Google Ads Update Access

Prerequisites

• Admin access to the Google Ads account
• Reason for permission change documented
• Manager approval for access level changes (recommended)

Update User Access Level

Step 1: Navigate to Access & Security

1. Sign in to your Google Ads account at ads.google.com
2. Click the Tools & Settings icon in the top right
3. Under "Setup," click Access and security

Step 2: Modify User Permissions

1. Locate the user in the access list
2. Click the pencil icon next to the user's name
3. Select new access level:
   • Admin: Full account control including billing and user management
   • Standard: Campaign management without billing access
   • Read-only: View-only access
   • Email-only: Receive reports via email only
4. Click Save

Changes take effect immediately - no user confirmation required.

Update Manager Account (MCC) Access

Modify MCC User Access

1. Sign in to your Manager account
2. Click Tools & Settings > Access and security
3. Locate user in the list
4. Click pencil icon next to user's name
5. Select new access level:
   • Admin: Full MCC control
   • Standard: View and manage linked accounts
   • Read-only: View-only across all accounts
   • Email-only: Receive aggregated reports only
6. (Optional) Modify which linked accounts the user can access
7. Click Save

Grant MCC Access to Specific Accounts

1. In MCC access settings, click user's pencil icon
2. Under "Linked accounts," select specific accounts to grant access to
3. Uncheck accounts to revoke access
4. Click Save

Note: User retains their permission level, but scope is limited to selected accounts only.

Common Access Update Scenarios

Promote User from Read-only to Standard

Use case: Analyst promoted to Campaign Manager role

1. Navigate to Access and security
2. Click pencil icon next to user
3. Change from Read-only to Standard
4. Click Save
5. Notify user of new permissions

Demote User from Admin to Standard

Use case: Transitioning account ownership or limiting permissions

1. Verify at least one other Admin user exists (cannot remove last Admin)
2. Navigate to Access and security
3. Click pencil icon next to user
4. Change from Admin to Standard
5. Click Save
6. Important: User immediately loses billing and user management access

Change User from Standard to Email-only

Use case: Stakeholder no longer needs login access, only reports

1. Navigate to Access and security
2. Click pencil icon next to user
3. Change from Standard to Email-only
4. Click Save
5. Configure report schedules to include user's email
6. Notify user they will no longer have login access

Upgrade Email-only to Read-only

Use case: Report recipient needs to explore data interactively

1. Navigate to Access and security
2. Click pencil icon next to user
3. Change from Email-only to Read-only
4. Click Save
5. User receives invitation email to accept access
6. Notify user to check email and accept invitation

Update User Email Address

Google Ads does not support changing a user's email address directly. Instead:

Option 1: Remove and Re-add User

1. Remove user with old email address
2. Add user with new email address
3. Grant same permission level as before

Note: User's Change history remains associated with old email address.

Option 2: User Updates Google Account Email

1. User updates primary email in their Google account settings
2. Google Ads access automatically follows the Google account
3. No admin action required

Recommended: Option 2 preserves Change history continuity.

Modify API Access

Revoke API Token Access

API access is controlled by the user's OAuth tokens, not directly by account admins.

To restrict API access:

1. Change user to Email-only (removes login capability)
2. User's existing API tokens will fail authorization
3. User cannot generate new tokens without login access

To audit API usage:

1. Review Change history for API-driven changes
2. Check API Center for active developer tokens
3. Use Google Cloud Console to review OAuth consent

Enable API Access for User

1. Ensure user has Standard or Admin access (required for API)
2. User navigates to Tools & Settings > API Center
3. User applies for API access (if not already approved)
4. User creates OAuth credentials for their application

Bulk Access Updates

For agencies managing multiple accounts:

Update Access Across Multiple Accounts

Google Ads does not provide native bulk user permission updates. Workarounds:

Option 1: Google Ads API Script

from google.ads.googleads.client import GoogleAdsClient

client = GoogleAdsClient.load_from_storage()

# List of account IDs to update
account_ids = ['123-456-7890', '098-765-4321']
user_email = 'user@example.com'
new_access_role = client.enums.AccessRoleEnum.STANDARD

for account_id in account_ids:
    customer_user_access_service = client.get_service("CustomerUserAccessService")

