GA4 User Permissions: Roles and Access for Agencies
An agency, a freelancer and three people in your own team all need something from Google Analytics, but not the same thing. GA4 handles this with five roles, two data restrictions and, for larger setups, user groups in an organization. This guide explains each one, how access is inherited, and a setup that keeps the business in control.
This guide is based on Google's Analytics Help pages on access and data-restriction management and adding, editing and deleting users and user groups, and Google Marketing Platform Help on organizations, user groups, user policies and recovering admin access, checked on 9 November 2026. Where we give our own advice, we say so.
The five roles
Every user gets a role for an account or a property. Each role includes everything the role below it can do. Google describes them as follows:
| Role | What Google says it can do | Typical fit (our view) |
|---|---|---|
| Administrator | "Full control of Analytics." Can add and delete users and assign any role or data restriction, including to themselves. | The business owner and one backup person |
| Editor | "Full control of settings at the property level." Cannot manage users, but can see the users of a property. | The agency or developer that sets up tracking |
| Marketer | Can create, edit and delete audiences, events and key events, import key events into Google Ads and edit attribution settings. | A paid ads specialist |
| Analyst | Can share explorations with other users of the property, and request unsampled explorations in Analytics 360. | Someone who builds reports for others |
| Viewer | Can "see settings and data", change what appears in reports (comparisons, secondary dimensions), see shared assets and create their own explorations. | Managers and anyone who only reads reports |
A sixth option, None, means the user has no role for that account or property, though they may have one somewhere else. Note the line between the top two: Editor has full control of property settings but cannot add or remove people. Only Administrators can.
Account level, property level and inheritance
You can give a role at the account level or at the property level. Google is clear about what happens next: "Parent roles are inherited by default." A user who is Editor on the account is Editor on every property in it.
Two rules follow from that:
- The most permissive role wins. If someone is Editor on the account and Viewer on one property, they are still Editor on that property. If they have a higher role on a property than on the account, the higher one applies there.
- You can add access lower down, not take it away. Google puts it this way: you "cannot give a user fewer permissions than you assigned at higher levels." To limit someone to one property, give them nothing at the account level and a role on that property only.
Google calls the result "effective permissions": the roles and restrictions a person gets through the organization, a user group or the parent account, plus anything set directly on the property. When access looks wrong, check all of those places, not just the property.
Hiding cost and revenue data
On top of a role you can add one or both data restrictions: No Cost Metrics and No Revenue Metrics. Google's lists cover metrics such as Google Ads cost, cost per click and return on ad spend on the cost side, and purchase revenue, item revenue, ad revenue and lifetime value on the revenue side. Any custom metric marked as cost or revenue, and any metric derived from one, counts too. That includes formulas in GA4 calculated metrics.
What the person sees depends on the feature:
- Reports: restricted values show as 0. The metrics still appear in the picker, so a user can add them but not see the numbers.
- Explorations: the metrics can be added but their results do not appear.
- Audiences: the user can build an audience on a restricted metric, but cannot use it as a filter, see its size or add audience triggers to it.
- Insights: automated and custom insights based on restricted metrics are hidden, and custom ones are not emailed to them.
Google enforces restrictions in the interface and in matching API calls. It also notes that users "may not be subject to these restrictions" if their access comes from a linked Google product. Restrictions are inherited like roles: if one is set at the account level, you cannot remove it on a property, but you can add the other one there.
Adding, changing and removing users
Users are identified by email, and Google says you "can only add users whose email addresses are registered in Google accounts." A Google Workspace address works. To add someone, go to Admin, then Access management under Account or Property, click +, then Add users. Enter the email, choose whether to notify them, pick the role and any restrictions, and click Add. There is no limit on how many users you can add.
- Who can add or change users: an Administrator at the account or property level, for the levels where they hold that role.
- Who can delete users: Google states you need "the Administrator role at the account level" and can delete users "only at the account level."
- The last Administrator cannot delete themselves. Google adds this as a safety measure.
- Subproperties: removing someone from a source property also removes them from its subproperties; removing them from a subproperty affects only that one. See our guide to GA4 subproperties and roll-up properties.
