Giving an agency access to Google Analytics 4 and Google Tag Manager

Google Analytics 4 (GA4) measures how people use a website or app. Google Tag Manager is where you manage tags, the small pieces of code that do that measuring and other tracking on a site. Both let the owner invite each person’s own Google account, which is a form of delegated access. They are separate products, though, and they set access at different levels with different role names.

Where access is set, and who adds and removes people

GA4 sets access at two levels: the account and the property (one website or app being measured). Tag Manager also has two: the account and the container (the set of tags for one site).

Both help centers point toward the account staying with the business that owns the data. Analytics Help defines an account as “a collection of properties whose data is owned by a single legal entity” and suggests one account per company. Tag Manager Help advises that someone inside the organization, rather than an outside agency, manage the account. For your agency, that means the client stays the administrator and invites your staff.

Roles in GA4

GA4 has five roles.

One way to choose: a web design firm that only reads reports gets Viewer. An agency that builds out the measurement setup gets Editor. An ad specialist who decides which actions count as results gets Marketer.

You can also add data restrictions to a role. No Cost Metrics hides cost figures, and No Revenue Metrics hides revenue figures. Restricted values show as 0 in reports. Use them when the person building the site has no reason to see sales.

If your agency works on only some of the client’s sites, ask to be added at the property level. A role given at the account level applies to every property under it. Analytics Help also says a lower level can raise a role but can’t lower it below what was granted above.

Linking Google Ads adds another set of users. When a Google Ads account is linked to a GA4 property, its users get an Analytics role automatically. That role doesn’t open GA4 itself. It lets them use GA4 features, such as audiences built from GA4 data, inside Google Ads. A GA4 Administrator can change that role and its data restrictions, and both last until the link is deleted.

Permissions in Tag Manager

At the account level there are two permissions. An Administrator can create containers and change other users’ permissions. A User sees basic account information and gets no container access unless an admin assigns it. Container permissions are set separately.

A change in Tag Manager reaches the site only when someone publishes it, and only Publish includes that. So the client can give your agency Edit or Approve and keep publishing in its own hands. Tag Manager Help also recommends at least two active administrators.

When your own staff change

Because the client keeps the admin roles, removing someone who leaves your agency means asking the client to do it. A Google Ads manager account works differently: there, your agency removes its own staff.

What to remove when a contract ends

Most of this work falls to the client’s administrators. Give them a list of who you added, and at which level, so nothing gets missed.

1. If you created the client’s property inside your agency’s GA4 account, move it into the client’s account first. Moving a property needs the Administrator and Editor roles on both accounts, so your agency has to take part. Choose to replace the property’s permissions with those of the destination account. If you keep the existing permissions, your staff stay on the property.
2. In GA4 Access Management, remove your staff. Check the account list and each property’s list, since people can be added at either level.
3. In Tag Manager User Management, remove your staff from the account and its containers.
4. Check the Google Ads links. Anyone who still has access to a linked Google Ads account keeps the GA4 role that comes with the link. GA4 can also link to a Google Ads manager account. Then data imported from GA4 is available to every client account under it, so make sure your agency’s manager account isn’t left in the list.
5. If one of your staff was a Tag Manager administrator, confirm the client has its own admin before removing them. Tag Manager deletes an account or container automatically once it has no admin, for example after the only admin’s Google account is deleted. Users with Read access then have 30 days to export its contents from the trash.

GA4’s change history keeps two years of changes, with the time and the person who made each one. Viewing it needs the Editor role. Analytics Help doesn’t say whether adding or removing users appears there.

When staff sign in with the client’s own Google account

Even with invitations available, agency staff sometimes keep using the client’s own Google account. Then the user list and the change history show that one account, and you can’t trace a change to a person. YouTube Help’s advice on protecting a Google account says to “never share your email address and password information with others.” To switch to invitations:

1. Invite each staff member’s own Google account at the level they need.
2. Confirm each person can get in with their own account.
3. Change the password of the client’s Google account, and don’t give the new one to the agency. Until it changes, anyone who knew it can still sign in.