AdRoll Add User Access

Add User Access Overview

Adding users to AdRoll involves inviting them to your organization and scoping them to specific advertisers (brands or business units) with the appropriate role (Admin, Marketer, or Analyst). Proper access configuration ensures security, prevents billing exposure, and maintains separation between clients or brands.

When to Add Users

• New employee joining marketing or analytics team
• Agency partner needs access for campaign management
• Client stakeholder requires reporting visibility
• Finance team needs invoice and billing access
• Contractor or consultant working on specific projects
• IT team implementing pixels or integrations

Prerequisites

Before inviting users, ensure:

1. You have Admin access:

• Only Admin role can invite and manage users
• Check your role: Settings → Users & Roles → Your profile

2. Determine access requirements:

• What role should user have? (Admin/Marketer/Analyst)
• Which advertisers (brands) should they access?
• Do they need Finance access for billing?
• Is access temporary or permanent?

3. Gather user information:

• Business email address (required for invitation)
• Full name (for record-keeping)
• Department/agency affiliation
• Approval documentation (if required by policy)

4. Security clearance (if applicable):

• User has completed security training
• Background check passed (for finance roles)
• Non-disclosure agreement signed
• Approval from manager or executive

Access Request Workflow

Step 1: Determine Appropriate Role

Use this decision tree to select the correct role:

Does user need to manage billing or invite other users?
├─ YES → Admin (with or without Finance access)
└─ NO → Continue

Does user need to create or edit campaigns?
├─ YES → Marketer
└─ NO → Continue

User only needs to view reports?
└─ YES → Analyst

Role selection guide:

Choose Admin when:

• User needs to install/modify pixels
• User will generate API keys
• User manages billing or payment methods
• User is responsible for user management
• IT team implementing technical integrations

Choose Marketer when:

• User runs day-to-day campaign operations
• Agency media buyer optimizing campaigns
• Marketing manager adjusting budgets and creative
• Campaign specialist building audiences

Choose Analyst when:

• Executive reviewing performance dashboards
• Finance team monitoring spend (without editing)
• Client stakeholder viewing reports
• Data analyst exporting for external BI tools
• External auditor requiring read-only access

Step 2: Define Advertiser Scope

Questions to answer:

1. Which brands should user access?

   • All advertisers (rare, usually executives only)
   • Specific advertiser(s) (most common)
   • Example: Agency user only sees their assigned clients

2. Does user need cross-brand visibility?

   • Analytics team may need all advertisers for consolidated reports
   • Brand-specific marketers should only see their brand

3. Are there client separation requirements?

   • Agency: Prevent Client A user from seeing Client B data
   • Multi-brand company: Prevent Brand A marketer from editing Brand B campaigns

Example configurations:

Agency media buyer:

Role: Marketer
Advertiser scope: Client A, Client B (only their assigned clients)
Finance access: No
Reason: Manages campaigns but shouldn't see agency billing

Client stakeholder:

Role: Analyst
Advertiser scope: Their brand only (not other agency clients)
Finance access: Optional (if they approve invoices)
Reason: Read-only visibility into their brand's performance

Corporate analytics team:

Role: Analyst
Advertiser scope: All brands (Brand A + Brand B + Brand C)
Finance access: No
Reason: Build cross-brand reports without editing campaigns

Finance approver:

Role: Admin
Advertiser scope: All (to see consolidated billing)
Finance access: Yes
Reason: Review invoices and payment methods
Note: Won't actually use campaign features

Step 3: Determine Finance Access

Enable Finance Access when:

• User manages payment methods
• User reviews and approves invoices
• Accounting team processing AdRoll bills
• Executive approving monthly ad spend

Disable Finance Access when:

• Agency partner (prevent seeing other clients' invoices)
• External contractors
• Marketing team (don't need billing visibility)
• Most Marketer and Analyst roles

Important: Finance access is only available for Admin role

Invitation Process

Navigate to User Management

1. Log in to AdRoll: https://app.adroll.com
2. Ensure you're in the correct Organization:
   • Click avatar (top right) → Check organization name
   • If wrong: Click Switch Organization
3. Navigate to: Settings (gear icon) → Users & Roles
4. Click Invite teammate (or + Invite button)

