Marketing Consultant Access: How to Grant It Without Passwords

This guide does not walk through a single platform. Instead, it builds one shared routine for GA4, Google Ads, Search Console, Meta, and Tag Manager, then points you to our separate walkthroughs for platform steps. As a result, you can hand a new consultant a controlled access package that you can also take back.

We at Talha Aslan and team treat this routine as the first step of any new engagement. Good access setup protects the business, and it also lets the consultant work without waiting on permissions. Menu names can change over time, so focus on the role logic and check the current steps on the official help page.

Why is sharing a password the riskiest option?

Sharing a password hands over everything tied to that account, not only one dashboard. For example, your Google password can open your email, your Drive files, and every other connected service alongside the ad account. In addition, every change appears under your name, so you can never tell later who did what.

Two-step verification also breaks down with this method. The consultant has to ask you for a code at every login, and eventually you start thinking about turning verification off. That decision weakens your security far more than the original shortcut did.

• Scope problem: a password opens the whole account instead of one role.
• Trail problem: the history points to a shared login, not to a person.
• Exit problem: ending access means changing the password everywhere it appears.
• Recovery problem: a changed recovery email makes the account much harder to reclaim.

Therefore, treat a first message asking for your password as a warning sign. Our password generator can help you strengthen your own logins, but those passwords stay with you. Where available, switching to a passkey for passwordless login also adds another layer of protection.

What should you check before granting marketing consultant access?

First, confirm that the accounts actually belong to you. In many businesses, a former employee opened the ad account and a previous agency set up the website. If you are not the owner, you cannot safely assign roles to anyone else.

1. Identify the owner: see who holds the top permission on each platform.
2. Add a second admin: make a trusted colleague your backup administrator.
3. Turn on account security: enable two-step verification on admin logins.
4. Clean the user list: remove people who no longer work with you.
5. Write down the scope: state what the consultant will do on each channel.

The second admin looks like a small detail, yet it is a critical safeguard. For instance, Google's Tag Manager user permissions page recommends at least two administrators so you do not get locked out. You can apply the same logic to the other platforms.

If the accounts turn out to be scattered, sort them out first. Our digital asset management plan offers a good starting point. Likewise, if a former agency still controls your site or domain, finish the steps in taking back your website and domain before you go further.

What does least privilege mean in practice?

Least privilege means giving someone only the role their current task requires. So a consultant reviewing reports does not get editing rights, and a consultant managing campaigns does not get the right to add users. That way, a mistake or a compromised login stays inside a limited area.

This principle does not signal distrust. In fact, a good consultant rarely minds a narrow role, because it also makes their own responsibility clear. When something goes wrong, everyone knows who could touch what.

In practice, ask these three questions:

• What will this person actually do this week?
• What is the lowest role on this platform that allows it?
• Until when do they need this permission?

Most businesses skip the last question. However, some permissions only matter during setup. For example, you can raise a role temporarily to build a connection, then lower it once the work finishes. In short, a role is not a permanent title; it is a permission you adjust to fit the job.

Which role is enough on each platform?

The table below summarizes our starting recommendation for marketing consultant access. That said, the final decision depends on the scope of work, so read it as a framework for your conversation rather than as a rule. The role names come from each platform's official help pages and can change over time.

One point runs through the whole table: even a management role is not the same as ownership. A consultant can run the campaign, but they cannot change who owns the account. That separation is the foundation of a safe setup.

At what level should you assign a GA4 role?

In GA4, choose the level first, then the role. Google's page on GA4 roles and data restrictions defines Administrator, Editor, Marketer, Analyst, and Viewer. An account level role covers every property, while a property level role applies only to that property. So a consultant working on one site usually needs only a property level role.

Here is how the roles differ. A Viewer sees data and settings. An Analyst also shares the explorations they create. A Marketer works with audiences, events, and key events. An Editor manages property settings but cannot manage users. An Administrator can add and remove users.

