A smart home access audit helps you remove old users, limit guest permissions, rotate lock codes, and protect shared cameras, hubs, and companion apps. Use this reusable checklist whenever someone joins or leaves your household, a contractor needs temporary access, you move home, or a major app update changes permission settings.
Overview
Smart home security is not only about strong passwords and firmware updates. It also depends on knowing who can control each device, view recordings, unlock a door, change an automation, or recover the main account. Access is often spread across several places: the device manufacturer’s app, a smart home platform, a hub, a voice assistant, and individual devices such as cameras or smart locks.
Start by creating an access roster. List every account, person, code, device, and permission that could affect your home. Separate people who need ongoing access from those who need access only for a limited time. A household member may need control of lighting and the ability to manage a lock, while a dog walker may need one temporary door code and no camera access.
Use the device’s current app labels as your source of truth. Permission names and invitation workflows can vary by manufacturer, product generation, subscription level, and software version. If a setting is unclear, do not assume that a shared user has the same access as the owner. Check what that person can view, change, invite, delete, or recover.
For broader protection, pair this audit with our room-by-room smart home security checklist and keep devices updated using the smart home firmware and end-of-support guide.
Checklist by scenario
Adding a household member
- Invite the person through the official app rather than sharing the owner’s password.
- Assign the lowest permission level that supports their needs.
- Decide whether they should control locks, view cameras, access recordings, manage automations, or invite other users.
- Confirm that their own account uses a unique password and multifactor authentication when available.
- Test the access while you are together. Check both what the person can do and what they cannot do.
Giving access to a guest, caregiver, or cleaner
- Create a named temporary user or guest code instead of reusing a household member’s PIN.
- Set an expiration date or schedule if the product supports one.
- Give access only to the required entry point. A door code should not automatically lead to camera, alarm, or account-management access.
- Record who received the code, why it was issued, and when it should be removed.
- Delete the user or disable the code as soon as the service ends.
Sharing cameras and doorbells
- Review every shared viewer and editor, including people invited months ago.
- Check whether each person can watch live video, view recordings, download clips, change settings, or invite others.
- Use privacy zones, camera schedules, and notification controls where appropriate, especially for indoor cameras.
- Remove access before selling, returning, or relocating a camera.
- Review shared recordings separately. Removing live-view access may not remove clips already downloaded or shared elsewhere.
After a relationship change or move
- Change the primary account password and revoke former household members from every relevant app.
- Remove old lock codes, digital keys, guest invitations, and recovery contacts.
- Review voice assistant household members, linked services, hubs, routines, and shared homes.
- Factory-reset devices that will remain with another person or be transferred to a new owner.
- Check whether the previous resident, landlord, property manager, or installer still has an invitation or administrative role.
- Change Wi-Fi credentials if you cannot confidently identify every connected user or device. See our guide to moving smart home devices to a new Wi-Fi network before reconnecting equipment.
Device-by-device access review
| Device or service | Review these permissions | Good default approach |
|---|---|---|
| Smart locks | Owner role, digital keys, PINs, schedules, activity history, and remote unlock | Use named codes, avoid shared PINs, and remove codes when the need ends. |
| Cameras and doorbells | Live view, recordings, downloads, notifications, settings, and invitations | Give viewing access only when necessary; keep editing and sharing rights limited. |
| Voice assistants | Household members, voice match features, linked accounts, routines, and shopping or purchasing controls | Review connected services and avoid leaving former residents in the household. |
| Hubs and bridges | Administrator accounts, remote access, automations, and linked platforms | Keep ownership with a current resident and remove old administrators. |
| Companion apps | Account recovery, shared homes, invitations, notifications, and device removal | Use individual accounts and confirm the recovery email and phone number are current. |
What to double-check
Owner access is different from household access. A person listed as a member may still have substantial control, but usually not every account-recovery or ownership function. Confirm the exact distinction in the app before assigning a role.
Removing a device is not always the same as removing a person. Deleting a camera from a dashboard may leave the user’s account active, and removing a user from one product may not remove them from the wider smart home platform. Audit each layer separately.
Codes and invitations may survive a change of routine. A temporary code can become a permanent one if nobody records its purpose. Review access history where available, but treat logs as a review aid rather than proof that no one else knows a code.
Account recovery deserves special attention. Check recovery email addresses, phone numbers, backup codes, and trusted devices. If a former resident can reset the owner account, removing their ordinary device permission is not enough.
Shared access can affect privacy. Camera viewers may see household routines, visitors, deliveries, or indoor spaces. Keep camera sharing narrower than general lighting or smart plug access whenever possible.
Common mistakes
- Sharing one administrator password with everyone in the home.
- Using the same door code for family, contractors, and guests.
- Forgetting old phones, tablets, browsers, or smart displays signed in to the account.
- Assuming a platform-wide removal automatically revokes access inside every manufacturer app.
- Leaving an installer, property manager, or previous resident with an owner role.
- Granting camera access when someone only needs a door code.
- Failing to test a new permission, which can lead to either unnecessary access or an avoidable lockout.
- Resetting devices without documenting the new owner, network, or account they should use.
When a device behaves unexpectedly after an access change, distinguish an authorization problem from a connectivity problem. Our guide to smart devices that keep going offline can help separate those issues.
When to revisit
Run a full access review at least when circumstances change, not only on a fixed calendar. Revisit the roster before a vacation, after hosting guests, when a caregiver or contractor finishes work, after a relationship or tenancy change, and whenever you sell, return, or move a device. A quarterly review is a practical routine for homes with several cameras, locks, hubs, or shared users.
Also review access after a major app redesign, account migration, firmware change, Wi-Fi replacement, or security incident. Permission labels and invitation paths can change, so repeat the test instead of relying on an old checklist.
For each review, export or write down the current roster, remove entries that no longer have a purpose, rotate shared codes, verify multifactor authentication, and test one representative permission for every device category. Finish by recording the review date and the next trigger. This turns smart home access management into a repeatable security habit rather than a one-time cleanup.
