Search Console Owners, Users and Permissions

This guide is based on Google's Search Console Help articles on managing owners, users and permissions, associations and verifying site ownership. If you are new to Search Console, start with our Search Console basics guide; if an agency is leaving, our website ownership handover checklist covers Search Console next to the domain, hosting and analytics.

The four roles

Everyone with access to a Search Console property has one permission level. The user list lives under Settings > Users and permissions, and only owners can see that page or grant access to anyone else.

• Owner. Full control: adds and removes users, changes settings, sees all data, uses every tool. There are two kinds with exactly the same rights. A verified owner proved ownership with their own token (an HTML file, a meta tag, a DNS record and so on). A delegated owner was simply added by another owner, with no token of their own.
• Full user. Google describes it as "view rights to all data" plus the ability to "take some actions".
• Restricted user. Google gives it "simple view rights on most data".
• Associate. Not a person browsing your reports but a link to another service, such as a Google Analytics property or a Play Store app. Associates "can't open or view your Search Console account or data directly"; they are covered below.

The one rule to remember: "A property must have at least one verified owner, or no users will have access to the property." Delegated owners and users all hang off a verified owner. Verification is also not a one-off check. Search Console "periodically checks if your verification token is still present and valid", and if it can no longer confirm it, that owner's permissions expire after a grace period. Deleting an old meta tag or DNS record during a redesign can lock everyone out.

What each permission can do

This is Google's permission table, in the same order. "Yes" means the role can use the feature; a blank means it cannot.

In practice: a full user can do almost all day-to-day SEO work, including sitemaps, removals, disavow files, reconsideration requests and validating fixes. What a full user cannot do is manage people, link Google Analytics, or run a Change of Address. A restricted user can read the reports but cannot submit or fix anything.

Adding a user or delegated owner

You must be an owner of the property, or of a parent property, to add anyone. Then:

1. Open the property and go to Settings > Users and permissions.
2. Click Add user and enter the person's Google Account email. It must be a valid Google Account, and "An email group cannot be added as a user."
3. Choose Owner, Full or Restricted, and save.

Limits per property: up to 100 non-owners (full, restricted and associate users together), and delegated owners until the property reaches 500 verified plus delegated owners. There is no cap on verified owners.

If you see the error "This user may only be added as 'Owner'", the person already owns a containing property (for example the Domain property above the URL-prefix one) and so already has owner rights here. Google does not allow adding them at a lower level.

Adding another verified owner

A delegated owner loses access if the verified owner who stands behind them disappears. A second verified owner is the safer backup. The process uses the other person's own token:

1. They start the verification flow in their Search Console and generate a personal token, for example an HTML file or meta tag.
2. You place it on the site (upload the file, add the tag, or add their DNS record).
3. They open the property in Search Console and click Verify.

For yourself, just follow the normal verification flow. A DNS record is the only way to verify a Domain property; Google also notes that once a parent property is verified, child properties you add are verified with the same method.

Changing or checking someone's permission

Owners can change the permission of anyone except a verified owner: open Users and permissions, use the menu next to the person, choose Change permissions, pick the new level and save. If Change permissions is greyed out, that person is a verified owner. You can remove a verified owner, but you cannot downgrade one.

To see your own level, open Settings and read the Ownership verification row. To see everyone's, open Users and permissions: "Owner" plus "Verified" means a verified owner; "Owner" without "Verified" means a delegated owner. A verified owner can also open Ownership verification details from the menu next to any verified owner to see which methods and tokens they used.

Removing people and their tokens

Removing a user or delegated owner is one step: menu next to the name, Remove access. Google says the change "should take effect very quickly."

Removing a verified owner has a second step that is easy to miss. Their access ends at once, but "their verification tokens are not deleted or revoked." While the token stays on the site, they can re-verify and get back in; all current owners are notified if that happens. After you remove them, Search Console shows the tokens tied to that person, and you can find them again later under Unused ownership tokens. Google says to delete all of them, one per verification method that person used.

