Update Google Analytics Roles for the collaborator | Blue Frog Docs

Update Google Analytics Roles for the collaborator

Adjust GA4 account or property permissions when scope changes.

Update Access & Roles

Use this guide when GA4 account or property permissions need adjustment. Updating access allows you to modify roles without removing and re-adding users, which preserves their activity history and configured assets.

Role and permission changes take effect immediately in Google Analytics 4. Users may need to refresh their browser to see updated permissions, but no logout is required.

When to Update Access

Update user access when:

  • A role changes: Analyst promoted to Marketing Manager; Editor stepping down to Viewer
  • Property scope expands or contracts: New websites launch; agency wins/loses client; team member takes on additional properties
  • Linked product access changes: Google Ads, BigQuery, Search Console, or Firebase integration responsibilities shift
  • Temporary elevation: User needs Editor or Administrator for one-time configuration task
  • Security or compliance requirement: Audit reveals user has more access than needed; implementing least privilege
  • Organizational restructure: Team mergers, department changes, or reporting line shifts
  • Data restrictions needed: User should only see subset of data (cost data, revenue data, etc.)

Pre-Update Assessment

Before making changes, assess:

Clarify the change request

  • Role change or property scope change? Determine if adjusting account-level role, property-level role, or both
  • Permanent or temporary? Document planned revert date if temporary elevation
  • Which properties? List specific properties to add or remove
  • Linked products affected? Identify if Google Ads, BigQuery, Search Console access needs adjustment
  • Data restrictions required? Determine if cost data, revenue data, or other restrictions apply
  • Reason for change: Business justification, security requirement, or organizational change

Review current state

  1. Go to Admin → Access Management at both Account and Property levels
  2. Note current:
    • Account-level role (if any)
    • Property-level roles for each property
    • Data restrictions applied
    • Linked product access (Google Ads, BigQuery, etc.)
  3. Screenshot for "before" record
  4. Document which audiences, conversions, or integrations they currently manage

Identify impact of changes

If reducing permissions (downgrading role, removing properties):

  • Check if user owns audiences, conversions, custom definitions in properties being removed
  • Verify no active Google Ads conversion imports depend on their access
  • Ensure another Administrator exists for properties losing Admin access
  • Confirm BigQuery exports or Looker Studio reports won't break

If expanding permissions (upgrading role, adding properties):

  • Confirm business justification and approval
  • Verify user needs the elevated access for their job function
  • Document expected scope and duration
  • Set calendar reminder if temporary
  • Consider data privacy implications of broader access

Obtain approval

For role elevations, property additions, or linked product access:

  • User's manager or department head
  • Data privacy or legal if expanding access to revenue/PII data
  • Security or compliance if adding Administrator rights
  • Marketing lead if adding Google Ads integration access
  • BI/Data team if adding BigQuery export permissions
  • Save approval for compliance audit trail

Change Execution

Step 1: Access user management

  1. Sign in as Administrator at the account or property level
  2. Go to Admin (bottom left gear icon)
  3. Choose Account Access Management or Property Access Management depending on which needs updating
  4. Locate the user by email

Step 2: Adjust account-level role (if needed)

If changing account-level responsibilities:

  1. In Account Access Management, find the user
  2. Click the three-dot menu → Edit
  3. Select new role:
    • Administrator: Full account control (all properties, users, billing)
    • Editor: Can edit account settings but not manage users
    • Analyst: Can create/edit audiences and custom dimensions
    • Viewer: Read-only access to all properties under account
  4. Consider impact:
    • Upgrading to Administrator: User gains access to all properties, billing, user management
    • Downgrading from Administrator: Loses account-level privileges; check if property-level access needed
  5. Click Save

Best practice: Account-level roles grant access to ALL properties. Use property-level roles for granular control.

Step 3: Modify property-level role (if needed)

If changing property-specific responsibilities:

  1. In Property Access Management, find the user
  2. Click the three-dot menu → Edit
  3. Select new role:
    • Administrator: Full property control (settings, users, data streams)
    • Editor: Can configure property settings, create audiences/conversions
    • Marketer: Can create/edit Google Ads links and audiences
    • Analyst: Can create/edit audiences, custom dimensions, and explorations
    • Viewer: Read-only access to reports and configuration
  4. Adding new property access:
    • Go to the new property's Access Management
    • Click + (Add Users)
    • Enter user's email
    • Select appropriate role
    • Click Add
  5. Removing property access:
    • Go to the property's Access Management
    • Find user and click three-dot menu → Remove access
  6. Click Save

Step 4: Configure data restrictions (if needed)

If user should have limited data visibility:

  1. When editing the user in Access Management
  2. Under Data Restrictions, select restrictions:
    • No cost metrics: Hides Google Ads cost data
    • No revenue metrics: Hides ecommerce revenue data
    • Direct user-identifier information only: Limits to specific user IDs
  3. These restrictions apply across all properties user has access to
  4. Click Save

Use case: Marketing interns get Analyst role with "No cost metrics" to see performance but not budget data.

