How to Share Access to Marketing Accounts: Google and Meta

Onboarding a new agency, hiring a freelancer or handing work to an in-house marketer always starts the same way: someone asks you to share access to marketing accounts you have never opened the settings of. This guide is the answer to that email — every platform, the current menu path, the right permission level, and the mistakes that cost businesses their ad accounts.

Screenshots are deliberately not included. Google and Meta redesign these screens every few months; menu paths and permission names survive far longer, and every path below was checked against the official documentation in September 2026.

Three rules before you share access to marketing accounts

• Never share a password. Every platform here supports named user access. A shared login breaks the audit trail, breaks two-factor authentication, and means offboarding requires a password change that locks out everyone at once. It is also the fastest way to trigger a security review on a Meta account.
• You own the assets, the agency gets access. If an agency creates your ad account, your Page or your pixel inside their own business portfolio, they own it. When the relationship ends you may leave without the account, the conversion history and the custom audiences built on years of your traffic. Create the asset yourself, then grant access.
• Grant the lowest level that lets them work. Admin rights are for people who need to add other users. A media buyer does not.

Google Ads

In your Google Ads account, open Admin, then Access and security. Click the plus button, enter the person’s email address and pick an access level. They receive an invitation they have to accept.

• Email only — receives notification emails, no access to the account.
• Read only — can browse the account and reporting, cannot change anything.
• Standard — can view, edit and manage the account. This is the level a media buyer needs.
• Admin — everything Standard can do, plus managing users and account hierarchy.
• Billing — view and edit billing information only.

Google Ads also lets you set an access expiration date when you invite someone. For a fixed-term contractor this is worth using: access ends on its own rather than depending on you remembering to remove it.

Linking an agency manager account instead

Agencies usually prefer a manager account link over a user invitation, because it keeps all clients in one place. For that they need your ten-digit customer ID, shown in the top corner of your account. They send a link request from their manager account, and you approve it under Admin, in the managers section.

The practical difference matters: a manager link gives the agency access at the account level and can be severed by you in one click, without touching individual users. A manager account can also be granted billing responsibility, so check what you are approving.

Google Analytics 4

Open Admin, then Account access management for the whole account or Property access management for one property. Add the person by email and choose a role.

• Viewer — sees settings and data, can build explorations.
• Analyst — Viewer, plus sharing explorations and other collaborative assets.
• Marketer — can create and edit audiences, events and key events. The right level for someone running campaigns.
• Editor — full control of settings at that level, but cannot manage users.
• Administrator — full control including user management.

Two data restrictions can be applied on top of any role: No cost metrics and No revenue metrics. If you want an external partner to see performance without seeing your margins, this is the control to use rather than refusing access altogether.

One thing to unlearn: GA4 has no views. If someone asks you for view-level access, they are working from Universal Analytics instructions and the rest of their brief is probably just as old.

Google Tag Manager

GTM separates account and container permissions, and the distinction is the whole point. Open Admin, then User Management at account level, or container-level user management for a single container.

Account permission is simply User or Admin. Container permission is where the risk lives: Read, Edit, Approve, Publish. Publish rights mean that person can push a change live to your website without review. Give Edit to anyone who builds tags and keep Publish inside your own team unless you have a specific reason not to.

Google Search Console

Open Settings, then Users and permissions, and add the email address.

• Owner — full control including adding users and removing the property. Verified owners cannot be removed by other users, only by giving up verification.
• Full — sees all data and can take most actions. This is what an SEO agency needs.
• Restricted — view-only for most reports.

Check which property you are sharing. A domain property covers every subdomain and protocol; a URL-prefix property covers only the exact prefix. Agencies asked to work on a migration need the domain property or they will be blind to half the site.

Google Merchant Center

Open Access and services, then the People and access tab, and click Add person. Enter the email and pick an access type: Admin, Standard, Read-only or Email-only, plus optional roles such as Performance and insights.

Standard is enough for a shopping specialist. Admin is only needed to add further users or change account-level settings.

Google Business Profile

For a local business this is often the most sensitive asset you own, because whoever holds Owner can remove everyone else. Share Manager, not Owner, and keep primary ownership in a company account nobody leaves with.

Meta: business portfolio, Pages and ad accounts

Meta changed both the naming and the mechanics here, and most instructions online are still describing the old Page Roles screen that no longer applies to Pages inside a business portfolio.

Facebook Page

Go to Meta Business Suite on a desktop computer, open Settings, and under Profiles click Pages, then select the Page. Click Assign people, find the person, and choose the access type:

• Partial access (business tools only) — they work through Business Suite with task-based permissions you pick individually.
• Partial access (business tools and Facebook) — as above, plus the ability to act as the Page on Facebook itself.
• Full access — can manage every Page setting.

You need full access to the Page or to the portfolio to grant access to anyone else. If the person is not yet in your portfolio, you can request that they be invited and given Page access, and someone with full portfolio access approves it.

Meta ad account

Same place, different asset: Settings, then Ad accounts, select the account, assign people, and choose between partial and full access. A media buyer needs the ability to create and edit campaigns and to view performance; they do not need to manage other users.

Agency access: use partner sharing, not personal profiles

If your agency has its own business portfolio — and any established one does — do not add individual employees to your assets. In Business Settings, open Partners, add a partner using their business portfolio ID, and assign them the specific Page and ad account they need.

This is the single most useful thing in this article. Partner sharing means staff turnover at the agency is their problem, not yours; you revoke one partner and every person behind it loses access at once; and your assets stay in your portfolio, which is exactly where they should be if the relationship ends.

What to do when the work ends

Offboarding is where most businesses quietly lose control of their marketing stack. A short checklist, run on the last day rather than six months later:

• Remove the partner in Meta Business Settings, and remove individual users if any were added directly.
• Unlink the Google Ads manager account and remove any user invitations that were accepted.
• Remove users from GA4 at both account and property level — they are separate lists.
• Check Search Console for verified owners, not just users. An owner added through a verification method you forgot about keeps access after you remove them from the users list.
• Revoke GTM container publish rights before anything else. Live tag access is the highest-risk permission on this list.
• Confirm every asset still sits in your own portfolio or account, not the agency’s.

If the account was built in the wrong place

Discovering that your ad account, pixel or Page lives inside a former agency’s portfolio is unpleasant but not always terminal. Meta allows assets to be moved between portfolios with cooperation from both sides, and a Page can be claimed back if you hold full access to it. It needs goodwill, and goodwill is scarcer after a relationship ends than during it — which is the argument for getting the ownership right at the start.

If you are auditing an inherited setup and are not sure what you actually own, that is a normal first step in any handover. Our team does this as part of onboarding, and a standalone ad campaigns audit covers account structure and access alongside performance. If Meta assets are the messy part, the Facebook and Instagram ads team handles portfolio and partner cleanups regularly.

A related problem worth knowing about before it happens: if an account you share access to gets restricted, the appeal has to come from an admin. See what to do when your Facebook ad account is blocked.