    # Get existing user access
    query = f"""
        SELECT customer_user_access.user_id, customer_user_access.access_role
        FROM customer_user_access
        WHERE customer_user_access.email_address = '{user_email}'
    """

    response = client.get_service("GoogleAdsService").search(
        customer_id=account_id.replace('-', ''),
        query=query
    )

    for row in response:
        # Update access role
        customer_user_access = client.get_type("CustomerUserAccess")
        customer_user_access.resource_name = row.customer_user_access.resource_name
        customer_user_access.access_role = new_access_role

        operation = client.get_type("CustomerUserAccessOperation")
        operation.update = customer_user_access
        operation.update_mask = client.get_field_mask(customer_user_access)

        customer_user_access_service.mutate_customer_user_access(
            customer_id=account_id.replace('-', ''),
            operation=operation
        )

        print(f"Updated access for {user_email} in account {account_id}")

Option 2: Manual MCC Management

1. Grant or update user access at MCC level
2. User permissions cascade to all linked accounts
3. Individual accounts can override with lower permissions

Temporary Access Changes

Grant Temporary Elevated Access

Scenario: Developer needs temporary Admin access for integration setup

1. Update user to Admin access
2. Document in access log with expiration date
3. Set calendar reminder to downgrade access
4. After project completion, downgrade back to Standard

Best practice: Use service accounts for temporary elevated access instead of modifying individual user permissions.

Suspend Access Temporarily

Google Ads does not support "suspending" access. Options:

Option 1: Change to Email-only (removes login but maintains email reports) Option 2: Remove access entirely and re-add later

Recommended: Option 1 for known temporary suspensions (e.g., leave of absence).

Verification Checklist

After updating user access:

• User appears in Access and security with new permission level
• User is notified of permission change
• Change is documented in access management log
• If downgrade: Verify user cannot access restricted features
• If upgrade: Verify user can access new features
• Review Change history for any unintended user actions

Common Issues & Solutions

Cannot Change User Permission (Greyed Out)

Causes:

• You do not have Admin access
• User is the last Admin (cannot downgrade last Admin)
• User invitation is pending (cannot modify until accepted)

Solutions:

• Verify you have Admin access
• Promote another user to Admin before downgrading current Admin
• Wait for user to accept invitation, then modify

User Still Has Old Permissions After Update

Causes:

• User's browser cache not refreshed
• User logged in during permission change

Solutions:

• Ask user to sign out and sign back in
• Clear browser cache
• Wait a few minutes for changes to propagate

User Lost Access After Update

Causes:

• Accidentally changed to Email-only (removes login)
• User was removed instead of modified

Solutions:

• Check Access and security list
• If Email-only, upgrade back to Read-only or Standard
• If removed, re-add user with correct permissions

Audit Trail

Google Ads maintains a change history of permission modifications:

View Access Change History

1. Navigate to Tools & Settings
2. Under "Setup," click Change history
3. Filter by:
   • Type: "Access and security"
   • User: Specific user who made changes
   • Date range: Recent access modifications

Logged events:

• User invited
• User access level changed
• User removed
• User accepted invitation

Security Best Practices

• Document changes: Record reason for permission changes in access log
• Notify users: Inform users when their access level changes
• Manager approval: Require manager sign-off for Admin access grants
• Regular reviews: Audit user access quarterly to ensure least privilege
• Immediate downgrades: Remove Admin access immediately when no longer needed
• Monitor activity: Review Change history after permission upgrades
• Two-factor authentication: Enforce 2FA for all Admin users

Communication Template

When updating user access, notify them via email:

Subject: Google Ads Access Updated - [Account Name]

Hi [User Name],

Your access to the Google Ads account [Account Name - 123-456-7890] has been updated:

Previous Access Level: [Standard]
New Access Level: [Read-only]
Effective Date: [YYYY-MM-DD]
Reason: [Access review - role change]

If you have questions about this change, please contact [Admin Name] at [admin@company.com].

Note: Changes take effect immediately. You may need to sign out and sign back in to see updated permissions.

Thank you,
[Your Name]

Automation & Monitoring

Automated Access Reviews

Use Google Ads Scripts to generate access audit reports:

function auditAccessChanges() {
  var account = AdsApp.currentAccount();
  var spreadsheet = SpreadsheetApp.openByUrl('YOUR_SPREADSHEET_URL');
  var sheet = spreadsheet.getActiveSheet();

  sheet.clear();
  sheet.appendRow(['Email', 'Access Level', 'Date Added']);

  var users = account.users().get();
  while (users.hasNext()) {
    var user = users.next();
    sheet.appendRow([
      user.getEmail(),
      user.getAccessLevel(),
      new Date()
    ]);
  }

  Logger.log('Access audit completed');
}

Schedule to run monthly for continuous access monitoring.

Related Documentation

• Add User Access
• Remove Access
• Google Ads User Management Overview