How Do You Give an Agency Access to Google Analytics?

How Do You Give an Agency Access to Google Analytics?

Handing an agency your analytics is a two-minute job that people get wrong in a way they only notice months later. The clicking is easy. The decision underneath it is not, and Google's interface does little to flag which parts you can take back.

There are two places you can add someone, and they are not two routes to the same outcome. One is reversible. The other is not, in a specific sense.

That is the part worth settling before you paste an email address into anything.

What Is the Short Answer?

Add the agency at the property level, not the account level, and give them the Editor role if they need to change your configuration or the Analyst role if they only need to read and build.

The path is Admin, then under Property, then the access management screen, then the + button, then Add users.

The reason the level matters more than the role is inheritance. Google's documentation is explicit about the direction it runs: "Parent roles are inherited by default (e.g., account > property). For example, when you give a user a role at the account level, that user then has the same role for all the properties in that account."

That sounds like a convenience. In practice it is a one-way door.

Not sure who already has access to your analytics, or what they can see? Get a free SEO audit and start from an accurate picture.

Why the Account Level and the Property Level Are Not Interchangeable

An Analytics account can hold several properties. A property is one website or app's worth of data. An agency normally needs one of them.

Google frames the difference as where access begins: "You can add users at the Analytics account or property level. The level at which you add a user determines that user's initial access."

What Account-Level Access Actually Gives Away

Add the agency at the account level and they get the same role on every property in it — every site and app, including the ones unrelated to the work you hired them for.

You also cannot trim it afterwards. Google states it plainly: "if you assign a user the Editor role at the account level, then that user also has the Editor role at the property level (and you cannot revoke those permissions at the property level)."

So an account-level grant is not a starting point you narrow later. Reducing it means removing the account role entirely and starting again at the property.

How Overlapping Roles Resolve

If someone holds a role in more than one place, Analytics does not average them or take the stricter one: "A user's effective permissions equate to the most-permissive role for that resource."

A generous account-level role therefore overrides a careful property-level one. Setting a contractor to Viewer on one property does nothing if they are already Editor on the account.

The Same Trap Applies to Data Restrictions

Two restrictions can sit on top of a role, and they inherit downward the same way — except here the inheritance blocks you from loosening rather than tightening.

Google's wording: "You can add data restrictions as direct permissions but you cannot remove them if they're in effect as inherited permissions. For example, if a user is assigned No Cost Metrics at the account level, then that user cannot see cost metrics for any property in the account."

If your agency reports on paid performance and sees no spend figures, an inherited restriction at the account level is the first thing to check.

The Five Roles, in Google's Own Words

Analytics ships five roles plus a null option. Google's page states that "Five roles and 2 data restrictions are available."

• Administrator — "Full control of Analytics. Can manage users (add/delete users, assign any role or data restriction)." It also includes everything the Editor can do.
• Editor — "Full control of settings at the property level. Can't manage users, but can view users across a property." Includes the Analyst role's permissions.
• Marketer — "Can create, edit, and delete audiences, events, and key events." It can also import key events into Google Ads as conversions and edit attribution-model settings.
• Analyst — "Can share created explorations to other users of the property." Includes the Viewer role's permissions.
• Viewer — "Can see settings and data; can change which data appears in reports (e.g., add comparisons, add a secondary dimension)." Viewers can also create, edit and delete their own explorations.
• None — "The user has no role for this resource. The user may have a role for another resource."

Several names are recent, and Google notes the lineage: Editor is the "New name for Edit permission", Analyst the "New name for Collaborate permission", Viewer the "New name for Read & Analyze permission". An older agency brief asking for "Read & Analyze" means Viewer.

There is no Owner role and no Manager role in Analytics, whatever a third-party onboarding form calls them.

The Two Data Restrictions

These are separate toggles, not roles, and you can apply either or both.

• No Cost Metrics — "Cannot see metrics related to cost. Cost metrics are unavailable in reports, explorations, audiences, insights, and alerts."
• No Revenue Metrics — "Cannot see metrics related to revenue. Revenue metrics are unavailable in reports, explorations, audiences, insights, and alerts."

Restricted numbers do not vanish from the interface. Google says users "see 0 instead" — confusing for anyone not told the restriction exists. Tell the agency if you apply one.

Want to know whether your analytics setup is giving your agency clean data to work with? Request a free audit.

How to Give an Agency Access, Step by Step

You need the Administrator role yourself to do any of this. Google is specific: "To add or modify users or user groups, you need to have the Administrator role at the account or property level."

Step 1: open the access screen for the right level. Go to Admin, then look under the Property column rather than the Account column, and open the access management screen there.

