How to manage user access for Google Analytics 360 Suite Products (Google Analytics, Google Tag Manager and Google Optimize)

YouTube videos that could help you do this task :

How to Implement Google Optimize Using Tag Manager :

How to setup and install Google Optimize :

Goal: To properly and securely assign and revoke employees, freelancers, and partners access to your Google Analytics, Tag Manager and Optimize accounts.

Ideal Outcome: You have full control over who has access to your Google Analytics 360 Product accounts, and have successfully assigned or revoked access to your staff.

Prerequisites or requirements: You need a Google Account, and admin permissions on the service to which you want to share access.

Why this is important: If your Google Analytics 360 product accounts aren’t properly accounted for and managed, you can easily lose track of who has access to critical information and tools for your or your clients’ business.

Where this is done: In Google Analytics 360 Home, Optimize, and Tag Manager.

When this is done: Every time you want to grant, request, or revoke access to your Google Analytics, Optimize, or Tag Manager accounts.

Who does this: The person responsible for managing access to your Google Analytics 360 accounts.

• Select user roles for Google’s 360 Suite Home

Below you will find the different user roles and access-levels for Google 360 Suite Home. Typically you won’t need to grant your employees access to Google 360 Suite Home, but you’ll want to assign individual products instead. That being said, go through the table below to understand the access level you need for your specific case:

(Source: Google: https://support.google.com/marketingplatform/answer/7513893?hl=en)

• User roles for Google Tag Manager:

There are 2 layers of access inside Google Tag Manager: Account and Container. To select which kind of access you want to grant:

Account-level

**Important**: It is recommended to have at least 2, but not much more than 2, account-level admins in your account at any moment. This is to avoid getting locked out of your account because the sole admin lost access to the account, or left the company.

1. Does that user need to manage other user’s access to that account, and do you absolutely trust that user?
1. Yes: Give that user “Admin” account-level access;
1. Important: Make sure you trust that user. A Google Tag Manager account does not have ‘ownership’. Admins can remove other admins, and you can get locked out of your Google Tag Manager account by a malicious user.
2. No: Give that user “User” account-level access;

Container-level

(Source: Google - https://support.google.com/tagmanager/answer/6107011?hl=en)

• No access: The user will not see the container listed in the account.
• Read: The user will see the container listed and may browse the tags, triggers, and variables in the container, but will not have the ability to make any changes.
• Edit: The user has rights to create workspaces and make edits but not create versions or publish.
• Approve: The user has rights to create versions, workspaces, and make edits but not publish.
• Publish: The user has full rights to create versions, workspaces, make edits, and publish.
• Important: Make sure you only give “Publish” permission to users you trust, and that actually need to publish containers frequently. Remember, these users could potentially inject malicious code into your website oro delete current containers.
• User roles for Google Analytics:

There are 3 layers of access inside Google Analytics: Account, Property, and View. And there are 4 access levels available to those that can be assigned to each.

Permissions are inherited, this means that if you assign a user “Edit” permission at the ‘Account’ level, that user will have “Edit” permission at the ‘Property’ and ‘View’ level.

To select which kind of access you want to grant at each layer:

(Source: Google - https://support.google.com/analytics/answer/2884495?hl=en)

• User roles for Google Optimize:

There are 2 layers of access inside Google Analytics: Account, and Container. And there are 4 access levels available to those that can be assigned to each.

To select which kind of access you want to grant:

Account-level

(Source: Google - https://support.google.com/optimize/answer/6376029)

• User – Can view other users.
• E.g: A common employee would only require this access level at the ‘Account’ level.
• Admin – Can view and manage users. Can create and view containers.
• Note: You should only assign this ‘Account-level’ permissions to users that you trust, and that need to manage users on your account.

Container-level

(Source: Google - https://support.google.com/optimize/answer/6376029)

• No access – Can’t view containers or experiments.
• Read – Can view containers and experiments.
• Edit – Can view and edit containers and experiments. Cannot start experiments or change property linking.
• Publish – Can view, edit, and delete containers, experiments and property linking. Can start experiments.

Container-level summary table:

Container-level detailed table:

(Source: Google - https://support.google.com/optimize/answer/6376029)

• Creating a 360 Suite Organization Profile

Your Google Analytics 360 Suite products and accounts will be collected together in organizations. This will allow you to centrally access your accounts, and smoothly manage which users have access to your accounts.

