a good thing to have. Then we tried to create the Page and Meta flagged the login as having no two-factor authentication at all. The passkey replaces the password. It is not a second factor. Keep it, and add one on top.

Then Meta did not offer the authenticator app option on that account. I have seen this a couple of times and I have no idea why it happens. The screen offered two choices and nothing else.

![A dark Meta dialog titled Help protect your account, under the heading Choose how to confirm it's you. Two options: SMS or WhatsApp, marked Recommended and selected, and Security keys, described as a USB, Bluetooth or NFC key. A blue Continue button sits at the bottom. The account name is replaced with a placeholder.](https://rodrigonask.com/images/posts/meta-portfolio/2fa-method.webp)

Caption: The two-factor picker on the live call. No authenticator app on offer, so SMS it was.

A second wrinkle: the owner's own phone number had been hijacked, so codes sent there would never arrive. We used a family member's phone for the SMS. If the number on the account is not one you control today, fix that before anything else, because account recovery sends everything to it.

One more reason this step is non-negotiable. One login per human. If two people share a login with two-factor on, every sign-in turns into a phone call to whoever holds the device. Give each person their own login and grant access through the portfolio instead.

## Step 2: create the portfolio, confirm the email twice, and require two-factor

Go to `business.facebook.com` at the root. If someone sent you a deep link, strip it back to the domain, because the deep link can land on a page that errors for a brand new user.

The creation form asks for three things: a portfolio name, your name, and a business email. Name it whatever you like. I tell clients to think of it as a holding: not the company, the container for everything the company does on Meta.

The email has to be an inbox you can actually open during the call, because Meta sends a confirmation link straight away. Click it, refresh, and the portfolio exists.

Then, in the left sidebar, go all the way down to **Settings**, then **Business info**. Scroll to the bottom, to the contact email.

On our build it still said **Pending confirmation**, with the first link already clicked. You have to confirm again. Use the three dots menu next to the email to resend, and enter the six-digit code. Stupid, and it happens.

On the same page, under **Business options**, find **Two-factor authentication**. It defaults to **No one**. Set it to **Everyone**.

![The Business info page of a Meta business portfolio. At the top, Ad account creation limit shows 1. Below, under Business options, the Two-factor authentication setting reads Require a login code to access this business portfolio from unknown browsers, and its dropdown is open on three options: No one, selected, then Admins only, then Everyone, with the cursor on Everyone.](https://rodrigonask.com/images/posts/meta-portfolio/business-options.webp)

Caption: Business info, one screen: the creation limit of 1 at the top, and the two-factor setting about to go from No one to Everyone.

While you are there, read the line above it: **Ad account creation limit**. On a new portfolio it says 1. That is the number the next two weeks are about.

Setting Everyone is what makes step 1 enforceable. The People list flags anyone without two-factor in red, and the flag clears once their login has a real second factor.

![Two rows from the People list of a Meta business portfolio, stacked. In the top row the account owner has Full access and a red line under the name reads Two-factor authentication not turned on, with Last active Not available. In the bottom row, after a refresh, the red line is gone and Last active shows a date with a green Active tag. Name and email are replaced with placeholders.](https://rodrigonask.com/images/posts/meta-portfolio/people-2fa.webp)

Caption: Before and after adding a real second factor. **A red warning that turns green** is my favorite screen of the whole call.

## Step 3: create the Page, and pick a boring category

In the sidebar, **Accounts**, then **Pages**, then **Add** and **Create a new Facebook Page**. Name it after the business.

The category matters more than it looks. The client suggested the category that literally described the business, which sat in a regulated vertical. I said no. We picked **Product/service**. The Page category is one more place for a reviewer to decide what you are, and I would rather that decision happen on the ads, where I control the wording.

![The Create Facebook Page dialog inside a business portfolio, on the Details step. The Page name field holds a placeholder brand name, the Category field holds one chip reading Product/service, and the optional Bio is empty. Cancel and Next buttons sit at the bottom right.](https://rodrigonask.com/images/posts/meta-portfolio/page-category.webp)

Caption: Category: Product/service. Deliberately generic, even for a business with a more specific label available.

Before any ad runs, the Page and the Instagram profile both need a profile picture. Instagram can wait. We deferred it on the call, because the browser refused to load that screen, and the warm-up does not need it.

## Step 4: invite your operator with full control and no finance

Go to **Users**, then **People**, then **Invite people**, and enter the operator's email. Choose **Full control**. Open the advanced options, the finance ones, and leave them empty. Assign no assets on the way in: the operator can connect assets to themselves once they are inside.

Full control lets me create ad accounts, connect Pages and assign assets. It does not let me touch who pays, and I do not want it to. Finance is the one permission that turns a hacked operator into a drained card.

On the call the desktop browser refused to open the invite dialog. A hard refresh with **Command+Shift+R** clears the cache and sometimes fixes it; this time it did not. My fallback is Microsoft Edge. I hate it, but for some reason it gets past most of the browser issues Facebook throws at you. The client did it from the phone app instead, which worked. On mobile, press space after typing the email so it registers as a chip, or the invite goes nowhere.

