Properly managing user access to Spotify Ad Studio is critical for maintaining account security, ensuring compliance with data protection regulations, and preventing unauthorized campaign changes. This guide covers the complete process of removing user access, from pre-removal planning through post-removal verification and security auditing.
Overview
User access removal in Spotify Ad Studio is an immediate action that cannot be undone. Once removed, a user loses all access to the ad account, including the ability to view campaigns, access reports, or make any changes. Plan removals carefully to avoid disrupting active campaigns or losing access to important work-in-progress.
Key Characteristics of Spotify Ad Studio Access Removal:
- Immediate Effect: Access is revoked the moment you confirm removal
- Complete Revocation: User loses all permissions across all campaigns in the account
- No Grace Period: Unlike some platforms, there is no temporary read-only access after removal
- Irreversible: User must be re-invited if access needs to be restored
- No Asset Ownership: Campaigns, creatives, and audiences remain with the account, not the user
When to Remove Access
Required Access Removal Scenarios
Employee Departure:
- Resignation or termination (voluntary or involuntary)
- End of employment contract
- Transfer to different department without advertising responsibilities
- Extended leave of absence (sabbatical, long-term medical leave)
Agency or Contractor Changes:
- End of agency contract or SOW (Statement of Work)
- Switch to different advertising agency
- Contractor project completion
- Agency-client relationship termination
Role Changes:
- Employee promoted or transferred to role without ad management needs
- Shift from active campaign management to strategic oversight only
- Reduction in responsibilities no longer requiring ad platform access
- Change from full access to reporting-only needs (downgrade to viewer role instead)
Proactive Access Removal
Security-Driven Removal:
- Suspected account compromise or credential theft
- User reports potential password exposure
- Detection of unusual login patterns or locations
- Failure to comply with security policies (e.g., 2FA refusal)
- Multiple failed login attempts suggesting brute force attack
Compliance Requirements:
- Regulatory requirement for least-privilege access
- Audit finding requiring access reduction
- Data protection policy mandating access reviews
- Privacy regulation compliance (GDPR, CCPA access minimization)
Operational Hygiene:
- Quarterly or annual access reviews revealing inactive users
- Consolidation of duplicate user accounts
- Cleanup of test or temporary accounts
- Reduction of admin users to minimize risk
Pre-Removal Planning
Before removing any user, take these critical steps to ensure business continuity:
1. Campaign Continuity Assessment
Identify Active Campaigns:
- Review all campaigns the user manages or has created
- Check for campaigns in draft or scheduled status
- Identify campaigns nearing approval deadlines
- Note any campaigns with pending creative reviews
Reassign Campaign Ownership (Conceptual): While Spotify Ad Studio doesn't have formal campaign ownership transfer, ensure:
- Another team member knows which campaigns the user manages
- Campaign credentials (if separate) are documented
- Campaign naming conventions are understood for ongoing management
- Budget pacing and optimization strategies are documented
Critical Timing Considerations:
- Avoid removal during active campaign launches
- Don't remove access before major reporting deadlines
- Consider fiscal calendar (month-end, quarter-end)
- Schedule removal during business hours for immediate support if needed
2. Knowledge Transfer
Document Pending Work: Create handoff document including:
- Active campaigns and their status
- Pending creative approvals
- Ongoing A/B tests and their hypothesis
- Upcoming campaign launches and timelines
- Budget allocation and pacing strategies
- Recent optimizations and their rationale
- Known issues or account quirks
Extract Key Information:
# Handoff Document Template
## User Information
- Name: [User Name]
- Role: [Campaign Manager/Analyst/etc.]
- Departure Date: [Date]
- Last Day of Access: [Date]
## Active Campaigns
| Campaign Name | Status | Budget | End Date | Notes |
|---------------|--------|--------|----------|-------|
| Summer Sale 2024 | Active | $10,000 | 2024-08-31 | Pause if CTR drops below 0.5% |
| Brand Awareness | Active | $5,000 | Ongoing | Weekly creative refresh |
## Pending Items
- [ ] Q2 performance report due 2024-07-15
- [ ] New creative assets in review (approval expected 2024-07-10)
- [ ] Budget reallocation proposal for stakeholder approval
## Account Access
- Spotify Ad Studio: [account@email.com]
- Related Tools: [Analytics, Creative Cloud, etc.]
- Shared Credentials: [None/see password manager]
## Important Context
- Worked closely with Creative Team on video ads
- Main contact for Spotify rep: [Rep Name]
- Preferred reporting format: [Excel/Looker Studio/etc.]
