Meta Ads Add User Access

Add User Access

Use this runbook to onboard people or partners through Meta Business Manager and grant access to ad accounts, pixels, catalogs, pages, and other assets.

Prerequisites

• Business Manager Admin rights on the owning business.
• The user's work email and confirmation they have (or will create) a Facebook account.
• Decision on whether they need Admin, Advertiser, or Analyst role on the ad account.
• List of assets to assign: ad account(s), pixels, catalogs, pages, apps, or other resources.
• Approval from manager or business owner for the access request.

Invite Workflow

Step 1: Navigate to Business Settings

1. Go to Meta Business Suite (business.facebook.com) and sign in.
2. Click the Settings gear icon in the top-right corner.
3. In the left sidebar, select Users → People.

Step 2: Initiate Invite

1. Click Add people (or + Add if no users exist yet).
2. Enter the user's email address (must be associated with their Facebook account).
3. Choose access level:
   • Employee access: Default for internal team members and most contractors.
   • Admin access: Only for business admins who will manage billing, users, and business verification.

Step 3: Assign Ad Account Roles

1. In the Assign assets section, expand Ad Accounts.
2. Select the ad account(s) the user needs access to.
3. For each ad account, choose the role:
   • Admin: Full control including billing, user management, and campaign access. Use sparingly.
   • Advertiser: Can create, edit, and manage campaigns and audiences. Cannot manage billing or users.
   • Analyst: View-only access to reporting and insights. Cannot edit campaigns.
4. Confirm the role assignments appear correctly.

Step 4: Assign Related Assets (Optional)

Depending on the user's responsibilities, assign access to additional assets:

Pixels

1. Expand Pixels in the asset list.
2. Select the pixel(s) the user needs.
3. Choose the role:
   • Admin: Can manage pixel settings, Conversions API, and share access.
   • Analyst: Can view events and diagnostics only.

Catalogs

1. Expand Catalogs in the asset list.
2. Select the catalog(s) the user needs for dynamic ads or product management.
3. Choose the role:
   • Admin: Can manage catalog settings, feeds, and sharing.
   • Advertiser: Can use catalog for dynamic ads but cannot modify settings.

Pages

1. Expand Pages in the asset list.
2. Select the page(s) the user needs for ad creation or management.
3. Choose the role:
   • Admin: Full control over page settings, posts, and ads.
   • Editor: Can create/edit posts and respond to messages.
   • Moderator: Can respond to comments and create ads.
   • Advertiser: Can create ads using the page only.
   • Analyst: Can view insights only.

Apps (if applicable)

1. Expand Apps in the asset list.
2. Select the app(s) the user needs for mobile ad tracking or app event management.
3. Choose the appropriate role (Developer, Admin, Advertiser, Analyst).

Step 5: Review and Send Invite

1. Review all assigned ad accounts and assets to confirm accuracy.
2. Add a note (optional) explaining the reason for access or the user's role.
3. Click Send invite.
4. Confirm the user appears as Pending in the People list.

Post-Invite Follow-Up

User Acceptance

1. The user receives an email invitation to join the business.
2. They must accept the invite and sign in to Facebook to confirm their account.
3. If they don't have a Facebook account, they must create one using the invited email address.
4. After acceptance, their status changes from Pending to Active in Business Settings.

Security Setup

1. Require two-factor authentication (2FA) for all users, especially Admins.
   • Go to Business Settings → Security Center → Two-factor authentication.
   • Enable the requirement for all users or specific roles.
2. Verify the user has accepted by checking their status in the People list.
3. Test their access by having them log in and confirm they can see the assigned ad accounts and assets.

Documentation

1. Update your access log or ticketing system with:
   • User name and email.
   • Date added.
   • Ad accounts and assets assigned.
   • Roles granted (Admin, Advertiser, Analyst).
   • Business justification and approver name.
2. Set a review date (e.g., 90 days) to confirm the user still needs access.
3. Capture a screenshot from Business Settings → People showing the user and their assigned assets.

Common Scenarios

Scenario 1: Onboarding an Internal Media Buyer

• Role: Advertiser on specific ad accounts.
• Assets: Ad accounts for their market or product line.
• Additional: No pixel or catalog access unless they manage tracking or product feeds.
• 2FA: Required.

Scenario 2: Adding an Agency Partner

• Role: Advertiser or Admin on client ad accounts (depending on contract).
• Assets: Ad accounts, potentially pixels for tracking setup.
• Additional: Consider adding the agency as a Partner instead of an employee for clearer governance.
• 2FA: Required for Admins, recommended for Advertisers.

Scenario 3: Granting Finance or Stakeholder Access

• Role: Analyst (reporting only).
• Assets: Ad accounts for the markets or campaigns they oversee.
• Additional: No campaign editing or billing access.
• 2FA: Recommended.

Scenario 4: Adding a Developer for Pixel/CAPI Setup

• Role: Analyst on ad account (if needed for reporting), Admin on pixel.
• Assets: Pixel(s) for the domains they are implementing.
• Additional: May need access to Events Manager and Test Events for debugging.
• 2FA: Required.

Troubleshooting

User Didn't Receive Invite Email

• Confirm the email address is correct and associated with a Facebook account.
• Check the user's spam/junk folder.
• Resend the invite from Business Settings → People.
• If still not received, ask the user to manually search for Business Manager invites in their Facebook notifications.

User Can't Accept Invite

• Confirm they are signed in to Facebook with the email address that received the invite.
• If they have multiple Facebook accounts, ensure they're using the correct one.
• Ask them to go directly to business.facebook.com and check for pending invitations.

User Doesn't See Assigned Assets After Accepting

• Verify the user accepted the invite and is marked as Active in Business Settings.
• Check that assets were actually assigned during the invite (not just business access).
• Re-assign assets if needed by editing the user in Business Settings → People.

User Needs Different Roles Than Originally Assigned

• Use the Update Access workflow to change roles without re-inviting.
• See Update Access & Roles for detailed steps.

Guardrails & Best Practices

• Least-privilege principle: Start with the minimum role required (Advertiser or Analyst) and promote to Admin only when necessary.
• Business Admin access is rare: Only grant Admin access at the business level for people who manage billing, domains, or user access.
• Use Partners for agencies: Add external teams as Partners rather than Employees for clearer separation and easier offboarding.
• Require 2FA for Admins: Before granting Admin access to billing or pixels, ensure the user has enabled two-factor authentication.
• Document everything: Keep a change log with who approved the access, why it was granted, and when it should be reviewed.
• Review after launch: Revisit permissions 30-90 days after onboarding to confirm the user has the right level of access.

Checklist

• Business Manager Admin access confirmed.
• User's email and required assets documented.
• Business justification and approver noted.
• Invite sent with correct role (Admin, Advertiser, Analyst).
• Related assets assigned (pixels, catalogs, pages).
• User accepted invite and status is Active.
• Two-factor authentication enabled (for Admins).
• Access logged in internal roster or ticketing system.
• Screenshot captured from Business Settings → People.
• Review date set for future access audit.