If you're running a website, tracking your traffic and conversions is crucial. This proves the value to the organization of your website. So adding users to Google Analytics is essential for being data driven as a organization.
Google Analytics is a free tool that lets you as many users as you want to it. Therre is no cost for additional users or “seats” as some other Analytics packages do.
Insights:
- There are 5 different roles a GA4 User can have
- Pick the role with enough function for your team
- Marketer is the new role for those who are handling site marketing
- You can restrict the sharing of revenue and cost data with any user
- Don't use gmail.com emails (you don't really know who has access), instead setup work domain Google Accounts
Actions:
- Have at least 2 admins on the account
- At least 1 admin should be a role account (e.g. analytics@organizationdomain.com)
- Set up or move marketing team users to the new Marketer role
Adding A User To The Google Analytics 4
There are two versions of Google Analytics currently available:
- Google Universal Analytics (GUA) – the old version, which will be shut down on July 1st, 2024
- Google Analytics 4 – the new one replacing Universal Analytics
This post looks at Google Analytics 4 as they have updated things since Universal Analytics.
This article will show you how to add user to Google Analytics 4. But also how to share google analytics access safely based on the controls for sharing commercial sensitive data.
Let's get started!
Update: New GA4 User Type Available
Google has added a new user type to GA4 which is called Marketer, this has added permissions compared to Analyst and should be your default for all marketers using GA4.
Don't Share Access To Your Google Analytics Account Using Your Account!
Here is a classic example I hear frequently.
Your agency wants access to your Google Analytics, and they've just said:
“give us your login, and we'll keep it safe. We have all our client's logins”.
“Stop! Don't share your Google Analytics account details.”
There are many reasons not to share your Google (Analytics) account details with other people and companies.
Here are a few of them:
- You don't know who'll have access to it at the agency.
- You can't protect it without changing your account password.
- If you change your account password, everyone in your company who has that account must be updated.
- Suppose the agency changes anything that later becomes a problem. In that case, your account name will show up in the Google Analytics Change History as the account name.
So what to do instead?
How To Grant Access To Google Analytics 4 Properly.
This is easy to do and should be standard for all Admins when giving Google Analytics 4 access.
- Get the Google Account Email Address the user wants to access with
- Open the Google Analytics > Admin > Property > User Management
- Click the Blue “+” sign button in the top righthand corner.
- Select “Add new users”
- Add the Google Account email.
- Set permission levels (see below)
- Click “Add”, and you are done.
How To Add A User To Google Analytics
You need to follow a few steps to add a user to Google Analytics.
Steps are; get the Google account email address of the user you want to add
- Open the Google Analytics admin page and go to the “User Management” section
- Click on the “+” sign and select “Add new users.”
- Add the email address and set the permission levels.
- Finally, click “Add”, and the user will be added to your google analytics account.
Who Can Add Someone To Google Analytics?
This is straightforward as long as your Google Account in Google Analytics 4 is an Administrator role.
First, you need to get the Google account email address of the person who needs access.
Then, open your Google Analytics account and go to Admin. In the admin panel, select the Property to which you want to add a user. Once in Property, click on User Management under PROPERTY SETTINGS. Next, click on the Blue “+” sign in the top right corner and select “Add new users.”
In the “New Users” box that appears, enter the email address of the person you want to add. Then select a user permission level from the drop-down menu. The permission levels are described in more detail below. Once you've selected a permission level, click “Add.” The user will now have access to your Google Analytics 4.
GA4 All Users Have Access To All Data
In Google Analytics 4 you no longer have a view level, instead everything is shared at the Google Analytics Property level.
This means every user you add to GA4 has access to all the data within. You can control some financial data like advertising Cost Metrics and Revenue Metrics but everything else is shared.
If this doesn't work for your Users, then a review of your GA4 Properties setup maybe needed, which we cover in details in our GA4 for Admins training course.
How Do You Control User Access in GA4?
This video from Google Analytics walks you through the concepts and explains some options.
What Are The GA4 User Permissions You Can Give?
It's a little complicated how Google Analytics handles users' permissions but to explain, there are two types:
- Effective permissions The permissions and roles that a member is assigned via other resources. This could be a company, a group of users, or an account that includes the current Property. All direct permissions explicitly granted for the current resource are taken into Account. Think of this as “inheriting” permissions based on broader permission.
- Direct permissions are also referred to as Direct roles and data restrictions. When permission is granted, the assigned role and data restrictions are explicitly defined for the current resource (e.g., organization, Account, or Property). This is what you give individual users.