Two data restrictions also come in handy: No Cost Metrics and No Revenue Metrics. For example, if a content consultant has no need to see revenue, you can block those metrics. Restricted values then show as zero in reports, so tell the consultant in advance to avoid a wrong reading. If your tracking already looks off, see our guide on missing GA4 conversions.

How do you choose a Google Ads access level?

In Google Ads, the scope of the work drives the choice. Google's Google Ads access levels page lists five levels: email only, billing, read only, standard, and admin. Read only suits an account audit. Standard usually covers day to day campaign management.

Admin is different because it adds the right to give access and change access levels. It also handles product links and manager account requests. Therefore, grant it only when the work truly needs it, and only for a limited time.

Remember too that standard access can edit billing information. So make sure the payment method belongs to you and that billing notices reach you. As an example scenario, your accountant could hold billing access, the consultant standard access, and the business owner admin access.

We do not repeat the invitation and removal steps here; our guide on giving an agency access to Google Ads covers them. If you are considering outside help for paid search, our Google Ads management page explains what that scope includes.

When does a manager account link make sense?

A manager account link makes sense when a consultant runs several ad accounts from one dashboard. In this setup, the consultant sends a link request from their manager account, and you accept or reject it as an admin of your own account. As a result, you create a connection between two businesses rather than adding people one by one.

However, this convenience has a price. Once the link exists, your own user list may not show every person on the consultant's team who can see your account. So ask these questions up front:

• Who on your team will see our account?
• How do you close access for someone who leaves your team?
• What happens when we want to remove the link?

If you work with one person or a small scope, a direct user invitation can be more transparent. Also, before accepting a link request, confirm that the sending manager account really belongs to the person you hired. In short, choose the method based on the visibility you need, not on habit.

Why is Search Console ownership a separate matter?

Search Console ownership depends on a verification token, so removing a person from the list is not always enough. Google's page on Search Console users and permissions separates verified owners, delegated owners, full users, and restricted users. For most SEO work, a full user role is a sensible start.

The exit deserves the most attention. According to Google, removing an owner ends their access right away, but their verification tokens remain in place. While a token exists, the former owner can verify again and regain access. Therefore, you also need to clear items such as an HTML file, a meta tag, or a DNS record.

There is one trap here: the same token may also verify another Google service. So check what depends on it before you delete anything. For the practical cleanup, see our guide on removing an old owner or user from Search Console.

What is the difference between adding a person and a partner in Meta?

Adding a person gives one individual access inside your business portfolio. Adding a partner shares your assets with another business portfolio. If the consultant runs a company with its own portfolio, partner access usually stays tidier, because their team works from their own portfolio.

With the partner method, the consultant sends you their business portfolio ID, and you pick the assets and the access level. Meta separates full control from partial access at this point. Partial access covers tasks such as creating content, managing ads, or responding to messages. For that reason, most jobs do not need full control.

What about letting the consultant create the accounts for you? We advise against it. Instead, keep your ad account, Pages, and data sources in your own portfolio, so they stay with you when the relationship ends. For detailed steps, read our guide on agency access in a Meta business portfolio.

Why should you include Tag Manager in the plan?

Many businesses skip Tag Manager because it sits behind the visible side of marketing, yet a change there can add code to your site. So grant publishing rights deliberately. Google defines User and Administrator at the account level, and Read, Edit, Approve, and Publish at the container level.

Edit lets someone create workspaces and make changes, but not create versions or publish. Approve can create versions but cannot publish. Publish carries the full rights. As an example scenario, the consultant edits the tags and the person responsible for your site checks and publishes them. That way, each live change passes through two pairs of eyes.

A small business cannot always keep these duties apart. Even so, if you do grant publishing rights, look at the version history from time to time. Also add other critical assets outside Tag Manager, such as your business email and domain, to the same sheet.

How do you build an ownership checklist?

An ownership checklist is a one page record that shows who owns each asset and who holds which role. A simple spreadsheet is enough. What matters is that every row stays current, because an outdated list can mislead you more than having no list at all.

