Taboola User Management | Blue Frog Docs

Centralized access management workflows for Taboola, covering invitations, removals, and role maintenance for cross-team engagements.

User Management Overview

Taboola (Backstage) organizes access by Account and Site. Common roles: Admin (full control, billing, pixels, and user invites), Account Manager (campaign setup and optimization), Billing (invoice/payment visibility), and Read Only (reporting). Assign users to the specific Sites or Advertisers they manage instead of granting global access.

Taboola Backstage's permission model is built around accounts that contain multiple sites or advertisers. Each account operates independently with its own billing arrangements, user roster, and tracking code configurations. Understanding this hierarchy is essential when managing access, as users granted account-level visibility can see all sites, campaigns, and invoices - even if they don't actively manage them.

Access model & roles

Taboola structures access around accounts and sites/advertisers. When you invite someone to an account, you must decide whether they need visibility to all sites or just a subset. Most organizations limit users to specific sites to reduce the risk of accidental campaign changes or content distribution errors.

Core roles in Taboola Backstage:

Admin: Full control over the account including user invitations, billing settings, tracking code management, and site/advertiser creation. Admins can modify account-level settings such as payment methods, blocklists, and global reporting configurations. This role should be restricted to senior managers, finance leads, or operations personnel who require account-wide visibility.
Account Manager: Can create, edit, pause, and activate campaigns within assigned sites/advertisers. Account Managers handle content distribution, bidding strategies, creative optimization, and day-to-day performance management. They cannot invite users, edit billing, or modify tracking codes. This is the most common role for media buyers and campaign managers.
Read Only: Read-only access to campaigns, reports, and dashboards. Read Only users can export data and view performance metrics but cannot change campaign settings, budgets, or targeting. Ideal for analysts, client stakeholders, or finance teams who need visibility without editing rights.
Billing: Limited to invoice and payment details. Billing users can download invoices, review payment history, and update billing contacts, but they cannot view or edit campaigns. Some organizations assign this role to accounts payable teams who don't need media access.
Custom roles: Some Taboola contracts support custom roles with granular permissions. Work with your Taboola account manager to configure these if your organization needs specialized access patterns.

Data controls:

Tracking codes and conversion events can be scoped to specific sites. When onboarding agencies, explicitly assign which sites they can associate with tracking code implementations and performance measurement.
Blocklists and brand safety controls are typically managed at the account level by Admins. Account Managers inherit blocklist settings based on site assignment.
Always document which content sources and publisher partnerships are authorized per site to avoid unexpected content distribution or compliance issues.

Common use cases

Agency onboarding: When bringing on an external agency, assign them Account Manager access limited to the sites/advertisers they will manage. Never grant account-wide access unless they are managing your entire Taboola presence. If they need reporting for client presentations, consider adding a separate Read Only user for their stakeholders instead of elevating campaign management permissions.

Client access: Clients typically need Read Only access to monitor campaign performance for their specific site/advertiser. Avoid giving clients Admin or Account Manager roles to prevent accidental changes. If a client insists on editing access, create a dedicated test site for training and limit their production access.

Internal team members: Campaign managers should receive Account Manager access with site-specific assignments. Finance teams should get Billing only. Data analysts or BI teams who need raw reporting data should receive Read Only access.

Contractor or temporary access: For short-term contractors, use Account Manager with a defined expiration date. Document the removal date in your ticketing system and set a calendar reminder. Taboola does not automatically expire users, so manual review is required.

Adding users

When adding a new user to Taboola Backstage, you'll need Admin rights and the user's work email. Taboola sends an email invitation that the user must accept to activate their account.

Step-by-step process:

Sign in to Taboola Backstage as an Admin and navigate to Admin → User Management.
Click Add user or Invite user and enter the user's email address. Use their work email for audit trail purposes.
Select the appropriate role: Admin, Account Manager, Read Only, or Billing. If uncertain, default to Account Manager and adjust later.
Choose which Site(s) or Advertiser(s) the user should access. You can select individual sites from the list or grant access to all sites (not recommended unless they truly need account-wide visibility).
If the user needs billing access, enable the Billing option. This is independent of the primary role, so an Account Manager can also have billing visibility if required.
Review your selections, then click Send Invite or Save. The user will receive an email with a link to accept and set their password.
Verify the user appears in the User Management table with a status of "Pending."

After sending the invite, notify the user to check their inbox and spam folder. Follow up if they don't accept within 72 hours.

Updating roles

Role adjustments in Taboola take effect immediately and do not require the user to log out. Changes are reflected on the next page load or action. This is useful when you need to temporarily elevate or restrict someone's permissions.

When to update roles:

An Account Manager is being promoted to Admin because they now manage billing or need to onboard other users.
An Admin is stepping down and should be downgraded to Account Manager to reduce risk.
A campaign manager is transitioning to analytics and only needs Read Only access going forward.
An agency's contract scope changed, and they now manage additional sites or fewer sites.

Update process:

Go to Admin → User Management and locate the user in the table.
Click the user's name or the Edit icon to open their profile.
Modify the role dropdown and/or adjust the Site/Advertiser assignments.
If you're downgrading an Admin, review any tracking codes or account settings they configured. Ensure another Admin can manage these going forward.
Update site assignments if the user is moving between advertisers. This prevents them from seeing another advertiser's campaign data.
Save your changes and verify the updated role appears in the user table.

Best practice: When downgrading someone from Admin to Account Manager, immediately audit any tracking codes, blocklists, or billing settings they created to ensure continuity.

Removing & offboarding

Removing a user from Taboola is permanent. Once deleted, you cannot restore their login or activity history. Always transfer ownership of critical assets before removal.

Offboarding checklist:

Identify any campaigns, tracking codes, custom audiences, or budget controls the user created. Transfer ownership to an active Admin or assign a new owner from the asset settings.
Go to Admin → User Management, find the user, and click Remove or Delete.
Capture a screenshot of the user's final permissions (role, sites, billing status) for your access log and compliance records.
Update your internal roster, SSO directory, or identity management system to reflect the removal.
If the user was an Admin, ensure at least one other Admin remains active on the account to prevent lockout scenarios.

After removal:

Run a quick audit of the account's User Management page to confirm no orphaned accounts or unexpected "Pending" invitations.
Document the removal in your ticketing system with the date, approver, and reason (e.g., "Left company," "Agency contract ended").
Schedule a reminder for your next quarterly access review to ensure the account roster stays current.

Available Guides

Change Control Checklist

Confirm whether the request is for Backstage advertisers or publisher sites and which ones.
Separate Billing visibility from campaign roles unless required for the job.
Capture proof from Admin → User Management after each change.
Sync the update to your access roster or SSO group.