3. Export Critical Data
Campaign Reports: Export comprehensive data before user removal:
- Campaign performance reports (lifetime and recent)
- Audience insights and demographics
- Creative performance data
- Budget pacing and spend history
- Conversion tracking reports
Export Process in Spotify Ad Studio:
- Navigate to Reporting tab
- Select date range (recommend exporting full account history if available)
- Select all relevant metrics:
- Export format: CSV or Excel
- Save with clear naming:
Spotify_Ads_[UserName]_Export_[Date].xlsx
Creative Assets:
- Download all creative files (images, video, audio)
- Export audience definitions and targeting parameters
- Save campaign structures and settings
- Document pixel/conversion tracking setup
4. Internal Communication
Notify Stakeholders: Before removal, inform:
- Direct manager and team members
- Cross-functional partners (Creative, Analytics, Product teams)
- Finance team (for budget management continuity)
- Spotify account representative (if applicable)
- IT/Security team (for coordinated access revocation)
Communication Template:
Subject: User Access Change - Spotify Ad Studio
Team,
As of [Date], [User Name] will no longer have access to our Spotify Ad Studio account due to [reason: departure/role change/etc.].
Campaign Continuity:
- [New Contact] will assume management of active campaigns
- All reports and documentation have been transferred
- No disruption to active campaigns is expected
Questions or concerns should be directed to [New Contact/Manager].
Thank you,
[Your Name]
Step-by-Step User Removal Process
Step 1: Access Team Management Interface
Log in to Spotify Ad Studio:
- Navigate to https://ads.spotify.com
- Enter your admin credentials
- Complete two-factor authentication if enabled
Navigate to Team Settings:
- Click on your account name or profile icon (top right)
- Select Account Settings from dropdown menu
- Click Team Members or User Management tab in left sidebar
Required Permissions: Only users with Admin or Account Owner roles can remove other users. If you don't see the Team Members option, you lack sufficient permissions.
Step 2: Locate the User to Remove
Find User in List:
Verify User Identity:
- Confirm email address matches the user to be removed
- Check "Last Login" date to verify it's the correct account
- Note current role (Admin, Editor, Viewer) for documentation
User List Information:
- Name: User's display name
- Email: Login email address
- Role: Permission level (Admin, Editor, Viewer)
- Last Login: Date of most recent account access
- Actions: Remove button
Step 3: Initiate Removal
Click Remove Button:
- Locate the user in the list
- Click Remove or Revoke Access button (usually trash icon or X)
- Button is typically on the right side of the user row
Confirm Removal:
- Confirmation dialog appears: "Are you sure you want to remove [User Email] from this account?"
- Review the warning: "This action cannot be undone. User will immediately lose access."
- Click Confirm or Remove User to proceed
- Click Cancel to abort the removal
Step 4: Verify Removal
Immediate Verification:
- User should no longer appear in Team Members list
- Refresh the page to confirm removal persisted
- Check audit log if available (Account Settings > Activity Log)
Access Revocation Test (if possible):
- Have the removed user attempt to log in (they should see "Access Denied" or be unable to see the ad account)
- Or check from another device/incognito window with their credentials (only if you have permission)
Expected Behavior After Removal:
- User can no longer log in to Spotify Ad Studio for this account
- User receives no notification email from Spotify (you must notify them)
- User's historical activity remains in account logs
- Campaigns created by user remain active and unaffected
Access Revocation Timing
Immediate Effect: Access is revoked the moment you click "Confirm" in the removal dialog. There is no delayed or scheduled removal option in Spotify Ad Studio.
Session Handling:
- If the user is currently logged in, their session may remain active briefly
- Force logout by changing account password (if shared credentials)
- Active sessions typically expire within 15-30 minutes
- For immediate security needs, consider API token revocation if applicable
Cross-Platform Considerations: If user has access to related tools, revoke simultaneously:
- Spotify for Artists (if connected for podcast ads)
- Third-party analytics platforms connected to Spotify Ads
- Shared creative asset repositories (Google Drive, Dropbox, etc.)
