Agency Access to Google Ads: How to Grant Roles Safely

What is agency access to Google Ads and how do you set it up?

Agency access to Google Ads is the permission that lets an agency work inside your ad account while you keep ownership. You can set it up in two ways. You can invite the agency's email as a user, or you can link the agency's manager account (MCC) to your account.

Also, this guide covers the technical and security side only. In addition, if you want to know what a consultant actually does once inside, read what Google Ads consulting includes. Also remember that menu names change over time, so we avoid exact button labels. Always confirm the current steps in the Google Ads Help Center.

What is the difference between a user invitation and a manager account link?

A user invitation gives one person a defined access level in your account. A manager account link connects the agency's management account to yours. With a link, the agency sees many client accounts in one place. You still approve the request and can remove it at any time.

In practice, the difference shows up when staff change. Also, if an invited person leaves the agency, the access stays with that email. With a manager link, another team member can take over inside the agency. So that is why larger agencies usually prefer the link.

Also, treat the table as a general frame. Some agencies use both methods at once, so agree on the approach before you start.

Which access level should you choose for agency access to Google Ads?

The Google Ads Help Center lists five access levels: email-only, billing, read-only, standard and admin. Choose the lowest level that lets the agency do its job. For daily campaign work, standard access is usually enough.

Admin access also lets a person grant or change access for others. For that reason, giving an agency admin rights on day one is rarely necessary.

How do you invite an agency as a user?

You need admin access to invite a user. Open the admin menu and find the access and security section. Then add a new user, type the agency's email address and pick an access level. Finally, send the invitation.

In addition, access starts when the invited person accepts the email. Labels can differ by interface language, so check the Help Center if you cannot find a section.

• Use the agency's business email or the Google account they name, not a personal address.
• Ask for a separate invitation for each agency employee.
• Start with read-only or standard access, then raise it only if needed.
• After sending, check that the address in the user list is correct.

Also, an invite sent to a mistyped address can open access to a stranger. So get the address confirmed in writing first.

How do you link an agency's manager account (MCC)?

Google describes a manager account as a tool that lets you link and manage multiple separate Google Ads accounts from one location. The agency starts the link. In its manager account, it chooses the option to link an existing account, enters your customer ID and sends the request.

You then open the access and security section of your account and find the pending request under the managers tab. Then review it and accept. After that, both sides receive a confirmation email and your account appears in the agency's panel.

1. Send your customer ID to the agency. It is the ten-digit number shown in your account.
2. Ask the agency to send the link request.
3. Check that the manager account name matches what the agency told you.
4. Accept the request and review the access level.

You stay in control here. The agency can request, but nothing links without your approval.

Why should account ownership stay with your business?

Your ad account holds history, audiences, conversion setup and your payment method. Together, these are a digital asset. If the account lives inside the agency's own structure, moving it later becomes hard and sometimes impossible.

So we recommend opening the account with your own Google account and business details. The agency then receives access only. For example, if you add the agency as a user and later switch agencies, your history stays with you.

• Open the account with a business email, not a personal one.
• Name at least two admins. Google also warns about relying on a single administrator.
• Register the payment method under your business name.
• Write your customer ID and account details in your own records.

This is also the working principle of Talha Aslan and team: the account stays with the client, and we receive access. It is how we work, not a claim about results.

Which security steps matter most when you grant agency access to Google Ads?

First, make sure everyone signs in with their own Google account. Second, turn on two-step verification for your accounts and ask the agency to do the same. Third, limit the access level to the job. As a result, even a compromised account can do only limited harm.

• Enable two-step verification for everyone with admin access.
• Review the user list at least every three months.
• Remove people who no longer work on the account right away.
• Ask the agency to confirm in writing that its own team uses two-step verification.
• Check the access list first if you receive a suspicious notification.

In addition, weak account security makes the ad account weak too. For recovery scenarios, see our guide on what to do when a Google Ads account is suspended.

Also avoid sharing passwords. A shared password hides who did what. It also exposes your verification codes and every connected Google service.

Why is sharing a password the wrong approach?

A shared login gives the agency your whole Google identity, not just the ad account. When you part ways, you must change the password, and every connected service is at risk during the switch. Invitations and manager links exist precisely to avoid this.

