Currently staff which Instagram and Tweet as WMSE are often logged directly into the main account.
When on a desktop Tweetdeck can be used to instead give access to a user account. However this doesn't work on mobile so we should investigate if enforcing that is a blocker.
Similarly Instagram has some business account settings which could be investigated (by someone who uses Instagram)
For Twitter: A first thought is to tell desktop users to switch over to tweetdeck, then update the password, then log into twitter and kick all older sessions. Users who need to work-tweet from their mobile (from events etc.) will just have to re-log in which shouldn't be the end of the world
I logged out all older sessions for both Instagram and X/Twitter. I was required to enable two-factor authentication for Instagram log-in to enable some advertising features.