The user list can be searched and filtered by name, email, user group, role and policy violations, which makes a periodic review quick. Administrators can see everyone's contact details. Other users may see a name or email in places such as change history or shared explorations.
Users who come in through Google Ads or Firebase
Linking a product can give its users access to Analytics without you adding them one by one. When you link Google Ads, each Ads access level becomes a "linked user" in the property. Google's recommended roles are:
| Google Ads access level | Recommended Analytics role |
|---|---|
| Administrator | Editor |
| Standard | Marketer |
| Read only, Billing, Email only | Viewer |
An Analytics Administrator can change these, and a change applies to everyone in the Ads account at that level. To create Analytics audiences from inside Google Ads, the linked user needs Administrator, Editor or Marketer. Firebase works the same way, with virtual users mapped to Editor, Marketer, Viewer, and Viewer with no access to cost or revenue data. In both cases the assignments last until the link is deleted, so these entries belong in any access review.
Organizations, user groups and user policies
An organization in Google Marketing Platform sits above your Analytics, Tag Manager and other accounts. Google describes it as a way to centralise product accounts, users, billing and integrations. Linking an account adds its users to the organization with the default permission of User. For most small businesses one Analytics account is enough, but three organization features are worth knowing.
User groups
To create a user group, your Analytics account has to belong to an organization; Analytics walks you through creating one if needed. A group gets a role on an account or property, and members "inherit that group's permissions, and also retain any permissions they have separately." Groups can be nested. Google recommends only two kinds: people oriented (who reports to whom) and role oriented (for example "Data Analysts: EMEA"), with a simple naming standard. For an agency relationship, a role-oriented group such as "Agency: paid ads" lets you add or remove one person without touching the property settings.
User policies
Org admins and user admins can set a policy listing allowed email domains, allowed addresses and banned addresses. By default any user is allowed. With enforcement switched on, admins cannot add users who break the policy; Google says enforcement is currently in effect only for Google Analytics. With it off, the policy is advisory and violators are flagged with a warning icon.
Recovering lost admin access
Google's example of how access gets lost is common: "an account administrator leaves the company without first assigning another administrator." Data keeps flowing and other users can still log in, but nobody can manage users. If the account is linked to an organization, an Org admin or user admin can restore Administrator access from Google Marketing Platform. Every user in an organization can see who its Org admins are.
A setup for working with an agency
This is our suggestion, built on the rules above, not a Google requirement:
- The business owns the Analytics account, and two people from the business hold Administrator at the account level. That avoids the lockout Google describes.
- The agency gets Editor on the property it works on, not on the account. If it only runs ads, Marketer is enough.
- Add No Revenue Metrics, No Cost Metrics or both for anyone who does not need the figures, such as a content writer or a freelancer.
- If you have an organization, put outside people in a role-oriented group so removing them is a single change.
- Review the user list, including Google Ads and Firebase linked users, when a contract ends and at least once a year.
Access to Analytics is one item in a wider list. Our guide on what you should own when your website is built covers the domain, Search Console, Tag Manager and code as well, and our GA4 basics guide covers the rest of the setup.
Frequently asked questions
What GA4 role should an agency have?
Usually Editor on the property it manages, or Marketer if it only works on ads and audiences. Editor covers all property settings but cannot add or remove users, so the business stays in control of access.
Can I give someone access to one property only?
Yes. Add them at the property level and give them no role at the account level. A role given at the account level applies to every property and cannot be lowered on a single property.
How do I stop someone seeing revenue in GA4?
Add the No Revenue Metrics data restriction to their access. Revenue figures then show as 0 in reports and do not appear in explorations. No Cost Metrics does the same for ad costs.
Why can't I remove a user from a property?
Google says deleting users requires the Administrator role at the account level, and that deletion happens only at the account level. If the person's role comes from the account or a user group, change it there.
What if our only GA4 administrator has left?
If the account is linked to a Google Marketing Platform organization, an Org admin or user admin can restore Administrator access. That is why we suggest two administrators from the business at all times.
Want a website where tracking and accounts are set up in your name from day one? See our website development service and all our services, or email [email protected].