Using someone else's account, or trying to bypass verification, also counts as circumventing Google's systems. That can put your account at risk. So a good agency will not ask for your password.

• Question any agency that asks for a password.
• Invite users instead of handing over your own login.
• Tie access to a role, not to a person's credentials.

Who should control payment and billing access?

Payment details are your financial data. Therefore, you do not have to give billing access to the agency. Paying with your own card or payment profile also keeps spending under your control.

Some businesses use the agency's card. In that case, put the spending and invoice process into a written agreement. We prefer to work with the client's own payment method.

• Set the monthly budget cap with the agency in writing.
• Check invoices and payments yourself on a regular basis.
• Ask your accountant about tax questions. This article is not tax or legal advice.

To plan a cap, try our Google Ads budget calculator.

How do you give an agency Google Analytics access?

Google Analytics access is managed separately from Google Ads. A person with admin rights on the property can add the agency as a user. Reading ad performance usually needs only an editor or viewer role. However, confirm the current role names in the Analytics Help Center.

The agency may also need to link Analytics data to Google Ads. That link often requires admin rights on both sides, so make sure you keep an admin on your side.

• Grant access at the property level. Do not open the whole account unless needed.
• Write down the role you gave.
• Verify together in the first week that conversions are measured correctly.

If you need the basics first, read what GA4 is and its benefits.

What is the checklist for Tag Manager and Merchant Center access?

An ad account does not work alone. It needs tags, product data and measurement. Each tool has its own access list, so apply the same discipline to each one.

For tags, see our Google Tag Manager guide. For product feeds, read about Google Shopping and Merchant Center.

How do you take back access when you change agencies?

When you part ways, close access in a clear order. First, list every user and manager link that is active. Then give the new agency what it needs. Finally, remove the old agency once the handover is complete.

1. List all users and manager links in the access and security section.
2. Remove the old agency's users one by one.
3. Remove the manager link if one exists.
4. Repeat the cleanup in Analytics, Tag Manager and Merchant Center.
5. Hand over campaign setup, conversion definitions and audiences with documentation.
6. Review the user list again after two weeks.

If you opened the account yourself, you lose no data. If the agency opened it inside its own structure, you may need to export your history.

What should you ask an agency before granting access?

A few clear questions prevent most later problems. The answers also show how the agency works. An honest agency answers them easily.

• Who will open the account, and in whose name will it be?
• Which access level do you need, and why?
• How many people will have access, and does everyone use two-step verification?
• What is your handover plan for data and setup if we part ways?
• How will you tell us about changes you make?

For a wider list, see our post on the SEO and Google Ads consulting checklist.

How do you manage several agencies at the same time?

Some businesses hire separate teams for ads, SEO and web design. Giving all of them the same access is a mistake, because each team needs only its own tools. For example, an SEO team does not need to edit campaigns.

So build an access matrix. Put tools in rows and teams in columns, then write the lowest needed role in each cell. This way you see who can reach what at a glance. When one team leaves, you remove only its column.

• The ads team gets Google Ads and Tag Manager access.
• Search Console and Analytics access go to the SEO team, but not the ad account.
• The web design team gets site access only.
• Update the matrix every three months and note the date.

What happens if your own admin leaves the company?

Many access problems come from inside the business, not from the agency. The employee who created the account leaves, and that person was the only admin. Google warns that with a single administrator you may lose access if that user becomes unavailable.

So tie the admin role to a position, not to one person. For example, let the owner and a senior manager both be admins with business emails. Also finish the access handover before the employee leaves.

1. List the tools where the departing person is an admin.
2. Add the replacement as an admin.
3. Remove the departing person's access.
4. Move the payment method to a company card if it sat on a personal one.

How can you tell a fake access request from a real one?

Not every link request comes from your agency. Bad actors sometimes send emails that imitate invitations or manager requests. So check the source before you accept anything.

The rule is simple: do not accept requests you did not expect. Even after talking to the agency, confirm the manager account name and ID through a separate channel, such as a phone call. That way, a fake request cannot hide behind a real agency's name.

• Sign in to your account directly instead of clicking the email link.
• Check pending requests only inside the access and security section.
• Decline requests from manager accounts you do not know.
• If something looks wrong, review the user list and payment settings at once.