Then check the People list before you wait for anything. Ours showed the invite sitting against a mistyped address. Twice. The third attempt was copied and pasted from the chat, and it arrived.

## Step 5: create the ad account and assign it to every person

With access confirmed, I create the ad account from my side, inside the portfolio. Name it with a number on the end, because there will be three. Set the timezone to the client's, not yours, or every daily report is cut at the wrong hour. Connect the Page.

Then assign the ad account to each person, including the owner. This is the part that confuses everyone, so here is how I explain it on calls: the business portfolio is the company, and the owner and I are employees of that company. I created the asset, and it belongs to the portfolio. But every asset has to be connected to every employee individually, or they cannot see it.

> **Figure (animated on the web version):** A business portfolio card at the top with two people below it, the owner and the operator. Each gets the Page and the ad account connected individually. The owner also holds finance; the operator's finance chip is crossed out.
>
> The portfolio is the company and every person in it is an employee. **Each asset is connected to each person, one at a time, and finance stays with whoever owns the card.**

The owner refreshes, and the ad account appears on their side.

## Step 6: add the payment method with the screen share off

The owner adds the card, because I have no finance access by design. The moment they start typing, I stop watching the screen share. Card numbers do not belong in a call recording.

Nothing is charged up front. The account's setup screen asks for location and currency, optional business and tax information, and the card. Use a business card if there is one. A personal card works and can be swapped later.

The questions that always come next are about billing, so answer them before the first charge lands.

> **Figure (animated on the web version):** A row of card charges stepping up: one dollar, two, three, five, seven, fifteen, as the billing threshold rises. A calendar chip marks one day a month when any outstanding balance is charged.
>
> Meta bills a new account after it spends, in charges that grow as the threshold rises. **You can lower the threshold yourself. Only Meta can raise it.**

A new account bills after it spends. Meta does not trust it, so the first charge lands at about a dollar, and the threshold rises as the account pays: two, three, five, seven, fifteen. On top of that, one day a month, picked by Meta, any balance left is charged anyway. So for the first weeks you see several small charges a day. That is the trust system working, not a fault. You can lower the threshold yourself. Only Meta can raise it. Prepaid credit is also an option if the owner would rather load funds than get billed.

The finish line is the setup checklist on the ad account, all green.

![The Account Overview for a new ad account named Ad account 01, with 0 active campaigns and $0.00 spent. Below, a card titled Get set up to run ads lists four items, each with a green tick: Add payment method, Confirm Facebook Page, Verify email address, and Verify phone number.](https://rodrigonask.com/images/posts/meta-portfolio/ad-account-ready.webp)

Caption: Payment method, Page, email and phone all confirmed. Ready to spend, and still with a creation limit of 1.

## Step 7: warm it up with an animal video for two weeks

This is the technique I have been tailoring for a decade, and it has gotten dumber every year.

Go to a free stock video site like [Pexels](https://www.pexels.com/license/), where the license allows commercial use. Search for an animal. On our call the client's favorite was a lion. Pick a beautiful clip: no blood, nothing that looks weird. Download it, upload it to the ad account, and run it at **$1 a day for two weeks**.

> **Figure (animated on the web version):** A fourteen-day track with a marker walking across it at one dollar a day. A counter rises to fourteen dollars spent, and at the end the ad account creation limit changes from one to three.
>
> One stock video of an animal, $1 a day, for about two weeks. **In my experience that is usually enough for Meta to raise the creation limit from one to three.**

It used to be a complex post. Now it is one animal. People watch the lion, the account builds a history of boring, compliant, paid delivery, and after about two weeks Meta starts trusting us and raises the creation limit. For some random, strange reason, it works.

When the limit reads 3, I create ad accounts two and three, connect the Instagram profile, and the real campaigns start. The creative has been ready for twelve days by then. That was always the plan.

## What went wrong, so it does not surprise you

Every onboarding hits something. Ours hit five, and none of them were rare:

- **The password lived with someone else.** Get the person who holds the login on the first call, or book the build for when they are around.
- **The passkey was not two-factor.** Meta says so the moment you try to create a Page.
- **The authenticator app option was missing.** Fall back to SMS on a phone you control, and add a security key later.
- **The browser broke.** Hard refresh, then Edge, then the phone app.
- **The invite went to a typo.** Read the People list before you wait for an email.

The worst case I have seen was worse than all five: a client whose Facebook account had been dormant for about ten years got blocked the moment we turned on two-factor. Not lost, but it took three weeks of support to prove they were a person. If the login is old and quiet, start this process earlier than you think you need to.

