Google Ads User Management | OpsBlu Docs

Google Ads User Management

How to manage team access, roles, and permissions in Google Ads. Covers adding users, updating access levels, revoking access, and security best practices.

Access Overview

Google Ads provides flexible user management for individual accounts and manager (MCC) accounts. Understanding access levels and proper user management ensures security and operational efficiency.

Permission Levels

Admin

Full control over the account including:

  • Campaign creation, editing, and deletion
  • Billing and payment settings
  • User management (add, edit, remove users)
  • Account-level settings and preferences
  • API access configuration
  • Conversion tracking setup

Use cases: Account owners, senior PPC managers, agency leads

Standard

Campaign management without billing access:

  • Create, edit, and manage campaigns
  • View and analyze reports
  • Create and modify ads, keywords, and audiences
  • Access Google Ads Editor
  • Cannot access billing or add/remove users

Use cases: PPC specialists, marketing managers, campaign operators

Read-only

View-only access to account data:

  • View campaigns, ads, and performance data
  • Generate and export reports
  • Cannot make any changes to campaigns or settings
  • Cannot access billing information

Use cases: Analysts, stakeholders, clients, reporting teams

Email-only

Receive reports without account login:

  • Automated email reports only
  • No login access to Google Ads interface
  • Cannot view campaigns or settings

Use cases: Executives, external stakeholders requiring periodic updates

Manager Account (MCC) Access

MCC Structure

Manager accounts allow agencies and large advertisers to manage multiple Google Ads accounts from a single interface.

Hierarchy:

MCC Account (Top Level)
├── Sub-MCC (Optional)
│   ├── Client Account 1
│   ├── Client Account 2
└── Client Account 3

MCC Permission Levels

  • Admin: Full control over MCC and linked accounts
  • Standard: View and manage client accounts (based on individual account permissions)
  • Read-only: View-only access across all linked accounts
  • Email-only: Receive aggregated reports

Linking Accounts to MCC

  1. In MCC account, navigate to Accounts > Performance
  2. Click Plus button > Link existing accounts
  3. Enter client account Customer ID
  4. Send invitation
  5. Client accepts invitation in their Google Ads account

Note: Clients can grant different permission levels even if MCC requests Admin access.

Access Scopes

Account-Level Access

Permissions apply to a single Google Ads account only.

MCC Access

Permissions can cascade to all linked accounts under an MCC.

Limited Access

Restrict users to specific campaigns:

  1. Grant Standard or Read-only access
  2. User can only view/edit campaigns they create
  3. Cannot be configured - users automatically have limited scope to their own campaigns if not granted broader access

Note: Campaign-level permissions are not directly supported. Use separate accounts for strict campaign isolation.

User Management Best Practices

  • Principle of least privilege: Grant minimum necessary access level
  • Regular access audits: Quarterly review of active users
  • Remove inactive users: Immediately revoke access for departing team members
  • Use MCC for agencies: Centralized management and reporting
  • Document access: Maintain spreadsheet of user roles and responsibilities
  • Two-factor authentication: Require 2FA for Admin users
  • Separate billing access: Limit billing permission to finance team only

Access Request Workflow

  1. Request: User submits access request with business justification
  2. Approval: Manager reviews and approves access level
  3. Provisioning: Admin grants access via Google Ads interface
  4. Notification: User receives email invitation
  5. Acceptance: User accepts invitation and confirms access
  6. Documentation: Log user, role, and date in access management spreadsheet

Security Considerations

  • Enable two-factor authentication for all Admin users
  • Use Google Workspace for centralized identity management
  • Monitor user activity via Change history
  • Set up billing alerts to detect unauthorized spending
  • Review API access tokens regularly
  • Use service accounts for automated scripts and tools
  • Implement IP allowlisting for sensitive accounts (via Google Workspace)

Troubleshooting Access Issues

User Cannot See Account

  • Verify invitation was accepted
  • Check user is logged in with correct Google account
  • Confirm user email matches invitation email
  • Check if account is linked to MCC (user may need MCC access)

User Has Wrong Permission Level

  • Current Admin must update user permissions
  • Changes take effect immediately
  • User may need to refresh browser or re-login

MCC Access Not Working

  • Verify account is linked to MCC
  • Check permission level granted by client account
  • Ensure user has access to the specific MCC
  • Confirm MCC hierarchy structure is correct
Nach oben