What Access Does An SEO Agency Need? GA4 & Search Console Permissions

Start every agency at the lowest level that still lets it work. That means Restricted user in Google Search Console and Viewer in Google Analytics 4, with Owner and Administrator kept by you. Move to Full user or Analyst only when the agency must request indexing or needs more than Viewer allows. Neither Full user nor Analyst can add or remove users.

This holds for an agency doing audit and reporting work on a property you own, where you can sign in as Owner in Search Console and Administrator in GA4.

One caveat before you open the dialog. Search Console has no Viewer level (Restricted user is its view-only tier), and a few tasks, such as linking GA4 to Search Console, stay with you whatever level the agency holds.

What An SEO Agency Needs Access To, And What It Does Not

Agencies commonly need Google Analytics and Search Console access for audit and reporting work. That is the whole list for most engagements. Search Console shows how the site performs in search and which pages Google can crawl and index. GA4 shows what visitors do once they arrive. Between them they cover the audit, the monthly report and most of the questions a founder or marketing lead will ask.

The principle is simple. Grant the lowest level that still lets the agency do the named task, and say out loud who keeps ownership. You keep Owner in Search Console and Administrator in GA4. The agency gets a working level on top of that, and you raise it only when a specific task needs it.

Two practical points shape everything below. Access in Search Console is added by a Google account email, not by an email group, so the agency needs to give you the address of a real Google account. And the access you grant is separate from any tool connections. Third-party SEO tools, Google Tag Manager and Google Ads have their own permissions and sit outside this guide. If you want to compare the tools an agency might bring, see the SEO tools stack we use.

You can also see the kind of technical issues an agency will raise before you grant anything. Running Semrush's Site Audit on your domain gives you a first look at crawl and on-page problems from the outside, so you walk into the onboarding call with your own list.

Access terms also belong in the pre-contract checks. If you have not signed yet, read how to evaluate an SEO agency before signing and ask what access the agency will request on day one. An agency that asks for Owner and Administrator at the start has told you something.

Once access is in place, the data turns into the content audit reports from GA4 and Search Console most agencies lead with.

The Permission Decision Rule: What To Grant Per Task

The default is Restricted user in Search Console and Viewer in GA4. There are two upgrade triggers. Move the agency to Full user in Search Console when it must request indexing or manage sitemaps, and move it to Analyst in GA4 when Viewer's limit on its own explorations gets in the way. Editor is for the stretch when the agency is configuring measurement, and you take it back afterwards.

This is TRM's recommended rule, not a Google requirement. Other practitioner guides default to Full user and Analyst. We start lower because raising a level later is easy, while explaining unneeded access is not.

Read the table as a default and a set of named exceptions. The exceptions are the rows where the agency cannot do the job at the default level. If a row does not apply to the work you hired for, leave the agency where it is.

The reasoning behind the first row matters. Audit and reporting work is read-heavy, and read-only data is what quick-win analysis runs on, so the agency can pick the page to push first without being able to change a setting. If you are buying audit work specifically, our content refresh and audit services are built around that viewer-level starting point.

Google Search Console Permission Levels Explained

Google's help page on Search Console permissions defines four levels. Here is what each means when the person holding it works for an agency.

• Owner: Full control of the property, including adding and removing users. This stays with you.
• Full user: Can view all data, but cannot add or remove owners or users. This is the upgrade for an agency that must request indexing or manage sitemaps.
• Restricted user: Has mainly view-only rights. A Restricted user cannot use Disavow, Sitemaps or Verify fixes, and cannot request indexing. This is the default for audit and reporting.
• Associate: Cannot open or view the account directly. It is not a level an agency works from.

There is no Viewer level in Search Console. The word shows up in guides because GA4 has one, and people carry it across. When a card, a contract or an onboarding form says "viewer-only" for Search Console, it means Restricted user.

The gap that matters most for an agency is the one between Restricted and Full. A Restricted user can look at everything the audit needs, but cannot ask Google to index a fixed page. That single limit is why Full user is the first named exception.

If you are still comparing agencies, the guide on choosing an AI-ready SEO agency covers what to look for before anyone gets a seat.

How To Add A User To Google Search Console

You must be an owner of the property, or an owner of a parent property, to add users. Nobody else can do it, whatever level they hold.

1. Open the Search Console property you want to share.
2. Go to Settings, then Users and permissions.
3. Select Add user.
4. Enter the agency's Google account email address.
5. Choose the permission level. Use Restricted user unless one of the upgrade triggers applies.
6. Confirm to add the user.

Access is added by a Google account email, not by a group, so a shared mailbox alias that is not a Google account will not work. Ask the agency which account it signs in with before you type anything.

Add the user at the property you actually want shared. If you manage several properties, repeat the steps for each one, and note which level you gave on each.

Google Analytics 4 Access Levels Explained

GA4 uses a ladder of five roles, from top to bottom Administrator, Editor, Marketer, Analyst and Viewer, and each role includes the access of the one below it, as Google's GA4 role table shows. The ladder is why the choice is easier than it looks. You are picking a rung, and everything beneath it comes with it.

• Viewer: The bottom rung and the default for an agency. A Viewer can change report view options and edit only its own explorations.
• Analyst: One rung above Viewer. TRM's rule moves an agency here when the own-explorations limit gets in the way of analysis.
• Marketer: Sits between Analyst and Editor. Most agencies never need it, so check the live role table in your property before granting it.
• Editor: Has full property settings but cannot manage users. Grant it only while the agency is configuring measurement.
• Administrator: Can manage users and grant roles. This stays with you.