Enter User Details

1. Email address:

• Enter user's business email (required)
• Use company/agency email, not personal (Gmail, Yahoo, etc.)
• Email must not already be in the organization

2. Select role:

• Choose: Admin, Marketer, or Analyst
• Hover over info icons for role descriptions
• Default: Marketer (most common)

3. Assign advertiser scope:

• Check boxes for advertisers user should access
• Select All (rare, usually for executives or analytics team)
• Specific advertisers (most common, limits visibility)
• If no advertisers selected: User can log in but sees nothing

4. Finance access (Admins only):

• Check Enable Finance access if user needs billing visibility
• Leave unchecked for most users (security best practice)

5. Add optional note:

• Internal reference: "Agency onboarding - Contract #12345"
• Helps track who invited whom and why

Send Invitation

1. Review all settings before sending
2. Click Send Invitation or Invite
3. User receives email at provided address
4. Invitation status shows as Pending

What user receives:

Subject: You've been invited to join [Organization] on AdRoll

Hi [Name],

[Inviter] has invited you to join [Organization] on AdRoll.

Role: [Marketer/Admin/Analyst]
Advertisers: [Brand A, Brand B, ...]

[Accept Invitation Button]

This invitation expires in 7 days.

Monitor Invitation Status

Check invitation status:

1. Settings → Users & Roles
2. Look for user in list
3. Status column shows:
   • Pending (invitation sent, not accepted)
   • Active (invitation accepted, user can log in)
   • Invited (some platforms show this instead of Pending)

If user doesn't accept within 48 hours:

• Contact user directly (check spam folder)
• Resend invitation: Click ⋯ (three dots) → Resend invitation
• Verify email address is correct

If invitation expires (7 days):

• Delete expired invitation
• Send new invitation with same settings

Special Access Scenarios

Agency Onboarding

Phase 1: Initial setup (Week 1):

Access configuration:

Role: Admin (needs pixel installation and audience setup)
Advertiser scope: Client's advertiser(s) only
Finance access: No (prevent seeing agency billing)

Steps:

1. Invite agency account manager as Admin
2. Scope to client's advertiser(s) only (not internal brands)
3. Agency installs pixel, creates audiences, sets up campaigns
4. Document plan to downgrade after onboarding

Phase 2: Transition to ongoing (Week 2-4):

Updated configuration:

Role: Marketer (downgraded from Admin)
Advertiser scope: Same (client advertisers only)
Finance access: No

Steps:

1. Settings → Users & Roles → Edit user
2. Change role from Admin to Marketer
3. Remove Finance access (if it was enabled)
4. Notify agency of role change and what they can still do

Why downgrade:

• Agency no longer needs pixel modification access
• Prevents accidental API key generation
• Removes billing visibility
• Maintains campaign management capabilities

Temporary Contractor Access

Configuration:

Role: Analyst or Marketer (depending on needs)
Advertiser scope: Specific advertiser(s) for project
Finance access: No
Duration: Project length (e.g., 3 months)

Best practices:

1. Document end date in access request ticket
2. Set calendar reminder to remove access after project
3. Use Analyst role if contractor only needs reporting
4. Upgrade to Marketer only if contractor actively manages campaigns

Removal process:

1. On project end date: Settings → Users & Roles
2. Find contractor user → Remove from organization
3. Export final reports if contractor needs handoff
4. Document removal in access log

Multi-Team Access (Same Company)

Scenario: User needs access to multiple teams/brands

Configuration:

Role: Marketer
Advertiser scope: Brand A + Brand B (multiple)
Finance access: No

Example:

• User supports both outdoor gear brand and fashion brand
• Needs campaign management for both
• Shouldn't see home goods brand (different team)

Steps:

1. Invite user with initial advertiser scope (Brand A)
2. After invitation accepted, edit user to add Brand B:
   • Settings → Users & Roles → Edit user
   • Check additional advertiser boxes
   • Save changes
3. Or invite with multiple advertisers initially (check multiple boxes)

Finance Team Access

Configuration:

Role: Admin (required for Finance access)
Advertiser scope: All (to see consolidated billing)
Finance access: Yes (enable billing features)

Best practices:

• Finance users typically don't touch campaigns
• Provide training: "Don't edit campaigns, only view billing"
• Consider separate "Finance Admin" users vs. "Campaign Admin" users
• Enable Finance access only for users who truly need it

Post-Invitation Follow-Up

Verify Invitation Acceptance

Within 24 hours:

1. Check Settings → Users & Roles for status change
2. Pending → Active means user accepted
3. If still Pending after 24 hours: Contact user
4. Check with user: "Did you receive invitation email?"