There are now a variety of permission levels summarized below:
| Name | Functions | Additional Functions | Replaces |
|---|---|---|---|
| Administrator | Add & Delete usersAssign any role Assign data restriction | All functions of lower roles | Manage Users permission |
| Editor | Edit all data and settings for the Account. | All functions of lower roles | Edit |
| Marketer | Create and edit:AudiencesEventsConversionsAttribution ModelsLookback Windows | All functions of lower roles | New role |
| Analyst | Can create Explorations and share with other users | All functions of lower roles | Collaborate |
| Viewer | See report data and configuration settings for Account.Can change standard reports using filters and comparisonsCan add secondary dimensionsCan create Explore reports for themselves | Lowest level user | Read & Analyze |
Standard Permission Roles
Administrator – only fully trained, responsible, and experience Users
Complete control of the Account. This Role can do everything possible in the Account, from managing users
- Add & Delete users
- assign any role
- Assign data restriction
Can give full permissions to any user, including their own at the Account, property level.
Includes permissions of the Editor role.
Replaces Manage Users permission.
Editor – these should be GA4 trained users should be at this level.
Edit all data and settings for the Account. Cannot manage users.
This Role allows full control of settings at the property level. However, this Role cannot manage users.
Includes permissions of the Analyst role.
New name for Edit permission.
New Role Alert: Marketer – this should be the default role for digital marketers
This role allows the user to create, edit, and delete:
- Audiences – which they will use for remarketing and creating specific reports on target audiences groups
- Events – able to set up new events based on current events
- Conversions – able to mark up events as conversions to use for campaign targeting
- Attribution-models – allow the Advertising reports to be updated for another type of attribution model (data-driven etc.)
- Lookback windows – Controls how far back for Acquisition conversion events (7 or 30 days) and other conversion events (30, 60 or 90 days)
This does include all the permission for the Analyst role as shown below.
Analyst – this is the role for reporting only
Create and edit shared assets like dashboards and annotations for Account. Includes the Viewer role. This is interesting as GA4 doesn't currently have dashboards (it uses Explorations and Alerts instead) and doesn't allow annotations. Maybe these features are coming over from Universal Analytics, but we will have to see.
- Can create, edit, and delete certain property assets.
- Can't add new Events or mark up Conversion Events
- Can create Explorations and share these with other Property Users
Includes permissions of the Viewer role.
This is the new name for Collaborate permission.
Property assets include things like GA4 Explorations.
Viewer – for Upper Management Users, so they can't break anything!
See report data and configuration settings for Account.
- Can see settings and data.
- They can change which data appears in standard reports.
- add filter
- add comparisons
- add a secondary dimension
- Create new Explore reports for themselves
- Can see shared assets via the user interface or the APIs.
Cannot share assets. For example, can't share their explorations but can view other Property Explorations.
This is the new name for Read & Analyze permission.
None
No role assigned. This is a weird one – why set up a user with no role? The user has no role in this resource. The user may have a role for another resource.
Google Analytics 4 User Cost and Revenue Restrictions
GA4, unlike Google Universal Analytics, actually allows you to control commercially sensitive data (money-related) data, so, for instance, an agency can see conversion but not how much revenue is generated.
No Cost Metrics
No access to cost-related metrics for the Account. (GA4 only).
Cannot see metrics related to cost.
Cost metrics are unavailable in reports, explorations, audiences, insights, and alerts. See below for more information.
No Revenue Metrics
No access to revenue-related metrics. (GA4 only).
Cannot see metrics related to revenue.
Revenue metrics are unavailable in reports, explorations, audiences, insights, and alerts. See below for more information.
Parent roles are inherited by default (e.g., account > property).
For example, when you give a user a role at the account level, that user then has the same Role for all the properties in that Account.
A user's effective permissions equate to the most-permissive Role for that resource.
For example, if a user has the Editor role for the Account, then that user has the Editor role for all of the properties in that Account, regardless of whether the user is also assigned a less-permissive role for one of the properties.
In addition, if a user is assigned a more-permissive role for a property than the user has at the account level, then that more-permissive Role applies to that Property.
You can add data restrictions as direct permissions, but you cannot remove them if they're in effect as inherited permissions. For example, suppose a user is assigned No Cost Metrics at the account level. In that case, that user cannot see cost metrics for any property in the Account. You could, however, add the No Revenue Metrics restriction for one or more of the properties in the Account.
You have a couple of options to see which users have which roles. From the User Management page at the Account or property level:
- Search for a specific user name to see that user's roles.
- Click the Account Roles column head to sort the list by roles.
Data restrictions and their impact on other Analytics features
Reports
Restricted metric values and values derived from restricted metrics do not appear in reports. Users see 0 instead.
Restricted metrics are available in metric pickers associated with reports (e.g., when customizing a report). Users subject to data restrictions can add those metrics but cannot view the results (e.g., can add the metrics to custom reports but cannot see the metric values in those reports).