This is how your Organization will be structured after you follow this SOP:

**Note: You can also be a member of multiple organizations:

1. Log In to your Google Account through this link. (Google 360 Suite Home > Organization Profiles)
2. Click “Get Started”:

Or click ‘Create Organization’ in the top-right corner if you already have other organizations)

3. Enter your Organization name (your employees will be able to see this)

4. Select the accounts that you want to link to your Organization Profile

**Note: Are you not seeing some of the accounts that you want to link? You can only link accounts to your organization if your Google Account has Admin permissions.

If you don’t have Admin permissions to those accounts contact one of the Administrators and request those permissions first.

3. Make sure everything is ‘ok’ and if it is, click “Create”:

4. That’s it! You’ll see a success message confirming your Organization Profile was created and your accounts linked:

**Note: If you don’t see your Organization at this point. Refresh your page (Ctrl+R for Windows, and ⌘+R for Mac). When the page refreshes you should be able to see it:

• How to link an additional Google Analytics 360 Suite Product accounts to your Organization Profile

1. Log into your Google Account through this link. (Google 360 Suite Home > Organization Profiles)
2. Select your organization:

3. Scroll down to “Linked Accounts” and click on the product that you want to link to this organization:

4. Click the ‘+’ icon on the top right corner:

5. Select the organization to which you want to link this account:
6. If you don’t have administrative access to this account:

**Note: You can locate the account ID by logging into your account and clicking in the top left corner:

7. Select “Enter comma-separated account IDs” → Enter the Account ID of the account that you want to link. → Click ‘Link’;

8. You will be notified with a message letting you know that the account was not linked. Don’t worry, this is part of the process. It just means your account wasn’t linked yet.

An administrator of the account has now received an email prompting to confirm the linking request.

Instructions to the account administrator

1. You will receive an email in the next few minutes:

2. Your email will contain details about the request that was made.

Make sure that you know and trust that email address, and that the account that is being requested is the correct one, and if it is, click “Manage Requests”:

3. You will be taken to a page where you will have one last chance to make sure you know the requester, the organization, and that the product and account that is being requested makes sense. If everything is correct:
4. Tick that specific request → Click the 3 vertical dots icon in the top right corner → Click “Approve selected requests”.

5. Read and accept the Terms of Service of Google Analytics 360 Home:

1. If you already have administrative access to this account:
1. Select the first option (“Choose accounts to which you have access”)

2. If you already have administrative access to this account select the first option (“Choose accounts to which you have access”) → Click “Choose accounts to link”:

3. Choose the account that you want to link:

4. Click “Select” in the top right corner:

5. Click “Link” in the top right corner:

6. Click “Link Account”:

7. That’s it! You will see a confirmation notification in the bottom of your screen:

• How to grant employees access to your organization, and Google 360 Suite Product accounts

1. Log In to your Google Account through this link. (Google 360 Suite Home > Organization Profiles)
2. Select your organization:

3. Under “User Management” click “Users”:

4. You will see a list of users that have access to the accounts that are linked to your organization. Click the blue “+” button:

5. Enter the email address of the person you want to give access to your organization → Click “Add”;

**Note: This email should have a Google Account associated. (If you’re using any other Google service, like Gmail, using that email you already have a Google account)

6. In the next screen you’ll see the profile of the person you’ve just invited, and you’re able to edit their permissions:
1. Organisation permissions: These permissions will grant that user access to your organization as a whole. Typically your employees would not need this type of permissions, but it would make sense for a business partner to have it.

**Note: You can check the available organization-roles and what they grant here.

7. Permissions: This section allows you to add users to your accounts, properties and views individually. It offers you more control over what each user is able to access and should typically be used for employees or freelancers.

8. Click the GA 360 Suite Product that you want to grant that user access:

9. Click the blue ‘+’ button in the top right corner:

10. Select the account that you want to grant access:

11. Depending on which product you’ve selected (Google Analytics, Google Tag Manager, or Google Optimize) you will have different options to further refine the access level;
1. Google Analytics:
12. Click the pencil icon next to the account you want to grant access:

13. Based on the permission level you’ve selected previously:

1. If you want to grant that user those permissions to all your properties: Tick those boxes on the right;

Or

• If you only want to grant access to specific properties, or different access-level per properties: Click on the pencil icon in the specific property that you’d want to assign to that user and then assign the permissions at the property and view level.