The line that matters most for security is the one between Editor and Administrator. Editor can change how the property collects data, but only Administrator can add or remove people. Keep Administrator and you keep control of who is in the account.

In September 2024, GA4 roles were renamed from the Universal Analytics set. Read and Analyze became Viewer, Collaborate became Analyst, Edit became Editor and Manage Users became Administrator, and Marketer was added. If an older guide or an old contract uses the earlier names, translate them with that list.

Two more points before you decide. Blitzmetrics notes that data restrictions such as No Cost Metrics and No Revenue Metrics can be added to any GA4 role, so a reporting seat can be narrowed further if finance data is sensitive. And access for Firebase-linked properties set before 4 January 2023 may differ from the published role table, so check Google's role table against your account.

The role table changes, and your property is the authority. Read the live table in your own account before you grant anything, and use this section as the map rather than the source of truth. When the agency's work is reporting, the real-time visibility dashboards it builds need only Viewer or Analyst to read the data.

How To Add A User To Google Analytics 4

You need the Administrator role on the account or property to add a user. An Editor cannot do it.

1. Sign in to Google Analytics and open Admin.
2. Choose whether to share at the account level or the property level. Property level is the narrower choice and usually the right one.
3. Open the access management area for that level. Check the label in your account, since the menu wording can differ.
4. Choose to add a user and enter the agency's Google account email address.
5. Pick the role. Use Viewer unless an upgrade trigger applies.
6. If your account offers a choice to notify the new user by email, decide whether you want that, then confirm.

If the account holds properties the agency has no reason to see, share at the property level instead.

Tasks That Stay With The Client As Owner Or Administrator

The rule is short. If a task changes who has access or changes how Google treats the whole site, the client does it. Practitioner guidance puts these three owner-only tasks with the client.

• Linking GA4 to Search Console: This connects two properties you own, and the link survives the agency. Doing it yourself means the connection never depends on a contractor's account.
• Change of address: This tells Google the site has moved to a new domain. A wrong submission affects the whole site, so the person accountable for the domain submits it.
• Disavow uploads: A disavow file tells Google to ignore links, and a bad file can strip value you wanted. Let the agency recommend the file and have your owner upload it.

Keep the agency on a shared agency login, one identity rather than a login per person, so you can revoke access in one move. That is a practitioner recommendation. It also makes the offboarding step at the end of this guide a single removal rather than a hunt. The trade-off is that you lose the record of which person did what, so decide which matters more to you before you ask for it.

The agency will often recommend technical fixes that go beyond read access. When that happens, treat the recommendation as a work request and decide the level then. Our technical SEO and AI readiness work covers the fixes that tend to need more than Viewer.

This is also a good question to put in an RFP. A B2B SaaS SEO agency scorecard is the place to ask what access the agency will request, and to compare how each bidder answers.

Verified Owner Vs Delegated Owner, And User Limits

A Search Console property can have a maximum of 100 non-owner users, and up to 500 verified and delegated owners in total, according to Google's help page. For a single agency engagement you will not get near either figure. The limits matter if you share one property with several agencies, freelancers and in-house staff over the years.

Verified and delegated owners both count toward the 500-owner limit. An owner can add and remove users, so an owner is never a casual grant. If an agency ever ends up as an owner, treat that as a change to review rather than a convenience, and remove it at offboarding.

Count the owners on each property once a year. A long-running property tends to collect owners from past agencies, and each one is a person who can still add users.

The Viewer-Only Onboarding Checklist

The goal is a working agency on the lowest levels, with a record of what you granted and when. Work through these in order.

1. Confirm you are Owner in Search Console and Administrator in GA4 before you add anyone.
2. Ask the agency for the Google account email it will use, and check it is an individual or shared agency account, not a group.
3. Add that account as Restricted user in Search Console.
4. Add the same account as Viewer in GA4, at property level where possible.
5. Ask the agency to open both tools and confirm the level took effect.
6. Record the date, the account and the person who granted it.
7. Write down the exceptions, meaning which task would justify Full user, Analyst or Editor, and who approves the change.
8. Set a review date to decide whether the levels still fit the work.

Do the review, and put the date in a calendar.

When the checklist is done, the natural next question is how long SEO takes to work, since access is the starting line rather than the result.

How To Remove Agency Access At Offboarding

Only an owner can remove a user in Search Console, and you need Administrator to remove a user in GA4. Do both, then check for leftovers.

1. In Search Console, open Users and permissions for the verified property.
2. Open the menu beside the agency's user, select the revoke option (Remove access) and confirm.
3. In GA4, open the access management area, find the agency's user and remove it. Check the label in your account.
4. If the agency verified ownership of the property itself, remove that ownership as well.
5. Check for leftover verification tokens and delete any the agency added. A removed verified owner may keep access through leftover verification tokens.
6. Ask the agency to hand over its reports and any files you need.
7. Record the date and who did the removal.

The token check is the step people skip, and it is the one that leaves a back door open. Removing a user does not always remove the way they proved they own the site.

For the hand-over, ask for reports that show what search visibility is for your site over time, so the next team starts with a baseline.