- Project management tools with campaign information
- Reporting dashboards with Spotify Ads data
Post-Removal Actions
1. Audit Recent Activity
Review User's Recent Actions: Check account activity logs for the 30 days prior to removal:
- Campaign changes (pause, activate, budget modifications)
- Creative uploads or modifications
- Audience changes
- Billing or payment updates
- User invitation or permission changes
Red Flags to Investigate:
- Unusual campaign spend increases
- Bulk campaign pauses right before removal
- Creative asset deletions
- Audience list exports (potential data exfiltration)
- Late-night or weekend activity (outside normal work hours)
Activity Log Access:
- Navigate to Account Settings
- Click Activity Log or Audit Trail
- Filter by user and date range
- Export log for security documentation
2. Verify Campaign Integrity
Campaign Status Check: Within 24 hours of removal, verify:
- All active campaigns are still running
- No unexpected pauses or deletions
- Budget pacing remains on track
- Targeting parameters unchanged
- Creative assets still accessible
Performance Monitoring:
- Check for sudden performance drops (could indicate accidental changes)
- Verify conversion tracking still functioning
- Confirm audiences still updating (if using custom audiences)
- Monitor spend rates for anomalies
3. Update Documentation
Access Control Documentation: Maintain a record of all access changes:
# Access Removal Log
## Removal Details
- Date Removed: 2024-07-15 14:30 EST
- User Removed: john.doe@company.com
- Role Removed: Editor
- Removed By: admin@company.com
- Reason: Employee departure
## Pre-Removal Actions
- [x] Knowledge transfer completed
- [x] Campaign reports exported
- [x] Team notified
- [x] Spotify rep informed
## Post-Removal Verification
- [x] User no longer in team list (verified 2024-07-15 14:35)
- [x] Activity log reviewed (no concerning changes)
- [x] Active campaigns verified running (2024-07-15 15:00)
## Notes
- User's campaigns reassigned to jane.smith@company.com
- Exported reports saved to /company/shared/spotify-ads/exports/
Update SOPs and Runbooks:
- Remove user from contact lists in documentation
- Update campaign responsibility matrices
- Revise escalation procedures if user was a key contact
- Modify approval workflows if user was an approver
4. Stakeholder Notification
Post-Removal Communication: After successful removal, notify:
- The removed user (if they don't already know)
- Their manager (confirmation of completion)
- Team members taking over their responsibilities
- Finance/procurement (if agency/contractor invoicing changes)
Notification Template to Removed User:
Subject: Spotify Ad Studio Access Removed
[User Name],
Your access to [Company] Spotify Ad Studio account has been removed as of [Date and Time].
This action was taken due to: [reason]
If you believe this was done in error, please contact [IT/Manager/HR Contact].
[Your Name]
[Your Title]
Security Considerations
Credential Management
Password Changes: If credentials were shared (not recommended, but common):
- Change account password immediately after user removal
- Update password in team password manager
- Notify remaining team members of new credentials
- Enable two-factor authentication if not already active
API Token Revocation: If Spotify Ads API was used:
- Revoke any API tokens the user had access to
- Generate new tokens for continued API access
- Update any automated reporting or bidding tools with new tokens
- Audit API call logs for unusual activity
Two-Factor Authentication
Enhanced Security:
- Require 2FA for all remaining users
- Use authenticator apps (Google Authenticator, Authy) instead of SMS
- Maintain backup codes in secure location
- Review 2FA settings after user removal
Post-Removal 2FA Verification:
- Ensure removed user's 2FA device is no longer associated
- Verify no backup phone numbers belong to removed user
- Check for any authentication app tokens that should be revoked
Data Access Audit
Sensitive Data Review: After removing a user with high-level access, audit:
- Audience list downloads in past 90 days
- Report exports containing customer data
- Creative asset access or downloads
- Budget and billing information viewed
- Connected third-party tools and their data access
Compliance Obligations: For regulated industries or GDPR compliance:
- Document the removal in access control logs
- Retain audit trail for required period (typically 7 years)
- Notify DPO (Data Protection Officer) if user had access to personal data
- Review data processing agreements if user was external contractor
Emergency Access Removal
High-Risk Removal Scenarios: For immediate security threats (suspected account compromise, hostile termination):
Immediate Actions (within 1 hour):
- Remove user from Spotify Ad Studio
- Change all shared passwords
- Revoke API tokens
- Pause all active campaigns (temporary)
- Enable login alerts and monitoring
Short-Term Actions (within 24 hours):
- Review all recent user activity
- Verify no unauthorized changes
- Contact Spotify support for additional security measures
- Change recovery email if it was user's email
- Audit connected applications
Follow-Up Actions (within 1 week):
- Complete security audit
- Resume campaigns after verification
- Implement additional security controls
- Update incident response documentation
Best Practices for User Access Removal
1. Timely Removal
Same-Day Removal Standards:
- Remove access on the user's last day of employment
- For involuntary terminations, remove access immediately
- For contractors, remove access when contract ends (not before)
- Don't wait for formal HR offboarding completion
Scheduled Removal: For planned departures with transition periods:
- Set calendar reminder for removal on last day
- Downgrade access to view-only if appropriate
- Monitor activity more closely during transition
- Have all knowledge transfer completed before final removal
2. Maintain Audit Records
Comprehensive Documentation: Maintain records including:
- Who was removed
- When they were removed
- Who performed the removal
- Reason for removal
- Pre-removal exports and documentation
- Post-removal verification results
Record Retention:
- Keep access removal logs for minimum 7 years (common compliance requirement)
- Store in secure, centralized location (access control system, HRIS, etc.)
