Who permitted you to use Google Analytics? This is a serious question.
Permissions and roles control what you and other users can do in a Google Analytics 4 account and property.
User roles and how permissions and data-restrictions affect what you can do. Understanding them is essential Google Analytics knowledge, no matter your skill level.
What you will learn
- The importance of user access governance in GA4.
- The difference between account and property permissions.
- The limitations of the 5 GA4 user roles so you can assign the right permissions to your users.
- Which additional data-restriction settings you can use to hide monetary metrics.
- How you can grant users access to GA4.
- How to ask for more privileges. In Google Analytics 4 of course. (Not in your interpersonal relationships. That's well beyond the scope of advice you can expect from a web analytics blog)
What’s even the point of access governance in GA?
If you are working as a team, more people will need to have access to GA to perform their job properly. This doesn’t mean that as a solopreneur or owner of an SMB you don’t need to worry about who has access to your account.
Let me put it as follows, so it sinks in:
Not everybody needs to be able to delete your GA account and all your data.
That is the worst that can happen if you take user access governance in GA lightly.
In a less nightmarish scenario, users don’t wipe out your data. But you must realize that every user that has access can harm you, intentionally or accidentally.
The only way to prevent this is by understanding permissions in GA4 and then apply it to your team and external service providers, or customers.
Marketers, for instance, definitely need detailed data about campaigns. Investors, on the other hand, are more interested in high level KPIs and revenue.
Thing is, not everybody needs to know what is happening on your site. Not everyone is equally qualified to change settings inside your GA account or properties.
This brings me to an important item I want to discuss before we dive into GA4 user roles and permissions.
GA4 access on account and property level
Google Analytics has a hierarchical structure. This plays an important role in user access management. In summary:
- GA account. Ideally, there is one account per business.
- An account can have multiple properties. A property can collect data for one website or domain and its associated apps. Or a property can also be set up for cross-domain tracking.
You can give users permissions on the account or property level.
For businesses or agencies that manage multiple websites, GA4 user access management is an important tool. And responsibility.
You can, for example, restrict the access of team members to a certain website (property). And even then, you can control the permissions they have there.
There is one tricky situation you need to keep in mind.
You can give a user different access levels to an account and a property. But the property permissions are inherited from the account level, if it is higher in the ranking of the 5 available user roles.
Let’s look at them in more detail…
The 5 roles of Google Analytics 4
GA4 has 5 user roles: Administrator, Editor, Marketer, Analyst and Viewer. By assigning users one of these roles, you can control what they can do on the account or property level.
The roles have a hierarchical structure.
The highest level (Administrator) has all permissions and can do everything.
The lowest (Viewer) can do the least in GA.
You can also assign the None role, which in fact ensures that the user cannot access an account or a property. Instead of removing their permissions and access completely, this can be a handy temporary demote option.
Let’s look at what users can actually do with one of the standard roles.
1. Administrator role
An administrator can do everything in GA4. That includes all permissions of all the other roles.
However, user management and data restriction settings are exclusively reserved to administrators.
This level of access should be used sparingly. Users at this level can lock other people out of an account. So make sure you trust the users who you authorize at this level.
Remember that GA4 has accounts and properties, so bear the following in mind.
A GA4 account administrator fully controls the account and all the properties in it. That includes user management and access permission for the properties.
I almost never grant anyone account level access with manage users permissions. That level of access is like giving someone the deed to your Google Analytics account. It's much safer and easier to authorize access at a property level.
GA4 property administrators have less permissions. They can only manage users within the property. They can also not change settings on account level, such as Data Sharing.
PRO TIP: Unless you are a freelancer or solopreneur, make sure your organization has at least two administrators. This will save you from horrible headaches the moment you need to recover your GA account.
2. Editor role
Like administrators, editors have full control over an account or property. This includes, for instance, activating enhanced measurement or deleting a property. The one thing editors don’t have permission for is to manage other users and their permissions.
The editor role is best reserved for advanced users. Users with this role need to know what they are doing in Google Analytics.
Account members with editor access permissions should be Google Analytics certified, for what that document is worth.
For the rest, they can also do everything else the lower level user roles can do.
3. Marketer role
As a marketer, your permissions in GQ4 are far more restricted compared to what an editor can do. You can, for instance, not change session settings.
Users at this level of permission usually have analytics skills. But, they lack the technical capability to manage or set up a Google Analytics account.
The marketer role inherits the permissions of the roles lower in the ranking. On top of they can :
Manage audiences, conversions and custom events.
That may sound limited, but in practice, this is sufficient to make sure that marketing efforts can be measured in detail.
4. Analyst role
Analysts are working with the data that is available. For that reason, they don’t need access to settings that are related to collecting the data, or linking products to GA4, such as Google Search Console.
This role is great for teamwork. Team members can work in an account together without being dangerous to any of the settings. I call this the “Nerf” level of access. You can use all the tools, without doing much damage.
Reports and explorations are what you need as an analyst and you can manage them or collaborate on shared assets. Those are, for example, custom reports other users have created and shared with you.
5. Viewer role
The role with the lowest GA4 access rights is the Viewer. This level of access allows you to see the data, but it doesn't let you make any changes to the account or property.
Users with this level of access can look at the data all they want. But they can't affect the account, and they can't collaborate with other users in Google Analytics.
Still, they can see and do a lot, such as:
- Add secondary dimensions to reports. That is, e.g., useful to filter by subdomains in reports.
- Add comparisons in, for instance, the realtime report to see what users from a certain region are doing live on your site.
- View (not collaborate on) shared assets, such as the exits exploration report.
If you think that this role is too restricted, think again.
Or try out the GA4 demo account. It is one of the best ways to practice GA4 without a website and it allows you to feel what it is to have the Viewer role in a GA4 account.
