# Giving an SEO agency access to Google Search Console, and removing it

A property owner adds each agency person by Google Account as a full or restricted user. If the agency verified the site itself, removal takes one more step.

Updated: November 10, 2026

To let an SEO agency work in Google Search Console, a property owner adds each agency person by Google Account and picks a permission. No password changes hands. One step at the end is easy to miss. If someone at the agency proved ownership of the site themselves, removing them from the user list doesn't fully remove them. Adding people this way is a form of [delegated access](/guides/agency-accounts/what-is-delegated-permission).

## Owners and users

Search Console Help describes two kinds of owner and two kinds of user for a property, which is the site or domain you track.

| Permission | How a person gets it | How it's removed |
| --- | --- | --- |
| Verified owner | Proves ownership of the site, for example with a DNS record, an HTML tag or an uploaded HTML file | Remove the person, then delete their proof from the site |
| Delegated owner | An owner adds them on the Users and permissions page | An owner chooses Remove access |
| Full user | An owner adds them | An owner chooses Remove access |
| Restricted user | An owner adds them | An owner chooses Remove access |

Both kinds of owner can do everything: add and remove users, change settings, see all data and use every tool. The difference shows when people leave: "A property must have at least one verified owner, or no users will have access to the property." So a verified owner is the one account your access can't do without.

Help also lists associates. They can't open your Search Console data directly, so they aren't a way to bring agency staff in.

## What full and restricted users can do

Help's permission table shows where the two user levels stop.

| Action | Owner | Full user | Restricted user |
| --- | --- | --- | --- |
| View Performance and Links reports | Yes | Yes | Yes |
| Submit a sitemap | Yes | Yes | No |
| Request URL removals | Yes | Yes | View only |
| Disavow links | Yes | Yes | No |
| File a reconsideration request | Yes | Yes | No |
| Inspect a URL | Yes | Yes | Fetch only |
| Change of Address | Yes | View only | View only |
| Link a Google Analytics account | Yes | No | No |
| Add users | Yes | No | No |
| Add or remove owners | Yes | No | No |

Full user covers the daily work of most SEO engagements: reading reports, submitting sitemaps, checking indexing and asking Google to recheck fixes. Restricted user fits someone who only reads the numbers. A restricted user only gets the messages that affect them, so don't rely on that person to see every alert.

Make the agency a delegated owner only when the work needs an owner-only action, such as linking Google Analytics or a site move with Change of Address. An owner can add other owners and remove your own staff's access, so treat it like an admin role. For the Analytics side, see [giving an agency access to Google Analytics 4 and Google Tag Manager](/guides/agency-accounts/ga4-gtm-agency-access).

## Adding agency staff

1. In Search Console, open the property, then Settings, then Users and permissions. The page appears only for owners.
2. Select Add user and type the Google Account email address of the person.
3. Pick the permission, usually full or restricted, and save.

Each person needs their own Google Account, and Help says "An email group cannot be added as a user." So the agency's shared address or mailing list won't work. Ask for the names and addresses of the people who will do the work, and add them one by one.

A property can hold up to 100 non-owner users. You can add delegated owners until the property has 500 owners of both kinds. There is no limit on verified owners.

If Search Console answers "This user may only be added as 'Owner'," the person already owns a larger property containing this one and can't be given less here.

## How an agency ends up as a verified owner

When an agency sets Search Console up for a client, whoever does the setup has to prove they control the site. They upload an HTML file, add a tag to the homepage, add a DNS record, or rely on an existing Google Analytics or Tag Manager setup. Each proof is tied to the person who created it, so the person who did the setup becomes a verified owner under their own Google Account.

That leaves your access resting on an agency employee's account. If that person is the only verified owner and their proof disappears, every user loses access after a grace period. Search Console keeps collecting data, but no one can see it until someone verifies again.

To fix this while the agency is still engaged, have someone at your company verify ownership with their own Google Account. This doesn't displace the agency's owner: several people can be verified owners of one property, each with their own proof. If your person uses the same method the agency did, add their proof alongside the agency's. Help warns not to overwrite another owner's proof.

An agency person can also become a verified owner later, without you. If your homepage carries a Google Analytics or Tag Manager tag, Search Console accepts that tag as proof of ownership. The person needs enough rights in the account behind the tag: edit rights for Analytics, or Publish or Admin permission for Tag Manager. So check the owner list after you grant either one to agency staff.

