Amazon Advertising Update Access & Roles | OpsBlu Docs

Amazon Advertising Update Access & Roles

How to modify user roles, permissions, and access levels in Amazon Advertising. Covers role changes, app access management, API key rotation, and common.

Update Access & Roles

Use this guide to modify Amazon Advertising permissions when user responsibilities change. Amazon operates two main products - Sponsored Ads and DSP - each with different roles and permissions. Properly updating access maintains security, ensures compliance, and prevents disruption to campaigns or billing.

Understanding Amazon Advertising Access Model

Amazon Advertising has two distinct products with separate access management:

Access Levels:

  • Manager account vs. individual advertiser profile access
  • Marketplace-based: Users can have different access to different marketplaces (US, UK, DE, etc.)

Available Roles:

  • Administrator: Full access including user management, billing, and payment methods
  • Editor: Campaign management without billing or user access
  • Viewer: Read-only reporting access
  • Billing: Invoice and payment access only

DSP (Amazon Demand-Side Platform)

Access Levels:

  • Seat-level access structure
  • Advertiser-based: Users can be limited to specific advertisers within a seat

Available Roles:

  • Administrator: Full access including user management, billing, pixels, and API credentials
  • Operator: Campaign and line item management without billing or user access
  • Analyst: Read-only reporting and data access

When to Adjust Roles

Update user access when:

  • Role transitions: External trader moves to reporting-only role after handoff
  • Responsibility expansion: Campaign manager needs additional marketplace or advertiser access
  • Responsibility reduction: User no longer manages certain marketplaces or advertisers
  • Finance requests: Billing visibility needed for invoice or payment management
  • Temporary elevation: Strategist needs temporary Editor/Operator rights for specific project
  • Compliance requirements: Quarterly access reviews require role adjustments
  • Agency relationship changes: Agency contract scope expands or narrows to new marketplaces/advertisers
  • Security incidents: Downgrade to read-only pending investigation
  • Seasonal needs: Temporary Editor access for holiday campaign, then revert to Viewer
  • Training periods: New hire starts Viewer/Analyst, promotes to Editor/Operator after training
  • Product transitions: User moving between Sponsored Ads and DSP responsibilities

Pre-Update Assessment

Before changing user access:

Document current state

  1. Screenshot current access for audit trail
  2. Document current role and marketplace/advertiser assignments
  3. Identify product access: Sponsored, DSP, or both
  4. Note billing visibility status
  5. Record in ticket or access log

Determine new access level

  1. New role needed:
    • Sponsored Ads: Administrator, Editor, Viewer, or Billing
    • DSP: Administrator, Operator, or Analyst
  2. Access scope changes:
    • Sponsored Ads: Add or remove marketplaces
    • DSP: Add or remove advertisers or seats
  3. Billing visibility: Should billing access be enabled or disabled
  4. Duration: Permanent change or temporary elevation

Obtain approval

Get written approval from:

  • User's manager or account owner
  • Finance or compliance if adding billing visibility
  • Security if elevating to Administrator role
  • Legal if contractual or vendor-related change

Document approval in ticketing system or access log.

Update Workflow (Sponsored Ads)

Step 1: Access user management

  1. Sign in to Amazon Advertising
  2. Select correct advertiser profile or manager account
  3. Navigate to Settings → User Management
  4. Verify you have Administrator access before proceeding

Step 2: Locate user

  1. Find user in the active users list
  2. Review current role and marketplace assignments
  3. Screenshot current state for documentation

Step 3: Edit user access

  1. Click Edit or Manage Access next to user name
  2. User editing form appears

Step 4: Update role

  1. Select new role from available options:
    • Administrator (requires business justification and approval)
    • Editor (most common for campaign managers)
    • Viewer (for reporting and oversight)
    • Billing (for invoice access only)
  2. Review role description to confirm appropriate selection

Step 5: Update marketplace access

To add marketplaces:

  • Check boxes for additional marketplaces to grant access
  • User will see campaigns and advertisers for new marketplaces
  • Document which marketplaces were added

To remove marketplaces:

  • Uncheck boxes for marketplaces to revoke access
  • User will lose access to those marketplace campaigns immediately
  • Verify user doesn't own critical campaigns in removed marketplaces