If user reports not receiving email:

• Check spam/junk folder
• Verify email address spelling
• Resend invitation
• Try alternative email address if corporate email blocked

Confirm Access Works

After user accepts:

1. Ask user to verify access:

   • Can they log in successfully?
   • Do they see the correct advertiser(s)?
   • Can they perform expected actions (view/edit campaigns)?

2. Test permissions:

   Admin user should be able to:
   ✓ View Settings → Users & Roles
   ✓ View Settings → Pixels
   ✓ Access API settings (if Finance enabled)
   
   Marketer user should be able to:
   ✓ Create new campaigns
   ✓ Edit existing campaigns
   ✗ Cannot access Settings → Users & Roles
   ✗ Cannot see billing information
   
   Analyst user should be able to:
   ✓ View campaigns and reports
   ✓ Download performance data
   ✗ Cannot edit campaign settings
   ✗ Cannot create new campaigns
   

3. Troubleshoot if issues:

   • User sees "No advertisers": Add advertiser scope
   • User can't edit campaigns: Upgrade from Analyst to Marketer
   • User sees wrong brand: Edit advertiser scope

Document Access Grant

Update internal records:

Access log entry:

Date: 2025-01-15
User: john.smith@agency.com
Action: Invited to AdRoll
Role: Marketer
Advertiser scope: Client A (Advertiser ID: ABC123)
Finance access: No
Requestor: Jane Doe (Account Director)
Approver: Sarah Johnson (VP Marketing)
Reason: Agency onboarding for new client
Review date: 2025-04-15 (quarterly audit)

Ticketing system:

• Close access request ticket
• Attach screenshot of user profile showing role and scope
• Link to approval email or ticket

Team documentation:

• Update team roster with AdRoll access details
• Add to onboarding checklist for new employees
• Include in agency contract documentation

Schedule Access Review

Set reminders:

• 30 days: Check if user is actively using access
• 90 days: Review if role/scope still appropriate
• Contract end date: Remove access (for contractors/agencies)
• Quarterly: Include in regular access audit

Calendar invites:

Event: Review AdRoll access for john.smith@agency.com
Date: 90 days after invitation
Description:
  - Verify user still needs access
  - Check if role should change (Admin → Marketer)
  - Confirm advertiser scope is correct
  - Document review outcome

Onboarding New Users

Send Welcome Information

After user accepts invitation, send onboarding materials:

Email template:

Subject: Welcome to AdRoll - Getting Started

Hi [Name],

Welcome to our AdRoll account! Here's what you need to know:

Access Details:
- Organization: [Company Name]
- Your role: [Marketer/Admin/Analyst]
- Advertisers you can access: [Brand A, Brand B, ...]
- What you can do: [brief role description]

Resources:
- AdRoll Help Center: https://help.adroll.com
- Internal AdRoll guide: [link to internal wiki]
- Training videos: [link if available]
- Contact for questions: [your name/email]

Getting Started:
1. Log in: https://app.adroll.com
2. Select advertiser from top navigation dropdown
3. [Role-specific next steps]

Questions? Reply to this email or ping me on Slack.

Best,
[Your name]

Role-Specific Training

For Admins:

• Pixel installation and verification
• Creating and managing audiences
• User management best practices
• API key security (if applicable)
• Billing review process (if Finance access enabled)

For Marketers:

• Campaign creation and setup
• Budget and bid management
• Audience targeting
• Performance reporting
• Ad creative best practices

For Analysts:

• Navigating reports dashboard
• Downloading and exporting data
• Building custom reports
• Interpreting key metrics
• Accessing historical data

Provide Support Contacts

Internal contacts:

• AdRoll admin: Who to contact for access issues
• Campaign manager: Who to ask about strategy/setup
• IT/ops: Who to contact for pixel/integration issues
• Finance: Who handles billing questions

External resources:

• AdRoll support: support@adroll.com
• Help center: https://help.adroll.com
• Live chat: In-dashboard support (if available)

Common Issues & Solutions

Invitation Not Received

Symptoms:

• User reports no invitation email
• Email doesn't appear in inbox or spam

Troubleshooting:

1. Check spam/junk folder:

• Have user search for "AdRoll" in all folders
• Check quarantine if corporate email security is strict

2. Verify email address:

• Settings → Users & Roles → Check pending invitation
• Look for typos in email address
• Delete invitation and resend with corrected email

3. Email filtering/blocking:

• Corporate firewall may block AdRoll emails
• Add @adroll.com to email whitelist
• Contact IT to allow emails from AdRoll

4. Resend invitation:

• Settings → Users & Roles → ⋯ (three dots) → Resend invitation
• Wait 5-10 minutes and check again

5. Alternative email:

• If corporate email blocked, try personal email temporarily
• Switch to corporate email after initial login
• Update email in user profile

User Invited But Can't See Campaigns

Symptoms:

• User logs in successfully
• Dashboard shows "No campaigns" or "No advertisers available"

Cause:

• User invited but no advertiser scope assigned

Fix:

1. Settings → Users & Roles → Find user → Edit
2. Check boxes for advertiser(s) user should access
3. Save changes
4. Ask user to refresh browser or log out/in
5. User should now see campaigns

Wrong Role Assigned

Symptoms:

• Analyst user expected to edit campaigns (needs Marketer)
• Marketer user needs pixel access (needs Admin)

Fix:

1. Settings → Users & Roles → Find user → Edit
2. Change role dropdown: Admin / Marketer / Analyst
3. Save changes
4. Notify user of role change
5. User may need to log out/in to see new permissions

User Needs Multiple Organizations

Scenario:

• Agency has separate AdRoll organizations for different client groups
• User needs access to multiple organizations

Solution:

• User can belong to multiple organizations with same email
• Each organization sends separate invitation
• User switches between organizations:
  • Click avatar (top right) → Switch organization
  • Or organization dropdown in navigation

Setup:

Organization A: Agency internal campaigns
  → User role: Admin

Organization B: Client 1 campaigns
  → User role: Marketer

Organization C: Client 2 campaigns
  → User role: Marketer

Security & Compliance Checklist

Before inviting:

• Verify requestor has authority to request access
• Confirm business justification for access
• Check if approval from manager/executive required
• Validate user's business email address
• Determine minimal role needed (least privilege)
• Define specific advertiser scope (avoid "all")

During invitation:

• Use business email, not personal
• Select least privileged role that meets needs
• Scope to specific advertisers only
• Disable Finance access unless truly needed
• Add internal reference note for tracking

After invitation:

• Document access grant in ticketing system
• Update internal access registry
• Send onboarding materials to new user
• Set reminder for access review (90 days)
• Verify user accepted invitation within 48 hours

Ongoing:

• Quarterly access audit includes new users
• Downgrade Admin to Marketer when appropriate
• Remove access promptly when user leaves
• Rotate API keys if Admin role changes

Best Practices

1. Least privilege principle:

Start with: Analyst (read-only)
Upgrade to: Marketer (if needs campaign access)
Promote to: Admin (only if needs pixel/API/billing)

2. Advertiser scope specificity:

Avoid: "Select all advertisers" (unless truly needed)
Prefer: Specific advertiser(s) matching responsibilities
Example: Agency user only sees their assigned clients

3. Finance access restriction:

Enable Finance access only for:
- Finance/accounting team
- Executive approvers
- Billing administrators

Disable for:
- Agency partners
- Marketing teams
- External contractors

4. Documentation discipline:

Always document:
- Who requested access
- Who approved access
- Business justification
- Expected duration (if temporary)
- Review date

5. Timely onboarding:

Send invitation: Day 1 (employee start or contract sign)
Verify acceptance: Day 2 (follow up if not accepted)
Provide training: Week 1 (role-specific guidance)
Review access: 90 days (quarterly audit)

Next Steps

• Update Access & Roles - Modify existing user permissions
• Remove Access - Offboard users when access no longer needed
• User Management Overview - Complete access management guide
• Setup & Implementation - Configure AdRoll pixel and tracking