• If you want to grant that user those permissions to all your views: Tick those boxes on the right;

Or

• If you only want to grant access to specific views, or different access-level per view: Click on the pencil icon in the specific view that you’d want to assign to that user and tick the permissions that you’d want that user to have:

14. Click the blue ‘Save’ button on the top-right corner whenever you’re done granting permissions to that user:

1. Google Tag Manager:
2. Click the pencil icon next to the account you want to grant access:

3. Based on the permission level you’ve selected previously:
1. If you want to grant that user those permissions to all your containers: Tick those ‘Account-wide permissions’ boxes to the right;

4. If you only want to grant access to specific containers, or different access-level per container: Click on the specific container that you’d want to assign to that user and select the permissions you want to assign for that specific container:

5. Click the blue ‘Save’ button on the top-right corner whenever you’re done granting permissions to that user:

1. Google Optimize:
2. Click the pencil icon next to the account you want to grant access:

3. Based on the permission level you’ve selected previously:
1. If you want to grant that user those permissions to all your containers: Tick those ‘Account-wide permissions’ boxes to the right;

4. If you only want to grant access to specific containers, or different access-level per container: Click on the specific container that you’d want to assign to that user and select the permissions you want to assign for that specific container:

5. Click the blue ‘Save’ button on the top-right corner whenever you’re done granting permissions to that user:

• Removing users from your GA 360 Suite Products

1. Log In to your Google Account through this link. (Google 360 Suite Home > Organization Profiles)
2. Select your organization:

3. Under “User Management” click “Users”:

4. You will see a list of users that have access to the accounts that are linked to your organization.
5. If you want to remove a user from all the Google Analytics 360 Suite products (e.g: Google Analytics, Google Tag Manager, Google Optimize) that you have linked to your organization:

E.g: An employee no longer works in the company.

6. Locate the user that you want to remove → Click the 3 vertical dots icon → Click “Remove User”

7. Tick ‘Organisation’ → ‘Remove’

8. If you want to remove a user from only specific Google Analytics 360 Suite products (e.g: Google Analytics, Google Tag Manager, Google Optimize) that are linked to your organization:

E.g: An employee no longer works in the Google Analytics department;

9. Locate the user that you want to remove → Click on that row;

10. Select the Google Analytics 360 Suite Product:

(I.e. Google Analytics)

11. Click the 3 vertical dots on the top right corner → ‘Remove user from Analytics’

• Changing/Updating user permissions for your GA 360 Suite Products

1. Log In to your Google Account through this link. (Google 360 Suite Home > Organization Profiles)
2. Select your organization:

3. Under “User Management” click “Users”:

4. You will see a list of users that have access to the accounts that are linked to your organization.
5. Locate the user whose permissions you want to manage → Click on that row;

6. Select the Google Analytics 360 Suite Product:

(I.e. Google Analytics)

7. Follow the instructions according to the product that you want to manage permissions for:

Google Analytics:

1. You will see a list of the accounts, properties, and views that are linked to your organization and to the right you will see a summary of the access level that user has to each of those.
2. Click the pencil icon next to each of them and edit the permissions based on the permission level you’ve selected previously:

**Note: If you want to change the permissions at the view-level, use the “View Permissions” section below instead.

3. Click “Save” on the top right corner:

4. That’s it!

Google Tag Manager:

1. Click the pencil icon next to the account you want to grant access:

2. Click the pencil icon next to each of them and edit the permissions based on the permission level you’ve selected previously:

**Note: If you want to change the permissions at the container-level, use the “Container Permissions” section below instead.

3. Click “Save” on the top right corner:

4. That’s it!
5. Google Optimize:
6. Click the pencil icon next to the account you want to grant access:

7. Click the pencil icon next to each of them and edit the permissions based on the permission level you’ve selected previously:

**Note: If you want to change the permissions at the container-level, use the “View Permissions” section below instead.

8. Click “Save” on the top right corner:

9. That’s it!