What is delegated access?

Delegated access is a way for an account owner to let other people work in an account without giving them the username and password. Each person signs in as themselves and can do only what the owner allowed. At an agency, the client is the owner, and your staff are the people allowed in.

How is delegated access different from a shared login?

Delegated access separates getting into an account from owning it. With a shared login, knowing the password gives a person the same rights as the owner. Whatever they do shows up on the platform (a service such as Google Ads or Meta) as the owner’s activity. With delegated access, the owner decides on the platform who may do what. Each person uses their own login, so the platform’s history names the person, as far as the platform keeps history.

How does delegated access work?

Platforms use different names, but delegated access has three parts.

1. Permission levels set how much a person may do, such as view only, edit, or manage. Some platforms call them roles. At an agency, ask only for the level each person’s work needs.
2. An invitation is how access starts. The owner names another person’s login, and that person accepts. At an agency, each staff member gets their own invitation, and no one shares a login.
3. Removal is how access ends. The owner, or someone with admin rights, takes the permission away. At an agency, you ask for removal on each account when staff change.

Some platforms limit the levels on offer or who can remove people, so check before you take on an account.

What can’t delegated access do?

Delegated access works only where the platform offers it. If an admin screen has one username and password and nothing else, it isn’t an option. Even where it exists, some settings and screens may open only to the owner’s login. For those tasks, the owner’s login still gets used.

Delegated access also starts with the owner’s invitation, so the client has to act first. Until it does, you keep using the username and password you were given. Managing client accounts at an agency covers what to do when delegated access isn’t available.

How does delegated access work in Google Ads?

Google Ads Help describes a manager account (MCC) as a Google Ads account “that lets you view and manage multiple Google Ads accounts.” It works at two layers. Between businesses, the client links its Google Ads account to your agency’s manager account. Users with admin access on the client account can unlink it at any time, which is the client’s way to remove access. Inside your agency, staff are invited as users of the manager account and given an access level.

The permission levels are the access levels of the client’s Google Ads account: Email only, Billing, Read only, Standard and Admin. An Admin can grant access, change access levels, and cancel invitations that haven’t been accepted. Removing someone who already has access is a separate step. Google’s help page on managing access describes it: open Access and security and select Remove access next to that user. Manager account users have their own access levels, covered in organizing agency access with a Google Ads manager account. So Google Ads has all three parts: permission levels, invitations and removal.