# Giving an agency access to Microsoft Advertising, and removing it

The client invites each person with a role, or links its account to your manager account. Campaign or Standard fits daily work. Unlinking removes everyone.

Updated: October 16, 2026

A client can bring your agency into Microsoft Advertising in two ways. It can invite your staff one by one as users and give each a role. Or it can link its ad account to your agency's manager account, which Microsoft Advertising Help calls account linking. Either way, your staff sign in with their own Microsoft accounts and never need the client's password. The idea behind this is covered in [what is delegated access?](/guides/agency-accounts/what-is-delegated-permission)

## Accounts and manager accounts

Microsoft Advertising has two levels. An account serves ads and holds campaigns, ad groups, keywords and budgets. A manager account (also called an MCC) is a container for accounts. Users and their roles, payment methods, UET tags (the code that tracks conversions) and remarketing lists can be shared from a manager account to the accounts under it.

The first sign-up creates both at once, so your client has a manager account of its own, just as your agency does.

One person can hold a different role in each manager account they can reach. For example, someone can be a Viewer in one manager account and a Super Admin in another. Staff can see their accounts and roles on the Manage my user access page, opened from the profile picture in the upper-right corner.

## Four roles, and which one fits agency staff

The roles are Super, Standard, Campaign and Viewer. Some Help pages use the longer names Super Admin, Standard User, Advertiser Campaign Manager and Viewer. These rows from the role comparison matter most when choosing a role for agency staff.

| Action | Super | Standard | Campaign | Viewer |
| --- | --- | --- | --- | --- |
| Manage campaigns | Yes | Yes | Yes | No |
| Run reports | Yes | Yes | Yes | Yes |
| Create, edit, approve or cancel insertion orders | Yes | Yes | No | No |
| Add, edit or delete payment methods | Yes | No | No | No |
| Give access, edit access and delete users | Yes | Partly | No | No |
| Approve or reject a manager account's request to link to an account | Yes | Yes | No | No |
| Send link requests and unlink requests | Yes | No | No | No |

An insertion order is what an account on monthly invoicing needs to keep serving ads. "Partly" means a Standard user can add and remove Standard, Campaign and Viewer users but can't edit or remove a Super user.

So Campaign and Standard differ on insertion orders, user management and approving link requests. If your staff build ads and adjust budgets, Campaign is enough. If your agency also creates insertion orders, it needs Standard. That role also lets the person invite other users and approve link requests. Microsoft recommends starting with the lowest access the work needs.

Super users can be added only at the manager account level, and they automatically get every current and future account under it. A Super user can also change payment methods and unlink accounts. For those reasons, a client is better off not giving Super to agency staff.

## Inviting users (multi-user access)

The invitation comes from someone on the client's side who can manage users, a Super or Standard user. They go to Settings, then User management, select Invite user, and enter your staff member's email address and role. Your staff member follows the link in the invitation email. They have 30 days to activate after the email arrives, and they sign in with a Microsoft account.

One user name that reaches accounts owned by different businesses is called multi-user access. A staff member who serves several clients keeps a single login of their own.

This route doesn't involve sharing one login across your team. The account security page recommends one email address and password per person. Its reasons: a shared login is hard to keep secure as people come and go. The email address behind it is tied to personal information and to products such as Outlook. And change history gets harder to read by person. The same page says not to disclose passwords or PINs to coworkers. The Microsoft Services Agreement, section 4(a)(i), says "You cannot transfer your Microsoft account credentials to another user or entity."

## Linking to your agency's manager account

For a link, your agency sends a request with the client's account number. A client user with the Super or Standard role approves it. The client has 30 days to respond, after which the request is declined automatically. For security, a request can't be accepted until 6 hours after it was sent.

Once the link is approved, your agency becomes a direct manager of that account. A direct manager has full control, including the option to take over billing and become the account's payer (Microsoft's term is bill-to customer). Before you take over billing, Microsoft suggests an agreement with whoever pays today. An account can have up to five direct managers.

A direct manager can add or remove other direct managers through link requests. It can't remove the users the client manages, such as its Super or Standard users. So approving a link hands over full control of the account, but not of the client's own users.

This setup is called a hierarchy. It lets a whole team from another manager account work on the account, and unlinking removes that team's access at once. Inviting users is the opposite: access is added and removed one person at a time. Staff who reach the client through a link are users of your agency's manager account, so you manage them in your own User management.

## Removing access

For an invited staff member, a client user with the Super or Standard role goes to Settings, then User management, selects the person, and chooses Delete. Your staff member can also remove themselves: on Manage my user access, they choose Delete access next to that manager account.