Explorations
Restricted metrics do not appear in explorations.
Restricted metrics are available in metric pickers associated with explorations (e.g., when creating an exploration). Users subject to data restrictions can add those metrics but cannot view the results (e.g., can add the metrics to explorations but cannot see the metric values in those explorations).
Audiences
Restricted metrics are available in metric pickers associated with audiences. Users subject to data restrictions can create audiences based on restricted metrics and edit audience names after creation, but those users are subject to the limitations listed below.
- Cannot use an audience (e.g., as a dimension filter) that includes restricted metrics.
- Cannot see audience count for audiences that include restricted metrics.
- Cannot add audience triggers to audiences based on restricted metrics.
- Automated insightsCannot see automated insights based on restricted metrics in the user interface.
Custom insights
- Users with permission can create and edit custom insights based on restricted metrics.
- Cannot see custom insights in the user interface and cannot receive them via email.
Custom metrics
Users with permission can create custom metrics and indicate that those metrics include cost or revenue data. Users with corresponding data restrictions are not able to remove indications that custom metrics include cost or revenue data. In addition, access to those custom metrics is subject to all the limitations listed in this article.
Finally, click the “Notify new users by email” of their new Google Analytics User account.
This is an optional step but strongly recommended, so the new user is actually notified.
The email will come from Google and look something like this:
Hello [First Name],
You've been added as a user to the [Account Name] Account in Google Analytics. As a user, you can now view reports and configure settings for the Account.
Best,
The Google Analytics Team
That's it! A user has been added to your Google Analytics account. This process can be repeated for as many users as you need.
How to change the email on a Google Analytics account
You might be a little confused as you aren't “adding an email” to Google Analytics but adding an email associated with a Google Account. So you can't update the email on a Google Analytics account directly as it's held in the Google Account.
But there are two ways to make this email change depending on the situation:
- Add the new email address associated with the new Google Account as a new User (as described above) and delete the older user with their old email address
- Suppose you change the email address of your Google Account. In that case, Analytics displays the new email address associated with your Google account. This means if you update the Google Account, then the Google Analytics account updates from that data source.
How to check which Users have access to your Google Analytics
This is a simple but important review to do at least every year.
The number of times I have shown clients who have access to Google Analytics, and they say:
- “Oh, they left years ago.”
- “We stopped working with that agency last year.”
- “I don't know who that account is!”
To do this, you need to click on Account> Account Access Management
Here will be the list of all users at every level of access (GA4 = Account > Property / GUA Account > Property > View).
Look down the list and remove or downgrade permissions on anyone who isn't currently an active user.
How to download a list of Google Analytics Users
This is how you can get a list of all current users in a Google Analytics account.
This can be useful if you want to do an audit or review who has access.
To do this, go to:
- Admin > Account User Management.
- At the top right, click on the three dots and select Download Data.
- You will then see this pop-up. From here, you can select what data to download.
- Click on Run Report, and your CSV file will be downloaded.
The report includes the following columns:
- NAME – The name of the user. This field is only populated if you have added first and last name information to the user profile.
- IS A GROUP – Are they assigned to a Account Group
- USER EMAIL ADDRESS – The email address of the user.
- IS SECONDARY EMAIL – if the email shown is a secondary email on Google Account
- IS A ORGANIZATION ADMINISTRATOR – Shows if the User is an Admin of the Organisation
- ROLES AND DATA RESTRICTIONS – The permissions that the user has been granted.
To Delete or change Permissions of a Google Analytics User.
Delete User
- Click on the “User”
- Click on the three dots in the top right-hand corner of their details pane.
- Click “Remove User”
To downgrade a user's permissions:
- Click on the user you want to downgrade
- In their detail pane, click on the level of access they currently have (for example, Editor or Analyst)
- Select the level of access you want to give them from the drop-down menu (for example, Read & Analyze)
- Click Save.
That's it! You have now successfully removed a user or changed their permissions in your Google Analytics account.
Google Analytics Change History – track what users are doing in GA4.
Another great feature that was introduced in GUA and available in GA4 is the Change History.
This allows you to track any changes made to your Google Analytics account, including who made the change, when it was made, and what was changed.
To access this feature, go to:
- Account > Account Change History
You will then see a list of all changes made and the date, time, and user who made the change.
You can also use the date, location (all properties in an Account), and search function to filter by specific criteria.
This is a great way to keep track of any changes made to your Account and ensure that only authorized users are making changes.
Google Analytics 4 User Checklist
- Don't give other users your Google Account details
- Give the lowest user permissions to do their job
- Actively manage who has access
- Review your users with access regularly (at least every 12 months)
- Check the “Change History” to see what users are doing