Step 5: Update linked product access (if needed)

For Google Ads, BigQuery, Search Console integration changes:

Google Ads:

  1. Go to Admin → Google Ads Links
  2. Click the linked account
  3. Update user permissions if needed
  4. Or adjust their GA4 role to include Marketer role for Ads access

BigQuery:

  1. Go to Admin → BigQuery Links
  2. Verify user has appropriate BigQuery IAM permissions
  3. Update Google Cloud IAM roles separately in Google Cloud Console

Search Console:

  1. Go to Admin → Search Console Links
  2. User needs at least Viewer in GA4 to see Search Console data
  3. Verify they have Search Console property access separately

Firebase:

  1. User needs access to both GA4 property and Firebase project
  2. Update Firebase project permissions separately in Firebase Console

Step 6: Save and verify

  1. Click Save or Done
  2. Refresh and verify:
    • Role updated correctly at account or property level
    • Data restrictions applied if configured
    • User appears in correct access level
  3. Screenshot for "after" record
  4. Check Change History (Admin → Change History) to confirm update was logged

Step 7: Notify the user

Send email or message to user explaining:

  • What changed: New role, properties added/removed, data restrictions applied
  • Why: Business justification or organizational change
  • When effective: Immediate (but may need browser refresh)
  • What they can now do: New capabilities or restrictions
  • Duration: If temporary, when access will be reverted
  • Contact: Who to ask if questions or issues arise

Post-Update Validation

User confirmation

  • Ask user to refresh GA4 and verify expected property access
  • If upgraded to Administrator, verify can access Admin section
  • If downgraded to Viewer, verify cannot edit configurations
  • Check that data restrictions hide expected metrics

Functional testing

Test specific changes:

  • Administrator: Can access user management, billing (if account-level), property settings
  • Editor: Can create/edit conversions, audiences, custom dimensions but not manage users
  • Marketer: Can create/edit Google Ads links and audiences
  • Analyst: Can create explorations and custom dimensions but not edit property settings
  • Viewer: Can only view reports; cannot create audiences or conversions
  • Data restrictions: Verify cost or revenue metrics are hidden as configured

Linked product verification

If changed access to linked products:

  • Google Ads: Verify can see linked account and import conversions (if Marketer/Editor)
  • BigQuery: Check BigQuery console for GA4 export dataset access
  • Search Console: Confirm Search Console data appears in GA4 reports
  • Looker Studio: Test that data source connection still works

Documentation

  • Update access log with details:
    • User email and name
    • Date of change
    • Account role: old → new
    • Property roles: properties added/removed, role changes
    • Data restrictions: applied or removed
    • Linked product changes
    • Reason and approver
    • Temporary or permanent
  • Update team roster or RACI matrix
  • Add note to ticketing system
  • Update documentation that lists user responsibilities

Monitoring

  • Set follow-up reminder for 1-2 weeks to verify working as expected
  • If temporary elevation, set calendar alert to revert on planned date
  • Include in next quarterly access review
  • Monitor Change History for any unusual activity after permission increase

Bulk Update Operations

For updating multiple users at once:

Via Google Workspace

If GA4 is tied to Google Workspace:

  1. Update user's organizational unit or group in Google Workspace Admin
  2. If using group-based access, add/remove from relevant Google Groups
  3. Changes propagate to GA4 automatically
  4. Verify within 15-30 minutes

Manual bulk updates

GA4 doesn't have native bulk update UI:

  1. Document all users requiring the same change
  2. Process each user individually through Access Management
  3. Use consistent approach for each
  4. Screenshot each before/after for audit trail
  5. Document all changes in single access review ticket

Via Google Cloud IAM (for BigQuery)

If updating BigQuery export access for multiple users:

  1. Go to Google Cloud Console → IAM & Admin
  2. Update BigQuery project-level permissions
  3. Grant BigQuery Data Viewer role for read access
  4. Document changes in access log

Troubleshooting

User can't see new properties:

  • Verify property access was saved correctly
  • Have user refresh browser (Ctrl+F5 or Cmd+Shift+R)
  • Check if account-level role was accidentally removed
  • Confirm properties are active and not deleted

User still has old role permissions:

  • Confirm save completed successfully
  • Have user log out of Google account completely and back in
  • Clear browser cache and cookies
  • Wait a few minutes for changes to propagate

User lost access to audiences they created:

  • If properties were removed, audiences in those properties become inaccessible to the user
  • Re-add property access temporarily if needed
  • Or have another Administrator export/recreate audiences

Upgraded to Administrator but can't access billing:

  • Account-level Administrator role needed for billing access
  • Property-level Administrator doesn't grant billing access
  • Or billing access may be restricted to Account Owner only

Data restrictions not working:

  • Verify restrictions were saved correctly
  • Have user refresh browser
  • Check if user has account-level access which may override restrictions
  • Contact Google Analytics support

Google Ads link permissions not working:

  • User needs Marketer, Editor, or Administrator role
  • Verify Google Ads account itself grants access to the user
  • Check that Ads link is active in GA4
  • User may need to be added in Google Ads separately