## Hand it to Claude Code

The setup is clicking, and clicking stays human. Never point a browser automation tool at Meta's interfaces: automated activity on a business portfolio is exactly the kind of thing Meta's integrity systems look for, and the penalty lands on the ad account, not on the tool. What I hand to Claude Code is the preparation and the read-only check afterwards:

```text
I am onboarding a new client onto Meta ads. Using this article as the procedure:

1. Build a one-page runsheet for two calls. Call 1: who holds the login, which phone
   number is on it, which second factor they will use, where the authenticator backs up.
   Call 2: the seven build steps in order, with the exact menu path for each, and a
   checkbox per step.
2. Draft the message I send before call 2: what they need in hand (the login, the phone,
   an inbox they can open live, a business card), in under 80 words.
3. After call 2, using the Marketing API with a read-only system user token and never a
   browser: list the people in the portfolio and their roles, the portfolio's two-factor
   requirement, and every ad account with its timezone, currency and funding status.
   Look up the exact field names in Meta's Graph API reference and say which ones you
   could not confirm. Do not guess a field.
4. Output a table: step, expected state, observed state, who fixes it.
```

The last line of step 3 is the one that earns its place. A model that invents a plausible field name gives you a clean-looking report of nothing. Same principle as the rest of [the operating model](https://rodrigonask.com/agentic-marketing): the tool's job is to check, not to reassure. If you want the tracking side wired after the account is live, [the Conversions API setup](https://rodrigonask.com/meta-ads-capi-claude-code-zero-setup) is the next step, and [the funnel benchmarks](https://rodrigonask.com/meta-ads-funnel-benchmarks-explained) tell you what each stage should cost once the real campaigns start.

## When not to do this

**You are spending a few hundred dollars once.** Boost the post from the Page and stop reading. The portfolio, the limit and the warm-up are for accounts that need to survive a year of spend.

**There is already an aged portfolio in good standing.** Do not build a second one next to it. Audit the one you have: two-factor on Everyone, people and roles, the creation limit, and who holds finance. Everything here still applies, minus the waiting.

**The vertical needs authorization first.** Prescription drugs, some financial products and a few other categories need Meta's permission before any ad in them runs, and no warm-up changes that. For health brands, [the prescription drug authorization](https://rodrigonask.com/meta-prescription-drug-ads-authorization-telehealth) comes before the first real campaign.

**Nobody can tell you who owns the login.** Stop. Building a portfolio on a login whose owner you cannot reach is how businesses end up locked out of their own ads.

For the security settings themselves, the reasoning is not mine alone. [CISA's guidance on multifactor authentication](https://www.cisa.gov/MFA) ranks phishing-resistant methods like security keys above codes, [NIST's authentication guidelines](https://pages.nist.gov/800-63-4/sp800-63b.html) restrict SMS as an authenticator for the reasons my client's hijacked number made obvious, and the [FIDO Alliance's passkey documentation](https://fidoalliance.org/passkeys/) explains what a passkey actually replaces.

If you want this run for you, from the first call to the first real campaign, that is [what I build](https://rodrigonask.com/services), and the [case studies](https://rodrigonask.com/case-studies) show what happens after the warm-up ends.

I run Meta acquisition end to end for B2B and expert-led brands: the account setup, the creative, the landing pages, and the tracking that proves which ad produced the money. One person, accountable for the number.

- [Work with me 1-on-1](https://rodrigonask.com/1-on-1-consultancy)
- [Read the rest of the breakdowns](https://rodrigonask.com/blog)

## Frequently asked questions

### Can I run ads without a business portfolio?

Yes, Meta will let you boost and run ads from a personal profile or a Page with no portfolio at all. What you give up is the structure: no clean way to add people with limited roles, no ad account limit that grows, and every asset tied to one personal login. If that login goes, the whole operation goes with it. A portfolio costs twenty minutes and separates the business from any one person.

### Is a passkey enough two-factor authentication for Meta?

Not on the account I set up. The owner had a passkey on their phone and Meta still flagged the login as having no two-factor authentication, because the passkey stands in for the password rather than adding a second step. We had to add a real second factor in Accounts Center before the portfolio would stop showing the red warning. Keep the passkey, and add an authenticator app or a security key on top.

### How long until Meta lets a new portfolio create more ad accounts?

In my experience usually under two weeks, sometimes one, occasionally three. A new portfolio starts with an ad account creation limit of 1, and once Meta trusts the account it goes to 3. I run a one-dollar-a-day warm-up during that window so the account shows real, boring, compliant spend. Nothing forces the change on a date, so plan the launch around the limit, not the calendar.

### Why should my agency not get finance access?

Because nobody running your ads needs it, and it is the one permission that turns a hacked operator into a drained card. Full control over the portfolio lets an operator create ad accounts, connect Pages and assign assets. Finance lets them change who pays. I ask every client to invite me with full control and the finance options left empty, and the card goes in on their side with my screen share off.

### Why is Meta charging my card several times a day?

Because a new ad account bills after it spends, against a threshold that starts low. The first charges land at a dollar or two, then the threshold rises as the account builds a payment history, so the charges get bigger and less frequent. On top of that, one fixed day a month settles any balance left over. You can lower the threshold yourself, but only Meta can raise it.