On the person's last day, open Manage my user access with them. It lists every manager account they can reach and their role in each, so you can see which clients are left. If someone leaves suddenly and can't do this, the client deletes them.

At the end of a contract, end the link. On the client's side, Settings, then Direct managers shows the account owner and every direct manager, and Unlink starts the removal on a chosen date. Your agency can also unlink from the Accounts Summary page and pick the date. A scheduled unlink can be canceled before it happens. An immediate one can't.

Check billing before anyone unlinks. Postpay threshold and monthly invoice accounts are billed after the ads run. If your agency is the bill-to customer on one and unlinks, the account pauses for up to 3 hours. Microsoft suggests agreeing with the client on the downtime and the next bill-to customer first. If the client unlinks you while you pay, the client becomes the bill-to customer and needs a payment method ready.

The Change history page shows six months of changes to campaigns, ad groups, ads and keywords, and the Changed by filter narrows it to one person. With one user per staff member, you can show whose changes came before a handover and whose came after.


## Frequently asked questions

**Should agency staff get the Super role?**

Better not. A Super user reaches every current and future account under the client's manager account and can change payment methods. Campaign or Standard covers day-to-day work.

**What's the difference between inviting users and linking accounts?**

Invited users get a role one at a time and are removed one at a time. A link makes your agency a direct manager that can take over billing, and unlinking removes your whole team at once.

**What does the client do when our account lead changes?**

If the person was invited, a Super or Standard user deletes them in User management. Your staff never had the client's password, so nothing needs changing.

**Can our team share one Microsoft Advertising login?**

Microsoft Advertising Help recommends one email address and password per person. With a shared login, every change shows the same user, so the change history can't tell people apart.

**Will ads stop if we unlink at the end of a contract?**

If your agency unlinks while it is the bill-to customer on a postpay threshold or monthly invoice account, the account pauses for up to 3 hours. Agree with the client on timing and on who pays next.

## Sources

- [Microsoft Advertising Help: How do I give someone access to my Microsoft Advertising account?](https://help.ads.microsoft.com/#apex/ads/en-us/52037/0)
- [Microsoft Advertising Help: Hierarchies in Microsoft Advertising](https://help.ads.microsoft.com/#apex/ads/en-us/60035/0)
- [Microsoft Advertising Help: Linking to an existing account](https://help.ads.microsoft.com/#apex/ads/en-us/56854/0)
- [Microsoft Advertising Help: Choosing between a hierarchy or multi-user access](https://help.ads.microsoft.com/#apex/ads/en-us/60036/0)
- [Microsoft Advertising Help: How do I access Microsoft Advertising as an invited user?](https://help.ads.microsoft.com/#apex/ads/en-us/52093/0)
- [Microsoft Advertising Help: Managing your user name to access multiple accounts](https://help.ads.microsoft.com/#apex/ads/en-us/56867/0)
- [Microsoft Advertising Help: What changes were made to my campaigns and can I undo them?](https://help.ads.microsoft.com/#apex/ads/en-us/50840/0)
- [Microsoft Advertising Help: Best practices to help protect your Microsoft Advertising account](https://help.ads.microsoft.com/#apex/ads/en-us/52087/0)
- [Microsoft Services Agreement, section 4(a)(i)](https://www.microsoft.com/en-us/servicesagreement)

## How Junify handles this

**Doing this by hand** You agree with each client on how access is handed over, add and remove people platform by platform whenever staff change, and keep track of which staff member used which client's account.

**With Junify** Microsoft Advertising lets a client invite each staff member, so use that. Junify is for the client's other tools where your team still shares one login, so every departure means asking the client for a new password. Agree with the client to change the password at setup so only Junify holds it. Staff sign in without seeing it, each use is recorded under the person's name, and once you remove someone in Junify, they can't sign in again.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=marketing-ops&from=guide&cluster=agency-accounts&slug=microsoft-ads-agency-access)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Account clauses an agency should propose in its client contract](/guides/agency-accounts/account-clauses-for-service-providers): Propose five: account handover, who may use accounts, records, incident notice, and offboarding. Keep your own promises apart from what the client must do.
- [How to write client account handling into your agency's security policy](/guides/agency-accounts/agency-security-policy-for-clients): Write a short public policy, an internal policy for staff, and an access summary for each client. Rewrite template rules for logins the client owns.
- [Amazon Seller Central user permissions, and how to give an agency access](/guides/agency-accounts/amazon-seller-central-user-permissions): Seller Central Help says not to share logins. On a Professional plan, the seller invites staff as employees and authorizes your agency as a Service Provider.