Google Ads Account Access brings together the practical considerations that affect this decision, from condition and timing to the available evidence.
The exact-match query google ads account access describes a small set of controls that decide who can see spend, who can edit campaigns, and who can move money. The mechanics are simple, but the consequences of choosing the wrong level are not. A freelancer given Admin can remove the owner. A billing-only user cannot pause a runaway campaign. Understanding the levels before sending an invitation prevents both problems.
What Google Ads Account Access Controls
Access in Google Ads is identity plus permission. The identity is a Google account (a Gmail address or a Google Workspace address). The permission is a role attached to that identity inside one specific Google Ads account. Nothing is shared globally. the same person can hold Admin on one account and Read-only on another.
Three things sit behind that role:
- Visibility. Whether the user can open the account at all, and whether they can see cost, conversions, and billing information.
- Change authority. Whether the user can create, edit, pause, or delete campaigns, ad groups, keywords, ads, and assets.
- Administration. Whether the user can invite others, remove others, change roles, and alter account-level settings.
Billing is deliberately separated from campaign control. A person can manage payment methods without being able to touch a campaign, and a person can run campaigns without ever seeing a card number. That separation is the main reason the access levels exist.
Access Levels in a Google Ads Account
Google Ads assigns each invited user one of five access levels. The practical difference between them is what the user can change, not how the interface looks.
| Access level | Can view | Can change | Typical use |
|---|---|---|---|
| Admin | Everything, including billing and user management | Campaigns, settings, users, billing, account closure | Account owner and the single senior person who must never be locked out |
| Standard | Campaigns, performance data, and most settings | Campaigns, ad groups, keywords, ads, audiences, and assets | Day-to-day managers, in-house marketers, and agency media buyers |
| Read-only | Campaigns and performance data | Nothing | Clients, finance reviewers, and auditors who need oversight without risk |
| Email-only | Nothing inside the account | Nothing | People who only need to receive account notifications and reports |
| Billing | Billing and payment information | Payment methods, billing profiles, and budget-related billing settings | Finance teams and bookkeepers who handle invoices but not campaigns |
Two edge cases matter. First, Admin is not a "senior Standard" — it is the only level that can remove other users, so an agency holding Admin on a client account holds effective ownership of that account. Second, Read-only still exposes spend and conversion data, which is commercially sensitive even though nothing can be edited.
Choosing a level without over-granting
Standard access covers almost every legitimate agency task. Admin should normally stay with the business owner, with the agency granted Standard. If an agency genuinely needs Admin for technical work such as linking accounts or changing conversion settings, the safer pattern is to grant it temporarily and downgrade afterwards. Read-only is the correct default for anyone whose job is to review rather than operate.
How to Give Access to a Google Ads Account
Granting access is an invitation flow. The recipient must accept before the role becomes active, and the invitation is tied to the exact email address entered.
- Sign in to the Google Ads account that owns the campaigns, using an account that already holds Admin access.
- Open the account's access or user management area from the account-level settings.
- Start a new user invitation and enter the recipient's full Google account email address.
- Select the access level — Admin, Standard, Read-only, Email-only, or Billing — that matches what the person actually needs to do.
- Send the invitation and confirm the pending user appears in the access list.
- Ask the recipient to accept the invitation from the email, then verify the role shows as active.
If the recipient does not see the email, the first check is the address itself: a typo produces a pending invitation that never resolves. The second check is whether the message landed in a spam or promotions folder, since Google notifications are frequently filtered. A pending invitation can be cancelled and reissued from the same access list.
Removing or changing access later
Access is not permanent and should not be treated as such. When a contract ends, a staff member leaves, or a freelancer's scope changes, the role should be edited or removed from the same access list. Removing a user takes effect immediately and does not delete their historical activity in the account's change history. Downgrading from Admin to Standard is preferable to removal when the relationship continues but the trust level changes.
How to Request Google Ads Account Access
Requesting access runs in the opposite direction. The requester cannot grant themselves anything; an existing Admin must approve. There are two routes, and the correct one depends on whether the requester already operates a Manager Account.
- Identify the Google account email that will be used for the work, and confirm it is the address the account owner will invite.
- Decide the route. a direct user invitation into the client's account, or a link request from a Manager Account.
- For a direct invitation, send the account owner the exact email address and the access level required, and wait for the invitation to arrive.
- For a Manager Account route, sign in to the Manager Account, open its account management area, and start a link request to the client's Google Ads account.
- Enter the client's Google Ads customer ID so the request reaches the correct account.
- Send the request, then ask the client to approve it from their side; the link stays pending until they do.
- Confirm the account appears under the Manager Account once approved, and verify the access level granted.
The Manager Account route is usually faster for agencies because approval happens once at the account level rather than per person. It also means the agency's own staff can be added and removed inside the Manager Account without the client issuing new invitations each time. The trade-off is that the client must still approve the initial link, and the agency's visibility into the account depends on the level the client grants.
What to send with a request
A request that includes the exact Google account email, the customer ID, and the specific access level needed is approved faster than a vague request. Asking for Admin when Standard would suffice is a common reason clients hesitate, and it is a legitimate reason for them to decline.
Manager Accounts and Linked Access
A Manager Account, often called an MCC, is a separate Google Ads account that manages other accounts rather than running its own campaigns. It exists to solve the multi-client problem: one login, one billing relationship, and one place to add or remove staff across many client accounts.
Linking is a two-sided action. The Manager Account sends a link request using the client's customer ID, and the client approves it. Until approval, the link sits pending and grants nothing. Once approved, the client's account appears inside the Manager Account, and users with access to the Manager Account can reach it according to the level granted.
Three constraints are worth knowing before relying on this structure:
- A Google Ads account can be linked to more than one Manager Account, but the client remains the owner of their own account and can unlink at any time.
- Manager Account access does not automatically grant billing control over the client's account; billing stays with whoever holds the appropriate level on the client account itself.
- Removing a user from the Manager Account removes their reach into every linked account at once, which is convenient for offboarding and dangerous if the wrong person is removed.
For agencies running paid search across several clients, the Manager Account is the practical structure. For a single business with one account and one in-house marketer, direct user invitations are simpler and avoid an extra layer of administration.
Security habits that prevent access problems
Keep at least two Admins on any account that spends money, so a single departure or lost login does not lock the business out. Grant the lowest level that still allows the work. Review the access list on a schedule rather than only when something goes wrong, because dormant Admin access is the most common finding in a post-incident review. Where a person needs oversight rather than operation, Read-only delivers the visibility without the risk.
Blackstone Intelligence, a Kuching-based AI systems and digital growth agency operated by Blackstone Consultancy Sdn Bhd, works across SEO, web systems, and campaign execution for Malaysian businesses. Its published case work includes AI-assisted local SEO for Sinar Saredah Sdn Bhd, which reached page one on Google within one month for targeted search activity, and local SEO for Eyonic Sdn Bhd covering CCTV, access control, and security services. Those engagements sit alongside the account-access decisions any client makes when handing campaign control to an external team.
Access decisions are reversible, which is the point. Start narrow, widen only when a task genuinely requires it, and review the list when people or contracts change.