## Removing an agency

For delegated owners and users, removal is one action. On Users and permissions, an owner opens the menu beside the person's name and chooses Remove access. The change should take effect quickly.

For a verified owner there are two steps.

1. Remove the person on Users and permissions, the same way as any user. They lose access immediately.
2. Delete every proof of ownership that person left on the site. Search Console lists them in a popup as you remove the person, and again under "Unused ownership tokens" on the same page.

Until those proofs are gone, Help says, "the removed owner will be able to re-verify ownership if they choose to." Current owners are notified if that happens, but by then the access is back. What you delete depends on the method they used.

| Method they used | What to remove |
| --- | --- |
| HTML file upload | That person's verification file at the root of the site |
| HTML tag | That person's google-site-verification tag in the homepage source |
| Domain name provider | The DNS record tied to that person |
| Google Analytics | Their edit rights in the site's Google Analytics account |
| Google Tag Manager | In Tag Manager, that person's Publish or Admin permission |

Help adds a caution before you delete anything: "The same verification token can be reused across various services," and it names Merchant Center and Google Workspace. So check what else relies on a file or record first, and remove only the one that belongs to the person who is leaving.

After the agency leaves, open the Ownership history link on Users and permissions. It lists owners added and removed and every verification attempt, so you can confirm no one verified again. If an owner you don't recognize appears, Help's first advice is to email that person, since it may be a colleague's other address. If they don't answer, remove them and their proof, and treat it as a possible sign the site was hacked.

When the engagement ends, go through the [account handover checklist](/guides/agency-accounts/handover-checklist) for the other platforms.


## Frequently asked questions

**Which Search Console permission should an SEO agency get?**

Full user fits most SEO work. It sees all reports and can submit sitemaps, request URL removals and disavow links. It can't add users, add or remove owners, or link a Google Analytics account.

**Can we add the agency's group email address as a user?**

No. Search Console Help says an email group can't be added as a user. Add each agency person by their own Google Account.

**We removed the agency, but Search Console warns it could regain access. Why?**

Someone at the agency was a verified owner, and their proof of ownership is still on your site. Delete the file, tag or DNS record listed under "Unused ownership tokens," or they can verify again.

**The person who verified our site left. What happens?**

If no verified owner is left, every user and delegated owner loses access after a grace period. Have a current employee verify ownership, then remove the old owner's verification file, tag or DNS record.

**How many users can one Search Console property have?**

At most 100 non-owners (full users, restricted users and associates). You can add delegated owners until the property has 500 owners of both kinds, and there is no limit on verified owners.

## Sources

- [Search Console Help: Managing owners, users, and permissions](https://support.google.com/webmasters/answer/7687615?hl=en)
- [Search Console Help: Verify your site ownership](https://support.google.com/webmasters/answer/9008080?hl=en)
- [Search Console Help: I don't recognize this new owner](https://support.google.com/webmasters/answer/7281924?hl=en)

## How Junify handles this

**Doing this by hand** You agree with each client on how access is handed over, add and remove people platform by platform whenever staff change, and keep track of which staff member used which client's account.

**With Junify** Search Console adds each person by their own Google Account, so use that. Junify is for an agency that still reaches a client's other accounts with one shared login. Junify recommends that the agency and the client change that password at setup, so only Junify holds the new one. The agency's staff sign in without seeing it, and each use is recorded under the person's name. A staff change then means removing access in Junify, not a new password.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=marketing-ops&from=guide&cluster=agency-accounts&slug=google-search-console-agency-access)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Giving an agency access to Google Merchant Center](/guides/agency-accounts/google-merchant-center-agency-access): An admin adds each agency person by Google Account. Where Merchant Center for Agencies is available, the agency can request a link instead. No login is shared.
- [Giving an agency access to Klaviyo or Mailchimp without sharing your login](/guides/agency-accounts/klaviyo-mailchimp-agency-access): Mailchimp lets an agency connect its own account to yours at a level you choose. In Klaviyo, an Owner or Admin adds each agency person as a user with a role.
- [Giving an agency access to a LinkedIn Page and ad account](/guides/agency-accounts/linkedin-page-ad-account-agency-access): A LinkedIn Page has no password to share. A super admin gives each agency person a Page role, and an Account manager on the ad account adds them there.