- Include in regular backup procedures
- Protect records with appropriate access controls
Audit Log Review:
- Monthly review of all access changes
- Quarterly validation that removed users still lack access
- Annual comprehensive access audit
- Document review findings and any corrective actions
3. Regular Access Reviews
Quarterly Access Audits: Every 3 months, review all current users:
- Verify each user still requires access
- Confirm role/permission level is appropriate
- Check for inactive accounts (no login in 60+ days)
- Remove or downgrade unnecessary access
- Document review completion
Access Review Process:
# Quarterly Access Review Checklist
Date: [Quarter End Date]
Reviewer: [Name]
For Each User:
- [ ] User still employed/contracted?
- [ ] Role still requires Spotify Ads access?
- [ ] Permission level appropriate for current responsibilities?
- [ ] Activity in past 90 days? (If no, consider removal)
- [ ] Any security concerns?
Actions Taken:
- Removed: [List users removed]
- Downgraded: [List users with reduced permissions]
- No Change: [Count of users unchanged]
Sign-off: [Name] [Date]
4. Established Offboarding Process
Integrated Offboarding Checklist: Include Spotify Ad Studio access removal in broader offboarding:
# Employee Offboarding Checklist
## IT Access Removal (Day of Departure)
- [ ] Spotify Ad Studio access removed
- [ ] Google Ads access removed
- [ ] Facebook Ads access removed
- [ ] Analytics platforms access removed
- [ ] Email account disabled
- [ ] Slack/Teams account deactivated
- [ ] VPN access revoked
## Knowledge Transfer (Prior to Departure)
- [ ] Campaign handoff document completed
- [ ] Reports exported and saved
- [ ] Password manager entries transferred
- [ ] Team members trained on takeover
## Verification (Within 24 hours)
- [ ] Confirmed user cannot access Spotify Ads
- [ ] Active campaigns still running
- [ ] No unusual account activity detected
Cross-Functional Coordination:
- HR triggers IT for access removal
- IT coordinates with Marketing for ad platform access
- Marketing verifies business continuity
- Security audits removal completion
5. Principle of Least Privilege
- Default to minimum necessary permissions
- Use Viewer role when possible (read-only access)
- Limit Admin role to 2-3 people maximum
- Regularly audit and downgrade over-provisioned access
Just-In-Time Access:
- Grant elevated access only when needed
- Set expiration dates for temporary access increases
- Require re-approval for continued access
- Document justification for all admin access
Restoration of Access
If a removed user needs access restored:
Re-Invitation Process:
- Navigate to Account Settings > Team Members
- Click Invite User or Add Team Member
- Enter user's email address
- Select appropriate role (Viewer, Editor, or Admin)
- Click Send Invitation
- User receives email invitation to rejoin
- User must accept invitation to regain access
Important Notes:
- User must be re-invited; there is no "undo" for removal
- User receives a new invitation email
- Previous permissions are NOT automatically restored
- Previous activity history is retained
- Consider whether restoration is appropriate or if security concerns persist
Troubleshooting
Cannot Find Remove Button
Possible Causes:
- You don't have Admin permissions (only Admins can remove users)
- Trying to remove yourself (account owners may not be able to self-remove)
- User is the only Admin (must have at least one Admin)
Solution:
- Request Admin access from current Admin
- Have another Admin remove the user
- Promote another user to Admin before removing the last Admin
Removed User Still Has Access
Diagnosis:
- User may be logged in with active session (can take up to 30 minutes to fully revoke)
- User may have been re-added by mistake
- User may have access through a different email address
Resolution:
- Wait 30 minutes and verify again
- Check Team Members list for duplicate entries
- Force logout by changing account password (if shared credentials)
- Clear browser cache and retry
User Removal Not Appearing in Audit Log
Expected Behavior: Not all platforms log access removal events in user-facing audit logs.
Workaround:
- Maintain your own access removal log (see documentation templates above)
- Export Team Members list before and after removal for comparison
- Contact Spotify Ads support for access removal verification if needed
Related Documentation
- Add User Access - Inviting new users to Spotify Ad Studio
- Update User Access - Changing user roles and permissions
- Security Best Practices - Account security guidelines
Support and Resources
Spotify Ads Support:
- Help Center: https://ads.spotify.com/help
- Support Email: adshelp@spotify.com
- For account security concerns, contact support immediately
Emergency Contact: For urgent security issues related to account compromise, contact Spotify Ads support directly and request priority escalation.