How to give an agency access to Google Tag Manager

In Google Tag Manager, open Admin, select User Management in the Account column, then + and Add users. Enter the agency person's Google account email, leave the account permission at User, give Publish on the one container they work on, and select Invite. Google emails the agency person, who accepts on the Invitations card in Tag Manager.

This guide is for whoever controls the Tag Manager account for the website. The agency only needs to send the email address it wants added.

Account or container access

Tag Manager has two layers of permission, described in Google's user management article:

• Account permission: User (the default) can view basic account information. Administrator can create new containers and change who has access to the account and its containers.
• Container permission: set for each container (usually one container per website or app). It decides what the person can do with the tags.

An agency that maintains your tags needs a container permission. It does not need to be an Administrator of the account. Keeping the account permission at User means the agency can work on the tags but cannot add or remove people.

Before you start

• You need the Administrator account permission to add people.
• The agency person needs a Google account. Google says you can only give access to Google accounts: Gmail, Google Workspace, or other accounts created at accounts.google.com.
• Know which container is the website's. Ask the agency to name it if you have more than one.

Steps

1. Sign in to Tag Manager and open the account.
2. Select Admin.
3. In the Account column, select User Management.
4. Select +, then Add users.
5. Enter one or more email addresses.
6. Leave Account Permissions at User.
7. Under container permissions, set Publish for the container the agency works on. Do not set any other container.
8. Select Invite.

You can also start from the Container column's User Management for that container. Then you only set the container permission.

Google emails the invited person, and an Invitations card appears on Tag Manager's Accounts screen. They open it, expand the invitation and select Accept.

Which container permission to give

Google's five container permissions:

• No access: the person cannot see the container.
• Read: can browse the tags, triggers and variables, but cannot change anything.
• Edit: can create workspaces and make edits, but cannot create versions or publish.
• Approve: can create versions, workspaces and edits, but cannot publish.
• Publish: full rights, including publishing.

Publish is what an agency usually needs, because tag work that cannot go live does not help you. It also means the agency can change what runs on your site, so give it to an agency you have hired for this work. If someone in your company should check each change first, give the agency Approve and keep Publish for that person. For an agency that only audits your setup, Read is enough.

One more thing to know. Google's Search Console lets a person with Publish or Administrator permission on your site's container verify ownership of the site. A verified owner has the highest level of access in Search Console. That is a reason to keep Publish for agencies you trust, and to check Search Console's owner list when an agency leaves. See how to add an agency in Search Console.

Who should own the Tag Manager account

Google's advice is plain: make sure that your Google accounts are managed by someone within your organization, not an outside manager or consultant. Keep at least two active administrators of your own.

There are reasons for this in the same article:

• Tag Manager support cannot add users for you, so if nobody in your company has access, you cannot get it back through Google.
• If the only administrator's Google account is deleted, the container is left without an admin. Google says a container without an admin is deleted, and the people left with Read access have 30 days to export it.

If an agency set up Tag Manager for you in its own account, ask it to add one of your people as Administrator.

Troubleshooting

The agency did not get the invitation

Ask them to sign in to Tag Manager with the invited address and look for the Invitations card on the Accounts screen. If it is not there, check the address you entered under User Management.

The address is not accepted

Only Google accounts can be added. The agency person can create a Google account with their work address at accounts.google.com; see using a work email for Google access.

You cannot add users

You need the Administrator account permission. Ask an existing administrator to add the agency, or to make you an administrator.

The agency can edit but cannot publish

They have Edit or Approve. Change their container permission to Publish, or publish their versions yourself.

There is a separate Google tag users screen

A Google tag has its own user list, with its own roles, reached from Google tags on Tag Manager's All accounts screen. Google describes it in a separate article. This guide covers container access only.

Removing access

1. Select Admin.
2. In the Container column, select User Management.
3. Select the agency person in the list.
4. Select Remove, then Save.

To lower a permission instead, change it on the same screen and select Save. Tag Manager does not let you remove every administrator, so add your own administrator before you remove an agency that holds that role. Our guide on removing an old agency's access covers the other platforms too.

Doing it with an access link

Our access link covers this task. The client opens the link, signs in with Google, picks the container and confirms. The agency gets the level it asked for: Read, Publish (with the account permission at User), or Administrator. Tag Manager and Analytics use the same Google sign-in, so a client can give both in one go.