What should you set up with the agency in the first week?

Granting access is only the start. The first week is when you confirm that the account rests on a healthy base. Hold a short kickoff call and review the current state together.

Next, check measurement. If conversions are counted wrongly, optimization follows the wrong signal. Also agree on the budget cap, reporting rhythm and contact channel. As a result, you avoid confusion in later months.

• Archive a copy of the current campaign and conversion setup.
• Confirm in writing what each conversion event counts.
• Agree on the report format and date.
• Set an approval rule for changes, such as budget increases needing your sign-off.

How do you keep an eye on the account after granting access?

Trust is not the same as giving up oversight. A light, regular review keeps both trust and transparency. Check the user list, the change history and the payment settings on a schedule.

Google Ads records changes in the account, and you can view that history. Menu names may shift, so confirm the current path in the Help Center. Once a month, compare the change history with the agency's report. If a budget or bidding change is missing from the report, ask why.

You can also run our Google Ads audit tool for a quick health view.

• Is there an email address in the user list you do not recognize?
• Do the budget and bid strategy match what you expect?
• Is auto-apply for recommendations on? See our guide to turning off auto-apply recommendations.
• Does conversion tracking still work?

Which clauses about access belong in the contract?

A contract matters most where verbal promises fade. A few simple clauses protect your business. This section is a general frame, not legal advice, so ask your lawyer for binding wording.

• The account, payment method and data belong to your business.
• The agency team uses only the access needed for the work.
• Access is removed within a set period after the contract ends.
• Setup documents and conversion definitions are handed over to you.
• All agency staff use two-step verification.

With these clauses, a written process takes over at the moment of separation, not an argument.

Which access mistakes do we see most often?

The mistakes we meet most are simple and easy to prevent. They usually appear when people rush or trust blindly. The list below comes from example scenarios, not statistics.

• The account is opened inside the agency's manager account in the agency's name.
• There is only one admin, and that person leaves the company.
• Agency staff share one login.
• The old agency's access is never removed.
• Two-step verification is off.
• Analytics and Tag Manager access is forgotten.

Example scenario: a business changes agencies but forgets to remove the old user. Months later, that user still has standard access. A regular user review closes this gap. For a broader list, read Google Ads mistakes that waste budget.

Is it a red flag when an agency wants full admin control?

Not always, but you should ask why. Some agencies request admin access because their workflow needs to link tools. However, most day-to-day work runs on standard access. So ask which exact task needs the higher level, and then decide.

A good answer is specific. For example, the agency may need to link Analytics to the ad account, and that step requires admin rights. In that case, grant admin for the task, then lower the level afterward. A weak answer is vague, such as "we always need full control." That is a reason to pause.

Also be careful with any request that tries to move ownership into the agency's structure. Your account should stay under your business, so treat that request as a warning sign. Finally, remember that the safest agencies are happy to document their access in writing.

What does a safe onboarding timeline look like?

A calm onboarding takes about two weeks and follows a clear order. First, you decide who owns the account and name two admins. Second, you send the invitation or approve the manager link. Then you give the agency roles in the other tools it needs.

In the first week, you review measurement together. Next, you agree on the budget cap and the report schedule. In the second week, the agency starts campaign work, and you check the change history once. After that, you set a recurring reminder to review the user list every three months.

This timeline is an example, not a rule. For instance, smaller accounts can move faster. Larger accounts with several tools may need more time. However, the order stays the same: ownership first, access second, work third. That sequence keeps control with your business from the start.

How do you put everything into one checklist?

The list below sums up what to do before and after you grant access. Print it and review it with your agency in the first call. Always confirm current menu names in the official Help Center.

1. Decide which business Google account owns the ad account.
2. Name at least two admins and turn on two-step verification for both.
3. Pick the lowest access level the agency needs.
4. Choose between a user invitation and a manager account link.
5. Ask for separate access for each agency employee. Never share passwords.
6. Grant roles in Analytics, Tag Manager and Merchant Center one by one.
7. Agree on the payment method and budget cap in writing.
8. Review the user list every three months.
9. Remove all access in order when you change agencies, and document it.

To track results, our UTM builder and ROAS calculator help. If you want to set up your account together, see our Google Ads management service.