These rows are an example scenario, so adapt them to your own situation. However, never add a password column. This sheet records access; it is not a password vault.

How should you collect the access request?

The cleanest way is to ask the consultant for a written access list. In other words, they state which role they need on which platform, for which email address, and for what task. This list works as your control document, and it also shows how clearly the consultant has thought through the job.

A good access request includes these points:

• The platform and asset name, such as the GA4 property for your site.
• The role requested and the reason for it.
• The email address or business portfolio ID that receives the invitation.
• Whether the permission is permanent or only for the setup period.

After that, send the invitations yourself and log each one in your sheet. If choosing roles feels confusing, an experienced digital marketing expert can map the list you need to the scope of work. Still, the person sending the invitation should always be someone authorized by your business.

Which email address should receive the role?

Assign the role to the Google Account or work email of the person doing the job. Avoid a shared address like an ads inbox, because you lose the individual trail. On the Google side, the email address identifies the user, and it must be registered with a Google Account.

Apply the same discipline on your side as well. Do not tie company account ownership to an employee's personal Gmail address. Instead, use a permanent admin address on your company domain. Then ownership stays with the company even if that person leaves.

As an example scenario, imagine a business that opened its ad account years ago with an intern's address. If nobody can reach that person, transferring the account can turn into a long recovery process. A company address from day one avoids that problem entirely. It also keeps your recovery details in one place.

Which mistakes make marketing consultant access risky?

Most mistakes come from haste rather than bad intent. A business that wants to start quickly picks the easiest path and then forgets to fix it later. For that reason, we suggest checking the following list on day one.

• Making everyone an admin: it feels easy, but it spreads control too widely.
• Letting the consultant open the account: data and history may not stay with you.
• Keeping one admin only: if that person is unreachable, you lose the way in.
• Forgetting a platform: Tag Manager and Search Console often slip off the list.
• Keeping no record: when work ends, you will not know whom to remove.
• Sharing codes: sending a verification code by message defeats two-step protection.

There is also an opposite mistake: a role so narrow that the consultant cannot do the job. For example, setting up a conversion link may require admin rights in Google Ads. In that case, grant the permission for a short period and then lower it. In short, the goal is not the lowest role; it is the lowest role that gets the job done.

What should you watch on the data and contract side?

The access you grant can also reach customer data. For example, ad audiences, message inboxes, and form entries may contain personal information. So do not treat access as a purely technical setting; address it in the contract too. This section is general information, not legal advice, so please consult your own lawyer about your situation.

These points are worth settling in the contract:

• Who owns the accounts and the data the work produces.
• Which data the consultant can access, and for what purpose.
• How access and assets return to you when the work ends.
• Whether the consultant may bring in subcontractors.

We explain how to phrase these items for SEO work in our SEO contract checklist. In addition, asking for a confidentiality commitment makes sense, especially when you open customer messages to someone outside your company.

How often should you review access?

A review once a quarter is a reasonable start for most small and midsize businesses. This is not an official rule; it is the rhythm we recommend. Also check right away whenever your team or your vendors change.

A marketing consultant access review does not have to take long, because your sheet is already at hand. You open each platform's user list, compare it with your record, and remove anything extra. In Google Ads, admin access can also show users' authentication methods and last login times, which helps you spot unused access.

Take three signals especially seriously: a user you do not recognize, a role increase you cannot explain, and a manager account link you did not request. In any of these cases, close the access first and ask questions afterward. After all, reopening closed access is far easier than repairing damage.

In what order should you grant roles in week one?

Instead of opening everything at once, follow the flow of the work. A consultant first needs to see the current state and only then make changes. That is why starting with review roles on day one is both safe and sensible. The order below is an example scenario that suits a small business well.

1. Day one: grant review roles in GA4, Search Console, and Google Ads.
2. Day two or three: hear the findings and agree on the work together.
3. Later in the week: move to management roles for the work you approved.
4. When setup requires it: open Tag Manager and admin rights for a short time.
5. End of the week: update the sheet and lower any temporary permissions.