How to remove each kind of token, according to Google:

• HTML file: delete that person's file (a long alphanumeric name containing "google-site-verification") from the site root.
• HTML tag: delete their google-site-verification meta tag from the homepage source.
• Domain name provider: delete their DNS record.
• Google Analytics: switch the site to a different Analytics account, or take away that person's edit rights in the current one.
• Google Tag Manager: switch containers, or remove their Publish or Admin permission.
• Google Sites or Blogger: the site's owner always has access, so the site's ownership itself has to change.

Two cautions. Remove only the removed person's token, never the tags or records of the owners who stay. And the same token can verify other Google services too (Google names Merchant Center and Google Workspace), so check what else uses it before you delete it. Also be careful with the last verified owner: if all verified owners are removed, everyone else loses access after a grace period. Data keeps being collected, but nobody can see it until someone verifies again.

Ownership history and owners you don't recognise

Users and permissions has an Ownership history link. It lists owners added and removed, successful and failed verification attempts, and verification tokens that disappeared. It is the place to check when access changed and who changed it.

If you find an owner you don't recognise, Google's warning is direct: "you might have been hacked," and a hacker "can probably add their token back after you've removed it." Removing them is not enough; the site itself needs securing. Our guide to the Security issues report covers what Search Console shows when Google detects a hacked site.

If your only verified owner has left the company, Google's answer is to verify ownership again yourself. Once you are verified, you can remove previous owners and their tokens as above.

Associations with other Google services

An association connects the property to something in another Google service. Google lists Google Analytics properties, Google Ads accounts, Merchant Center accounts, Play Store apps, Play Console and Android Developer Console accounts, Chrome Web Store accounts, Google Assistant Actions Console projects and Vertex AI Agent Builder. The requests come from the other service and go to the property's owners, who approve or deny them under Settings > Associations. Google Analytics is the exception: it can be requested from either side.

What matters for access:

• Google Analytics: "anybody with access to that Google Analytics property may be able to see Search Console data for that site", including people an Analytics admin adds later, and users of a new Analytics account if the property is moved there. Search Console does not notify you about that move. One Analytics property links to one Search Console property, and vice versa. Our GA4 and Search Console guide covers the link itself.
• Merchant Center: once linked, "all users with access to your Search Console property will be able to view data from your Merchant Center account, and add or update information."
• Pending requests stay in the table until someone approves or denies them. Any owner can remove an association at any time, and Search Console keeps no history of removed or rejected ones.

A setup that works for most businesses

This is our suggestion, built on Google's rules above:

1. The business is a verified owner through a Google Account it controls, ideally on the Domain property with a DNS record.
2. A second person at the business is also a verified owner, so one departure does not lock anyone out.
3. Agencies and developers get full user access, or delegated owner only if they need to manage users or run a Change of Address.
4. People who only read reports get restricted access.
5. A few times a year, review Users and permissions, Unused ownership tokens, Ownership history and Associations, and remove what is no longer needed.

Frequently asked questions

What is the difference between a verified and a delegated owner?

They have the same rights. A verified owner proved ownership with their own token on the site or DNS; a delegated owner was added by another owner. If all verified owners go, delegated owners lose access too.

Should our agency be a full user or an owner?

Full user covers most SEO work, including sitemaps, removals and reconsideration requests. Owner is needed only to manage users, link Google Analytics or run a Change of Address.

We removed a former owner. Can they get back in?

Yes, if their verification token is still on the site. Delete every token listed for them under Unused ownership tokens; all owners are notified if a removed owner re-verifies.

How many users can a property have?

Up to 100 non-owners, and up to 500 verified plus delegated owners before no more delegated owners can be added. Verified owners have no limit.

Can I add a Google Group as a user?

No. Google says an email group cannot be added as a user; each person needs their own Google Account.

Want a website that is handed over with the right owners in place from day one? See our website development and website maintenance services and all our services, or email [email protected].