Marketplace scope considerations:

  • Different marketplaces have different currencies and regulations
  • Some users may need all marketplaces, others only specific regions
  • Agency contracts often specify marketplace scope

Step 6: Save changes

  1. Review all changes for accuracy
  2. Click Save or Update
  3. Changes take effect immediately
  4. User may need to log out and back in to see updated access

Step 7: Verify changes

  1. Refresh User Management page
  2. Confirm updated role and marketplace list display correctly
  3. Screenshot updated state for audit trail

Update Workflow (DSP)

Step 1: Access DSP user management

  1. Sign in to Amazon DSP console
  2. Navigate to correct seat
  3. Go to Admin → User Management
  4. Verify you have Administrator access before proceeding

Step 2: Locate user

  1. Find user in the active users list
  2. Review current role and advertiser/seat assignments
  3. Screenshot current state for documentation

Step 3: Edit user access

  1. Click Edit or Manage Access next to user name
  2. User editing form appears

Step 4: Update role

  1. Select new role:
    • Administrator (requires business justification and approval)
    • Operator (most common for traders)
    • Analyst (for reporting access)
  2. Review role permissions

Step 5: Update advertiser/seat permissions

Seat-wide access:

  • Grant access to all advertisers within the seat
  • Higher privilege - requires approval
  • Best for internal teams managing multiple advertisers

Advertiser-specific access:

  • Select specific advertisers user should access
  • Add advertisers: Check boxes for new advertisers
  • Remove advertisers: Uncheck boxes for advertisers to revoke access
  • Recommended approach for agencies and contractors

Step 6: Save changes

  1. Review all changes for accuracy
  2. Click Save or Update
  3. Changes take effect immediately
  4. User may need to log out and back in to see updated access

Step 7: Verify changes

  1. Refresh User Management page
  2. Confirm updated role and advertiser permissions display correctly
  3. Screenshot updated state for audit trail

Post-Update Tasks

Notify user

  • Inform user of access change
  • Explain new role and capabilities
  • List marketplace or advertiser changes if applicable
  • Provide effective date (changes are immediate)
  • Share updated onboarding docs if role significantly changed

Update documentation

Update the following:

  • Access log or ticketing system:
    • User email and name
    • Date of change
    • Product (Sponsored Ads, DSP, or both)
    • Old role and new role
    • Old marketplaces/advertisers and new ones (if changed)
    • Billing visibility changes
    • Reason for change
    • Approver name
    • Screenshots before and after
  • Internal roster or RACI matrix
  • Contract documentation if agency scope changed

Test new access

Have user test new permissions:

Sponsored Ads:

  • Administrator: Verify can access User Management, billing, payment methods
  • Editor: Verify can create/edit campaigns in assigned marketplaces
  • Viewer: Verify can view reports but cannot edit campaigns
  • Billing: Verify can access invoices and payment methods only

DSP:

  • Administrator: Verify can access User Management, billing, pixels, API credentials
  • Operator: Verify can create/edit line items and campaigns
  • Analyst: Verify can view reports but cannot edit campaigns

Marketplace/Advertiser changes:

  • Verify user can access new marketplaces or advertisers
  • Verify user cannot access removed marketplaces or advertisers

Schedule review

  • Set follow-up reminder in 30 days to confirm access still appropriate
  • If temporary elevation, set reversion reminder for end date
  • Add to quarterly access review schedule

Troubleshooting

Changes saved but user still has old access:

  • Have user log out completely and log back in
  • Clear browser cache and cookies
  • Verify changes were saved successfully (check user list)
  • Contact Amazon Advertising support if persists after 24 hours

Added marketplace but user cannot see it:

  • Verify marketplace is active (not suspended)
  • Have user refresh browser or clear cache
  • Check if user is viewing correct advertiser profile
  • Confirm marketplace has active campaigns or advertisers

DSP user cannot see added advertisers:

  • Verify advertisers are active (not archived)
  • Have user refresh browser or clear cache
  • Confirm advertiser assignments saved correctly
  • Check if advertisers were moved to different seat

Billing visibility issues (Sponsored Ads):