Of course, an urgent project can change this order. For instance, if a campaign must start right away, you can move to standard access on day one. Even so, a staged start gives you something extra: you see how the consultant works before granting broad permissions. Once you write this order down, you can also reuse it for the next engagement.

Does the same rule apply to your website, CRM, and other tools?

Yes, the same rule applies there too. Ad and analytics dashboards are only part of the picture, because a consultant may also ask for your site admin panel, email marketing tool, CRM, or social scheduling tool. Most of these tools let you create separate users, although role names vary by product. Check the current options on each tool's own help page.

Be careful with your site admin panel, because an admin role may also allow installing plugins or creating users. A narrower role usually suffices for someone who only edits content. Similarly, the permission to export customer records in a CRM carries its own risk, so keep it off unless the job requires it.

Domain and hosting accounts form a separate class. A mistake there can affect your whole site and your email. So when a DNS record is needed, the better approach is often to add it yourself rather than open the account. In other words, the consultant writes down what to add, and you apply it in your own panel.

What should you do first if something goes wrong?

When you spot suspicious activity, limit access first and ask for an explanation afterward. That covers an unknown user, an unexpected jump in spending, or a connection you did not approve. You do not need to panic, but waiting is not the right move either.

1. Remove the suspicious user or connection.
2. Change your own admin password and check your two-step settings.
3. Review the change history and note what you find.
4. If ad spend is involved, pause campaigns and check the billing side.
5. Contact the platform through its official support channel.

Then talk openly with the consultant, because many problems have a simple explanation. Still, ignore strangers who promise to recover an account for a fee. Use only official channels for recovery, and remember that no method guarantees the outcome.

How do you end marketing consultant access when the work stops?

End marketing consultant access with a checklist on the day the work finishes. Plan it alongside the final delivery rather than waiting for the contract date. Also tell the consultant ahead of time, so they can hand over open tasks and reports.

1. Get the handover: ask for reports, campaign notes, and tag descriptions.
2. Google Ads: remove the user, and also unlink any manager account.
3. GA4: remove the role; deleting a user fully requires an account level Administrator.
4. Search Console: remove the user and clear the tokens if they were an owner.
5. Meta: remove the person or partner from your assets.
6. Tag Manager: remove the user and review recent versions.
7. Close the record: date the sheet and change any password someone shared.

After the removal, run a quick check. Campaigns or tags may rely on a tool tied to the consultant's personal account. So watch your conversion data and ad delivery for a few days after you close the access.

How do you keep continuity when you change consultants?

The biggest risk during a change is having the old and new consultant both hold broad rights at the same time. So plan a short handover period. First give the new consultant a role, then collect handover notes from the old one, and finally close the old access.

This transition stays simple when the assets sit in your own accounts, because the ad history, audiences, and reports remain in place. It becomes harder if the previous consultant owns the account, since some data may not transfer. That is why setting up ownership correctly from the start is the cheapest insurance against future loss.

If you want to clarify the SEO scope for your next engagement, you can review our SEO consulting page. Either way, the routine stays the same: update the sheet, reassess the roles, and close unnecessary permissions.

How do you sum up a safe access routine?

The rule is simple: ownership stays with you, the role goes to the consultant, and the record lives in your sheet. Do not share passwords, invite people individually, choose the lowest role that gets the job done, and remove access the day the work ends. Once you build this routine, you also have a ready template for every future consultant.

Even a single hour reviewing your accounts today can close a major gap. First find the accounts you do not own, then add a second admin. After that, remove the people you no longer work with.

We follow the same marketing consultant access routine when we start a new engagement: the business grants the access, and the assets stay with the business. To see how this works in practice and learn more about our approach, take a look at how digital marketing expert Talha Aslan and team work with clients.

Core guide: What Is Digital Marketing? Its types, examples and how it is done, on one page with an interactive film that travels through the brain.