How to give an agency access to Google Analytics 4

In Google Analytics 4, open Admin, and under Property click Access Management. Click +, then Add users, enter the agency person's Google account email, choose a role and click Add. Do it on the property, not the account: Google says a user added at account level also gets access to every property in that account.

This guide is for the person who looks after the business's Analytics. The agency only has to send you the email address it wants added.

Property or account?

A Google Analytics account can hold several properties, for example one for each website or app. Google's user management article explains that the level you add someone at decides what they reach:

• Added to the property: they see that property only, with the role you give.
• Added to the account: they see every property in the account, with the same role.

Roles set on the account pass down to every property, and Google says a person's effective access is the most generous role they hold. So if the agency only works on one website, add it on that website's property and nowhere else. If you already added the agency at account level by mistake, removing the account-level access and adding them on the property is the way back. If your property sits in the agency's own Analytics account instead, see how to move a GA4 property to your account. Giving access needs no ID, but if the agency asks for one, the GA4 IDs guide says which is which.

Before you start

• You need the Administrator role on the property or the account to add someone.
• The agency person needs a Google account. Google says you can only add users whose email addresses are registered as Google accounts. A Gmail or Google Workspace address works. An ordinary company address works once a Google account has been created with it.
• Ask the agency which role it needs. The next section helps you check its answer.

Steps

1. Sign in to Google Analytics and select the property.
2. Click Admin.
3. Under Property, click Access Management.
4. In the permissions list, click +, then Add users.
5. Enter the email address of the agency person's Google account.
6. If you want Google to tell them, select Notify new users by email.
7. Choose the role, and any data restrictions (below).
8. Click Add.

Repeat for each person at the agency who needs access. To change a role later, open Access Management, click the person's name, change the role and click Save.

Which role to give

These are Google's role names, from its roles article, with what each one allows (the glossary gives the older permission names they replaced):

• Viewer: sees settings and data, changes which data appears in reports, and creates their own explorations.
• Analyst: everything Viewer can do, plus sharing explorations with other users of the property.
• Marketer: everything Analyst can do, plus creating and editing audiences, events and key events, and importing key events into Google Ads as conversions.
• Editor: full control of the property's settings. Cannot manage users.
• Administrator: full control, including adding and removing users.

A simple rule:

• An agency that only reports on results needs Viewer or Analyst.
• An agency that runs your Google Ads and works with audiences and conversions needs Marketer.
• An agency that sets up or repairs your tracking needs Editor.
• Administrator is for someone who has to manage the other users. Give it to an agency only if it should do that.

Data restrictions

With the role you can add two data restrictions. Google describes them like this:

• No Cost Metrics: the person cannot see cost figures, such as Google Ads cost and return on ad spend.
• No Revenue Metrics: the person cannot see revenue figures, such as total revenue and purchase revenue.

The figures show as 0 in their reports. Use these when an agency should see traffic but not your margins. A restriction set at account level applies to every property and cannot be lifted on one property.

Troubleshooting

The address is not accepted

Google only accepts email addresses registered as Google accounts. Ask the agency person to create a Google account with that address, or to send you one that already is. How to do that is in using a work email for Google Ads and Analytics access.

You cannot see Access Management, or there is no + button

You need the Administrator role on the property or the account. Ask someone who has it, or ask them to give it to you.

The agency can see other properties

They were added at account level. Remove them there and add them to the right property instead. Removing someone needs the Administrator role at account level.

The agency's access looks higher than the role you set

A role on the account passes down to the property, and the most generous role wins. Google also says you cannot give someone less on a property than they have on the account. Open Access Management under both Account and Property in Admin and compare.

Remove the agency later

Google says deleting a user needs the Administrator role at account level. The steps:

1. In Admin, under Account or Property, click Access Management.
2. Search for the person by their full or partial email address.
3. Select the check box next to them and click REMOVE.

If the agency was added at both levels, remove it at both. As a safety measure, the last Administrator cannot remove themselves. When you change agency, our guide on removing an old agency's access covers every platform in one place.

Doing it with an access link

Our access link covers this task. The client opens the link, signs in with Google, picks the property from a list and confirms. Access is added on the property, not the account, with the level the agency asked for: Viewer, Editor or Administrator. Analytics and Tag Manager share one Google sign-in, and Google Ads has its own.