How to give an agency access to GA4 and Google Tag Manager

In GA4, the level where you add a user defines their access: a user added to the account gets access to all of its properties with the same permissions; a user added to the property only accesses that property. That’s why you should add the agency to the property.

Tag Manager has account permissions (User or Administrator) and permissions for each container (No access, Read, Edit, Approve or Publish). What the agency can do with tags depends on the container permission; it doesn’t need to be an account Administrator, a role meant for creating containers and managing users.

1. Sign in to Google Analytics with a Google Account that has the Administrator role on the account or the property. Only administrators can add users.
2. In Admin, under Property, click Access Management. Check that the selected property belongs to the right website or app.
3. Click +, then Add users. Enter the email the agency gave you and, if you like, select Notify new users by email.
4. Choose the role (see the next section) and click Add.

GA4 only accepts email addresses registered as Google Accounts.

• Editor: full control of property settings, but can’t manage users. Suitable if the agency will set up measurement.
• Marketer: can create, edit and delete audiences, events and key events, and edit attribution-model settings.
• Analyst or Viewer: enough if the agency will only follow data and reports.

The Administrator role gives full control of Analytics, including managing users. The agency usually doesn’t need it: grant it only if there is a reason.

1. Sign in to Google Tag Manager with a Google Account that has Administrator permission on the Tag Manager account. Click Admin and, in the Container column, select User Management.
2. Click the add icon, select Add users and enter the email the agency gave you.
3. Assign the container permission (see the next section) and click Invite.

The agency receives the invitation by email. Tag Manager only accepts Google Accounts.

• Edit: can create workspaces and make edits, but not create versions or publish. A good option if someone on your team reviews and publishes.
• Approve: can also create versions, but not publish.
• Publish: can create versions and publish changes. Grant it if you agreed that the agency publishes.

You don’t need to make the agency an Administrator of the Tag Manager account.

If the agency asks for the container ID: the ID starts with GTM and is shown in the Tag Manager Workspace tab.

• I can’t find how to add users: in GA4, only users with the Administrator role on the account or property can add users; in Tag Manager, only account Administrators manage users.
• The email isn’t accepted: GA4 and Tag Manager only accept Google Account email addresses.
• I added the agency to the account instead of the property: in that case it can access every property in the account. If that wasn’t your intention, adjust the access in Access Management.