BigQuery access not updating:

  • BigQuery permissions are managed separately in Google Cloud IAM
  • Update GA4 role AND Google Cloud IAM role
  • Can take a few minutes to propagate
  • Verify user's Google account matches between GA4 and Cloud

Best Practices

  • Document every change with reason, approver, and date
  • Screenshot before and after for compliance audit trails
  • Notify users immediately after access changes
  • Set revert reminders for temporary elevations
  • Use least privilege: Grant minimum role needed (prefer Viewer/Analyst over Editor/Admin)
  • Review quarterly: Verify all users still need current access levels
  • Use account-level roles sparingly: Property-level grants provide better control
  • Test after changes: Verify user has expected permissions
  • Apply data restrictions when users need reporting but not sensitive metrics
  • Coordinate with Google Ads team: Ensure Ads access aligns with GA4 permissions
  • Check linked products: Update BigQuery, Search Console, Firebase access separately

Common Use Cases

Promoting Analyst to Marketing Manager

  1. Obtain approval from department head
  2. Review current property access and identify gaps
  3. Upgrade property role from Analyst to Editor or Marketer
  4. Add access to new properties under their management
  5. Grant Google Ads link permissions (Marketer role minimum)
  6. Verify can create audiences and conversions
  7. Document promotion with effective date
  8. Notify user of new responsibilities

Downgrading Editor to Viewer (pre-departure)

  1. Confirm departure timeline with HR
  2. Document audiences and conversions they created
  3. Transfer ownership or export critical assets
  4. Downgrade property role from Editor to Viewer
  5. Keep read-only access active until last day
  6. Apply data restrictions if cost/revenue visibility no longer needed
  7. Document downgrade and planned full removal date

Temporarily elevating for BigQuery setup

  1. Obtain approval with specific task and revert date
  2. Screenshot current access state
  3. Upgrade to property Administrator for relevant property
  4. Also grant BigQuery Data Editor role in Google Cloud IAM
  5. Notify user to set up export by specified date
  6. Set calendar reminder to revert on completion date
  7. After export configured, downgrade back to previous role
  8. Document temporary elevation in audit log

Expanding scope (agency wins new client/property)

  1. Confirm new property covered by contract/SOW
  2. Obtain approval from account owner
  3. Add user to new property with appropriate role (usually Editor or Marketer)
  4. Verify user can access new property
  5. Update Google Ads links if they'll manage ads for new property
  6. Document with contract or SOW reference
  7. Notify agency of expanded access
  8. Update vendor access documentation

Reducing scope (property sunset or handoff)

  1. Confirm property is being deprecated or handed off
  2. Identify all users with access to the property
  3. Export critical audiences, conversions, or reports
  4. Remove property access from user
  5. Verify user no longer sees property in GA4
  6. Document property handoff and access removal
  7. Update team documentation

Moving user between departments

  1. Confirm organizational change with HR or manager
  2. Review current property access and determine new needs
  3. Add properties for new department
  4. Remove properties from old department (unless overlap needed)
  5. Adjust roles to match new responsibilities
  6. Update account-level role if management responsibilities change
  7. Update Google Ads links if managing different campaigns
  8. Document organizational change
  9. Notify both old and new managers
  10. Update team roster and org chart

Granting Google Ads integration access

  1. Confirm user will manage Google Ads conversion imports or audience sharing
  2. Obtain approval from marketing lead
  3. Upgrade property role to Marketer minimum (or Editor/Administrator)
  4. Verify user also has access to the Google Ads account separately
  5. Test that user can see Google Ads links in GA4
  6. Document with marketing team approval
  7. Train user on conversion import workflow if first time

Implementing data restrictions for contractor

  1. Contractor needs analytics access but shouldn't see financial data
  2. Obtain approval from legal or finance
  3. Grant Analyst or Viewer role
  4. Apply No cost metrics restriction
  5. Apply No revenue metrics restriction if ecommerce data is sensitive
  6. Verify contractor can see traffic but not cost/revenue
  7. Document restrictions with legal/finance approval
  8. Set reminder to remove access at contract end

Seasonal analytics team scaling

  1. Hiring seasonal analysts for holiday period
  2. Grant Analyst or Viewer role for relevant properties
  3. Apply data restrictions if they don't need cost/revenue visibility
  4. Document contract start and end dates
  5. Set calendar reminders for access removal at season end
  6. Provide training on creating explorations and custom reports
  7. Track in HR or vendor management system

Compliance-driven access reduction

  1. Security audit identifies excessive Administrator permissions
  2. Document current access levels across all properties
  3. Work with user's manager to determine minimum required role
  4. Downgrade from Administrator to Editor or Analyst where appropriate
  5. Remove access to unnecessary properties
  6. Apply data restrictions if sensitive metrics aren't needed
  7. Screenshot before and after states
  8. Document compliance requirement driving change
  9. Report changes to security/compliance team
  10. Schedule follow-up review in 90 days
↑ Back to top
// SYS.FOOTER