PPC Account Access and Permissions: A Platform-by-Platform Setup Checklist

Overview

Good advertising platform management starts with access design. A person who reviews campaign performance does not necessarily need permission to change bids, publish ads, alter conversion settings, or manage billing. Separating these responsibilities reduces avoidable mistakes and makes it easier to investigate changes later.

This checklist covers access planning for Google Ads, Microsoft Advertising, Meta Ads, analytics, and tag-management systems. Platform labels and menu paths can change, so treat the role names below as a planning framework and confirm the exact options shown in the account before inviting someone.

Use four access principles

1. Give the lowest useful level. Start with view or reporting access. Add editing rights only when the person’s responsibilities require them.
2. Separate account ownership from daily operations. Keep a controlled business-owned administrator or primary owner account rather than making an individual employee the only person who can recover access.
3. Use named users. Invite people through their own business identities instead of sharing passwords or creating generic logins that cannot be attributed to one person.
4. Document every invitation. Record the account, user, role, purpose, date granted, approver, and planned review date.

A simple inventory can support multiple accounts and make a future audit much faster:

Checklist by scenario

1. Onboarding an employee

1. Confirm the person’s responsibilities: reporting, campaign edits, conversion tracking, billing, or administration.
2. Verify that the person uses a business-controlled identity and has multi-factor authentication enabled where available.
3. Invite the user separately to each required platform. Access in one system does not automatically provide access to another.
4. Grant view access first when the role is still being assessed.
5. For campaign managers, provide the ability to edit only the relevant accounts or assets when the platform supports scoped access.
6. Reserve billing, payment, ownership, and administrator permissions for designated business owners.
7. Ask the employee to confirm they can sign in and see the intended account without granting additional rights “just in case.”
8. Log the invitation and schedule a review after the first working period or major role change.

2. Working with a contractor or agency

1. Define the deliverables before granting access. “Manage paid search” is less precise than “build and optimize campaigns, excluding billing and user administration.”
2. Use the platform’s partner, manager-account, business-portfolio, or asset-assignment process where available instead of sharing credentials.
3. Grant access to only the accounts, pages, pixels, catalogs, analytics properties, or containers needed for the agreed work.
4. Keep ownership and recovery details with the business. The external party should not become the only administrator.
5. State whether the partner may publish ads, change budgets, alter audiences, edit conversion settings, or publish tags.
6. Record the start date, approving owner, end date or review date, and offboarding contact.
7. Before work begins, agree on an approval process for major budget changes, tracking changes, and account-level settings.

For reporting-only work, view access to ad platforms and analytics may be enough. A reporting specialist may also need access to the data source used by a cross-platform ad reporting dashboard, but that does not automatically justify campaign-editing rights.

3. Giving access to Google Ads

Begin with the account or manager-account structure. Decide whether the user needs access to one advertiser account or several accounts managed through a central relationship. Use the available user role that matches the task, such as viewing reports, making campaign changes, or managing users and account settings. Confirm whether billing or payment permissions are separate from campaign permissions.

• Reporting: Use read-only access when the person only needs performance data.
• Campaign operations: Use an editing role for keyword, ad, budget, and targeting work, subject to the platform’s available controls.
• Administration: Limit administrator-level access to trusted business owners or operational leads.
• Manager accounts: Check whether access at the manager level exposes more client or business accounts than intended.

4. Giving access to Microsoft Advertising

Map the person to the specific customer or advertising account before inviting them. Separate reporting needs from campaign-management needs, and check whether the selected role also permits account settings or user management. If a manager relationship is used, confirm which accounts are visible through that relationship rather than assuming the scope is limited.

5. Giving access through Meta Business tools

Meta access commonly involves more than the ad account itself. Review the business portfolio, ad account, page, dataset or pixel, catalog, and reporting assets separately. Assign only the tasks required for the role. Someone who creates ads may need ad-account and page permissions, while a measurement specialist may need access to a dataset or related tracking asset. Check the complete asset list before sending the invitation.

6. Giving access to analytics and tag management

Analytics and tag-management permissions deserve their own review because changes can affect every channel, not just paid media. Give analysts the ability to inspect reports without allowing configuration changes. Give implementation specialists edit access only when necessary, and restrict publishing rights to people who follow a documented review process. Keep at least one business-controlled administrator for each property and container.

What to double-check

Ownership and recovery

• Is the primary owner a business-controlled account rather than a former employee’s address?
• Are recovery email addresses, phone numbers, and authentication methods still current?
• Do at least two trusted business representatives understand how access can be recovered?
• Are manager, partner, or business-portfolio relationships documented?

Scope and separation

• Does the invitation expose one account or an entire group of accounts?
• Can the user change budgets, payment settings, conversion actions, audiences, or tracking tags?
• Are production and test assets clearly distinguished?
• Does the person need access to both advertising and analytics, or only one?

Auditability

• Are named users used instead of shared credentials?
• Can the team identify who approved access and why?
• Are important changes subject to a second-person review?
• Will the account’s change history show an identifiable user?

Before changing permissions, export or record the current inventory. This creates a baseline for an access audit and helps prevent accidental removal of a required integration. Include linked tools used for UTM conventions, conversion tracking, and attribution reporting—not only the ad accounts.

Common mistakes

• Sharing one login: Shared credentials weaken accountability and make offboarding difficult. Use individual invitations instead.
• Making every operator an administrator: Broad access is convenient at first but increases the impact of an accidental or unauthorized change.
• Forgetting connected assets: Campaign work may depend on pages, datasets, catalogs, analytics properties, tag containers, or manager accounts.
• Leaving former users active: Removing someone from one platform does not remove them from every connected system.
• Granting access permanently: Temporary project access should have an end date or a scheduled review.
• Ignoring billing permissions: Campaign editing and payment management are different responsibilities. Keep them separate when the platform allows it.
• Skipping a change-control process: Access alone does not explain who may publish ads, change budgets, or alter conversion tracking.
• Failing to document exceptions: If someone receives elevated access for a specific reason, record the reason and the removal condition.

Access planning should also support performance operations. For example, a keyword specialist may need campaign-editing rights but not billing access, while a reporting analyst may only need read access to validate data in a unified PPC dashboard. Match permissions to the workflow, not to a job title alone.

When to revisit

Run this checklist before a new hire starts, before seasonal planning, when a contractor or agency changes, and whenever a platform reorganizes its account structure or permission labels. Review access after a promotion, role change, business acquisition, account migration, or new tracking implementation.

A practical cadence is to perform a lightweight monthly review of external users and a broader quarterly review of every platform. Review immediately after an unexpected account change, a suspected security issue, or the departure of someone with elevated access. Platform interfaces and role names can change, so confirm the current options directly inside each account before applying this checklist.

Five-minute action plan

1. List every advertising, analytics, and tag-management account used by the business.
2. Export or record the current users, roles, partner relationships, and ownership details.
3. Mark each person as requiring view, edit, billing, or administrator access.
4. Remove unnecessary users and reduce permissions that exceed the documented role.
5. Set the next review date and assign one accountable owner.

Keep the completed inventory with your campaign audit materials. Reusing it before each hiring cycle, seasonal budget change, and platform migration turns PPC account access from an informal favor into a repeatable security and operations process.