Meta Ads User Management

User Management Overview

Meta Ads permissions are managed inside Business Manager (also called Meta Business Suite). You invite people to the business, then assign asset-level roles for ad accounts, pixels, catalogs, pages, apps, and other resources. Core ad account roles are Admin (full control), Advertiser (create/edit campaigns), and Analyst (reporting only). Keep business-level Admins limited to people who manage payments, pixels, domains, and partner integrations.

Access Model & Roles

Business vs. Asset Hierarchy

• Business-level access: Users are first added to the Business as Employees or Admins.
  • Business Admin: Can manage all assets, add/remove users, control payment methods, verify domains, and manage partners.
  • Business Employee: Standard user who receives asset-specific roles after being added to the business.
• Asset-level access: After joining the business, users receive specific roles on individual assets (ad accounts, pixels, catalogs, pages, apps).

Ad Account Roles

• Admin: Full control including campaign management, billing, user access, and pixel/catalog sharing. Use sparingly.
• Advertiser: Can create, edit, and manage campaigns, audiences, and ads. Cannot manage billing or user access.
• Analyst: View-only access to reporting and insights. Cannot edit campaigns or access billing.

Pixel & Catalog Roles

• Pixel Admin: Can manage pixel settings, share access, view events, and configure Conversions API.
• Pixel Analyst: Can view pixel events and diagnostics but cannot modify settings or share access.
• Catalog Admin: Can manage product catalog, configure feeds, and share access.
• Catalog Advertiser: Can use catalog for dynamic ads but cannot modify catalog settings.

Page Roles

• Page Admin: Full control over page settings, posts, ads, and insights.
• Page Editor: Can create/edit posts and respond to messages but cannot manage page settings.
• Page Moderator: Can respond to and delete comments, send messages, and create ads.
• Page Advertiser: Can create ads using the page but cannot post or manage settings.
• Page Analyst: Can view insights only.

Partner Access

• Partners: Agencies, consultants, or vendors added as partners rather than employees.
• Partners can be assigned assets in bulk and managed separately from internal employees.
• Use partner access for external teams to maintain clear separation and easier offboarding.

Adding Users

Invite Process

1. In Meta Business Suite → Settings → Users → People, click Add people.
2. Enter the user's work email (must be tied to a Facebook account).
3. Select Employee access (default) or Admin access (for business admins only).
4. Assign ad account roles: Choose the ad account(s) and select Admin, Advertiser, or Analyst.
5. Assign related assets: Add pixel, catalog, page, or app access as needed for their role.
6. Click Send invite and confirm the user appears as Pending.

Best Practices for Adding Users

• Require two-factor authentication for all Admins before granting access to billing or pixels.
• Use the least-privilege principle: Start with Advertiser or Analyst and promote to Admin only when necessary.
• Document the business justification and approval for each new user in your access log.
• For agencies, add them as Partners rather than employees for clearer governance.
• Assign assets in batches (e.g., all US ad accounts + US pixel + US catalog) to streamline setup.

Updating Roles

When to Update Access

• A media buyer transitions to a reporting-only role (Advertiser → Analyst).
• Finance needs billing visibility without campaign edit rights (add Analyst role).
• An agency gains additional ad accounts or markets (assign new assets).
• A user's responsibilities expand to include pixel management or catalog updates.
• A project ends and the user should lose access to specific assets but retain others.

Update Workflow

1. Go to Business Settings → Users → People and select the person.
2. Under Ad Accounts, click the account and change the role (Admin, Advertiser, Analyst).
3. Add or remove related assets (pixels, catalogs, pages) to match current scope.
4. Save changes and confirm updates appear under the user's profile.
5. Notify the user of role changes and document the reason in your access log.

Role Transition Guidelines

• Downgrade Admins to Advertiser once onboarding is complete to reduce security risk.
• Promote to Admin only for users who need to manage billing, pixels, or other users.
• Switch to Analyst for users on leave, auditors, or stakeholders who only need reporting.
• Revisit pixel and catalog sharing when users change teams or markets to avoid unnecessary access.

Removing & Offboarding

Deactivation Triggers

• Employee or contractor leaves the company or completes their project.
• Agency contract ends and all asset access should be revoked.
• Security incident flags the account for immediate suspension.
• Two-factor authentication failures or suspicious activity detected.

Removal Steps

1. Go to Business Settings → Users → People and select the user.
2. Under Ad Accounts, remove roles from each account.
3. Remove pixels, catalogs, pages, apps tied to their work.
4. Click Remove from business to revoke all access at once.
5. Confirm removal and verify the user no longer appears in the People list.

Post-Removal Checklist

• Transfer ownership of pixels, catalogs, payment methods, and custom audiences to an active Admin.
• Remove System Users or API tokens created by or associated with the departing user.
• Check Partners tab to ensure the user wasn't also added as a partner account.
• Revoke payment methods tied to the user's personal cards or accounts.
• Document removal with screenshots from Business Settings for compliance and audits.
• Update internal rosters, SSO groups, and password vaults to reflect the access change.
• Notify the team if the user had critical roles (e.g., primary pixel owner, billing admin).

When to Use These Runbooks

• Onboarding a new agency partner or internal teammate to specific ad accounts and assets.
• Offboarding an employee, contractor, or vendor from the business and all Meta assets.
• Changing someone's role from Advertiser to Analyst (or vice versa) based on evolving responsibilities.
• Conducting quarterly access reviews to ensure only active users retain permissions.
• Responding to a security incident requiring immediate user suspension.

Available Guides

• Add User Access
• Remove User Access
• Update Access & Roles

Change Control Checklist

• Confirm whether the request is business-level (Admin/Employee) or asset-specific (ad account, pixel, catalog).
• List every asset to assign: ad accounts, pixels, catalogs, pages, apps.
• Capture before and after screenshots from Business Settings → Users → People.
• Document the business justification and approver for the change.
• Update your access roster, SSO group, or identity management system to stay in sync with Business Manager.
• Set a review date for new users (e.g., 90 days after onboarding) to confirm they still need access.

Security & Compliance Notes

• Two-factor authentication (2FA) is required for business admins and strongly recommended for all users.
• Business verification unlocks advanced features and is required for agencies and high-spending accounts.
• Domain verification is needed for pixels, Conversions API, and Aggregated Event Measurement.
• Regular audits: Review the People and Partners lists monthly to remove inactive or unnecessary users.
• Payment method security: Limit Admin access to prevent unauthorized billing changes or ad spend.
• System Users: API access via System Users should be documented and audited separately from human users.