  • Verify Billing role is assigned
  • Confirm billing is enabled for the advertiser profile
  • Check if payment method is configured
  • Contact Amazon support if billing access still not working

DSP billing visibility issues:

  • Verify Administrator role or billing permissions
  • Confirm seat has billing configured
  • Check if seat owner has enabled billing visibility
  • Contact Amazon DSP support if issues persist

User has access to both Sponsored and DSP - need to update both:

  • Update each product separately
  • Sponsored Ads and DSP have independent user management
  • Changes in one product don't affect the other
  • Document changes for both products in access log

Downgraded user can still edit campaigns:

  • Verify role change saved successfully
  • Check for duplicate accounts or additional access paths
  • Have user log out and back in
  • Review marketplace/advertiser permissions
  • Contact Amazon support if permissions not updating

Need to temporarily elevate access:

  • Document start date and planned reversion date
  • Set calendar reminder to revert access
  • Approve both elevation and reversion in advance
  • Monitor usage during elevated period

Best Practices

  • Document every change with reason, approver, and before/after screenshots
  • Obtain approval before making role changes, especially elevations to Administrator
  • Use principle of least privilege: Grant minimum access needed for user's responsibilities
  • Update both products if user has access to Sponsored Ads and DSP
  • Test access changes immediately after updating
  • Notify users of changes and explain new capabilities or limitations
  • Screenshot before and after for audit trail
  • Enable billing visibility only when explicitly needed and approved
  • Set review reminders for temporary access changes
  • Maintain access matrix documenting all users, roles, and changes over time
  • Schedule quarterly reviews to audit all user access levels
  • Limit Administrator role to essential personnel only
  • Use Viewer/Analyst roles for stakeholders who need visibility without edit rights
  • Separate billing from campaign roles to maintain financial controls
  • Keep at least 2 Administrators per product to prevent lockouts
  • Document business justification for every access change

Common Use Cases

Agency transition from active management to reporting (Sponsored Ads):

  1. Confirm handoff date with agency and internal team
  2. Transfer campaigns to internal team
  3. Change agency user role from Editor to Viewer
  4. Reduce marketplace access to only those requiring ongoing reporting
  5. Remove billing visibility if enabled
  6. Notify agency of change and new access level
  7. Document transition in access log

Seasonal elevation for campaign launch (Sponsored Ads):

  1. Analyst needs Editor access for Q4 holiday campaign in US marketplace
  2. Document temporary elevation with start and end dates
  3. Change role from Viewer to Editor for US marketplace only
  4. Set calendar reminder to revert on January 15
  5. Notify user of temporary elevation and reversion date
  6. Monitor usage during elevated period
  7. Revert to Viewer after campaign concludes

Finance team needs invoice access (Sponsored Ads):

  1. Finance requests billing visibility for budget reconciliation
  2. Obtain approval from account owner and finance manager
  3. Change user role to Billing (or add billing to Administrator)
  4. Grant access to all relevant marketplaces for invoice consolidation
  5. Verify user can access invoices and payment methods
  6. Document billing access grant with approver
  7. Schedule annual review of billing access

Expanding agency scope to new advertisers (DSP):

  1. Agency contract expands to include 3 additional advertisers
  2. Obtain approval from seat owner and legal
  3. Edit agency user to add new advertisers to access list
  4. Verify role remains Operator (no elevation needed)
  5. Notify agency of new advertiser access
  6. Update contract documentation
  7. Add to quarterly access review schedule

Downgrading after security incident (both products):

  1. Security team requests immediate downgrade pending investigation
  2. Change user role to Viewer (Sponsored) and Analyst (DSP)
  3. Remove billing visibility if enabled
  4. Document incident and downgrade in security log
  5. Coordinate with security team for next steps
  6. Set review date for potential restoration after investigation

User transitioning from Sponsored Ads to DSP focus:

  1. Confirm role change with manager
  2. Downgrade Sponsored Ads access to Viewer for oversight
  3. Elevate DSP access to Operator for active management
  4. Adjust marketplace (Sponsored) and advertiser (DSP) scopes appropriately
  5. Notify user of changes and provide DSP training materials
  6. Document transition and new focus areas
  7. Schedule 30-day follow-up to assess performance
Back to top