Step 2: note which label your interface uses. Google's own help pages disagree here. One says "In Admin, under 'Account' or 'Property', click Access Management." Another says "In Admin, under Property, click Property access management." Both describe the same destination, so treat whichever label you see as correct rather than assuming you are in the wrong place.

Step 3: start the invitation. In the permissions list, "click +, then click Add users."

Step 4: enter the agency's email address. It must be a Google account: "Users are identified by their email addresses. You can only add users whose email addresses are registered in Google accounts." A generic agency inbox that is not a Google account will be rejected, so ask which address to use rather than guessing.

Step 5: decide about the notification. There is a Notify new users by email checkbox. Leaving it on is usually right for an agency, because it gives them a dated record that access was granted.

Step 6: select the role. Pick the narrowest one that still lets them do the job. The next section covers which that is.

Step 7: confirm. Click Add.

That is the whole flow. The step that deserves a second look is step 1, not step 6.

Which Role Does an Agency Actually Need?

This depends on what you hired them to do, and most agencies are given more than they need.

• An agency building reports and doing analysis needs Analyst. They can create explorations, share them with your team, and read everything. They cannot break your configuration.
• An agency managing your tracking setup needs Editor. Creating events, editing data streams and changing property settings all require it.
• An agency running paid media often needs Marketer, because importing key events into Google Ads as conversions sits in that role specifically.
• A stakeholder who only reads dashboards needs Viewer.
• Almost nobody external needs Administrator. It lets them add and remove users, including granting themselves anything on any resource they administer.

If you are unsure between two, grant the lower one. Raising a property-level role later takes thirty seconds. Unwinding an account-level one does not.

Getting an agency set up and want a second opinion on the data they will be working from? Start with a free audit.

How to Remove an Agency's Access

Offboarding is where the inconsistency in Google's documentation stops being academic.

The steps are simple: open the access management screen, "use the search box at the top of the list to find the user you want", then "select the check box for each user you want to delete, then click REMOVE."

To change rather than remove someone, "click the user name, then add or remove permissions", then click Save.

Two things to know before you try it:

• Google's page says deletion is account-level only — "You can delete users or user groups only at the account level" — while the navigation instructions on the same page offer both Account and Property. If a removal is not available where you are looking, go up to the account level rather than concluding the user cannot be removed.
• "If you remove a user from a source property, that user is also removed from its subproperties." Worth knowing if you run a roll-up structure.

There is also a guard against locking yourself out: "if you are the last user who has the Administrator role, you cannot delete yourself."

Limitations Worth Knowing First

There is no per-agency container. Analytics has no concept of a client-agency relationship. An agency is a user with a role, so the boundary is whatever level you grant at.

There is no stated user limit. Google's answer on volume is "You can add as many users as you need." No numeric maximum appears on the access management pages, so a long contractor list is not itself a problem.

User groups need an organization, not Analytics 360. This one is commonly misstated. The actual requirement is "To create a user group, your Analytics account has to belong to an organization." Analytics will walk you through creating and linking one when you make your first group. Groups also take the permissions of the level where they were created, so a group made at the account level applies to every property.

Role inheritance has no audit trail you can read at a glance. The screen shows direct permissions clearly, but working out why someone sees something they should not usually means checking the account level separately.

Unsampled explorations are a 360 feature. The Analyst role includes the ability to "request unsampled explorations (Google Analytics 360 only)", so on a standard property that part of the role does nothing.

How This Compares to the Alternatives

Sharing a login is what people do instead, and it is worse in every respect. It breaks the audit trail, survives the end of the engagement, and hands over whatever else that Google account can reach. Adding a user takes the same two minutes and is revocable.

Exporting reports manually keeps access tightest and suits a short, narrow engagement. It stops making sense the moment the agency needs to investigate something you did not think to export.

Looker Studio sharing is a good middle path when the agency only needs to read numbers. You share a dashboard rather than the property, so they see what you chose to show and nothing else. It does not work if they need to configure anything.

Account-level access is the right choice in exactly one situation: when the agency genuinely manages every property in the account and you want their access to follow new properties automatically. If that is not your arrangement, the property level is the answer.

Final Thoughts

The role matters less than the level you pick it at, because the role is easy to change and the level is not. Add the agency to the property, give them Analyst unless they have a concrete reason to need Editor, and keep Administrator inside your own organisation.

It is also worth checking what is already there first. Old agencies, former staff and forgotten contractors accumulate quietly, and the access management screen is the only place that shows you.

Once the agency has access, the next question is what they do with it. Our guide to building a Google Analytics SEO report covers what a useful one should actually contain, which is a reasonable thing to agree on at the start of an engagement rather than three months in.

Want an independent read on your analytics setup before you hand it over? Get a free SEO audit.