Besides the 5 roles in GA4, there are 2 additional data restriction settings that give even more control over users’ permissions at property level.
Data restriction settings in GA4
For every user role, you can hide two types of data related to money: cost metrics and revenue metrics.
When these restrictions are applied to users, they will, for example, won’t see this business sensitive data in the GA4 monetization report.
Please note: you can also deactivate this for administrators, but they can easily give themselves permission to these metrics.
You can force the restriction when you are giving permissions to a new user, as I have outlined in the following section.
Or as an administrator, you can change user roles or data restrictions at any time.
How to give a user access to GA4?
To give a user access to a GA4 account or property, you need to be an administrator. Make sure you are in the right account and property. Then follow these steps.
Step 1: Click on Admin
The button is floating at the left-bottom corner of your screen.
Step 2: Open the Access Management settings
Click on either Account Access Management or on Property Access Management.
You can find the button in the right-top corner of your screen.
Step 4: Click on Add users
If you want to share your GA4 account or property with one person only, click on Add Users.
User Groups are useful for bigger organizations and to use it, you first need to create a free account on the Google Marketing Platform and set up an organization.
Step 5: Enter the email address of the user
The user needs to have the email address associated with a Google Account. This can be done later, if needed.
Optional, but recommended: check the Notify news users by email option. This will save you from sending a mail yourself to the user.
Step 6: Assign a user role
You can choose between 5 different roles. They are ranked from all to the least permissions.
Step 7: Optional apply data restrictions
You can hide revenue and cost metrics for a user.
The moment you click the Add button, the user has access to the selected GA4 property or account.
If needed, you can always assign another role later on.
How to request more access permissions for GA4?
Basically, permissions and roles define which tasks you can perform in a Google Analytics account or property.
Although this may seem obvious, there is more to access control. Anya, a student of our Google Analytics Mastery Course asked the following question in our private DDU community:
How do you go about asking your clients to give you access as a consultant – do you ask them to add you as a Viewer and then tell them what they need to do? Or do you offer to do it for them and ask them to upgrade your role in GA4?
How to get permission in GA4 is a big question, but it's also an important one!
Despite the user role you have been granted, you can always request directly in GA4 to upgrade your role and access level.
To do so, click in your admin dashboard on Account Access Management.
Then, click theRequest Access link.
In the pop-up window, select one of the five roles and click Confirm.
That’s the easy technical way to request a higher level of permissions. However, there are deeper forces at work here that you need to be aware of…
What level of access do you need?
Maybe a better question is what level of access do you deserve?
Gaining permission in GA is like earning trust. You need to prove to the account owner that you are trustworthy and that you're not going to mess up their account.
How do you prove you deserve a high level of access?
Remember, Anya asked about working as an analyst and setting up conversions for an account she's working on. Without gaining Marketer level access, she can't turn events into conversions for her client's account.
She needs at least to have the role of a Marketer at a property level to get her job done. This scenario is not uncommon.
If you're trying to make a living as an analyst, or as a digital marketer, you want the most access you can obtain. More access equals more information.
Beyond being trustworthy, there are a few things that factor into gaining higher level permissions in Google Analytics.
Google Analytics certification
First of all, the account admin needs to know you have the right skill set. The easiest way to prove you have the skills to work on Google Analytics accounts is to get certified.
Helping people get Google certified is the reason I created the Google Analytics Mastery Course. A Google certification for an analyst is like a badge for a police officer.
If you want to get access, you need to show your credentials!
Use Analytics Course to help you get Google certified and gain Edit level access
So, if you need Edit level access, take our Google Analytics Mastery Course. The Course is built to take you from zero to Google Analytics certified.
The course will also hold your hand while you're working in Google Analytics. Following the course will save you from messing up anyone's account.
And if you get stuck? You can ask questions in our private DDU community. You'll get your Google Analytics questions answered by me, or one of our savvy students. Then you can take our advice to pass it off as your own work.
So let's assume you're one of my students or another smart Google certified analyst. Let's talk about how you get the access you deserve.
Here's my process for getting the Google Analytics permissions I need to do my job as an analyst:
1- Explain exactly what you are going to do, why, and how you will do it.
Be transparent about the work you plan to do. Would you give someone access to your Google Analytics account without knowing why they need access? Probably not. So be straightforward with the account owner or administrator. Tell them what you're going to work on. Why you're doing that work, and how you're going to do your job.
2 – Explain the risk of the change, and how you are mitigating the risk.
Account managers don't want to take any risks. Show them you understand the risks at the access level you need, and let them know how you can mitigate any risk.
3 – Show your experience and examples of your work to inspire confidence in your capabilities.
Show the account owner or admin you know what you're doing! Show off your shiny Google Analytics certification. And if you can, speak to examples of similar work you've done for other accounts.
Present client or peer testimonials to help show off your work. Let the account manager know that they're not handing over account access to a complete novice.
4- Develop a timeline for the work you're going to complete
Present a timeline for your work. Tell the account owner when you'll accomplish the objectives you're going to work on. And let the powers that be know when they can expect to see the outcome of your work.
It's likely that the analytics problems the account owner faces are holding up other work. If they know when you can help them get their business to the next step, they are probably going to give you access.
If you can map out these steps, then, in my opinion, you deserve access.
Wrapping it up
Understanding permissions and roles in Google Analytics 4 is important for users of all levels. As an administrator, you want to make sure that your business-critical data remains safe.
As a user with less access rights, you need to have sufficient permission to access data, functionalities and account or property settings to perform your job professionally.
If that is not the case, you now know how you can work your way up towards earning higher access levels.
To help you gain experience, I have created a course to master GA4 in as little as a weekend.
