Guide 141 · Setup · GA4 + Tag Manager

Add users to a GA4 property: five roles, two levels, and the lowest role that works

Checked 11 November 2026 · Verification: roles counted (5 standard roles plus None = 6 choices; 2 levels: account and property) · Steps traced to Analytics Help, read 11 November 2026 · 6-minute read

Adding a user is how a team shares GA4 without sharing a password. Users are added by their Google account email address, at the account level or the property level, with one of five roles. The most permissive role always wins, so a person with Editor at the account level is an Editor in every property, whatever the property-level setting says. This guide adds a user at the property level with the lowest role that does the job.

Expected signal

After step 4, the new user appears in Property access management with the role you picked, and they can sign in with their own Google account and see the property.

Download the reference: the GA4 user roles reference (JSON) (945 bytes, MD5 cea2f49cc41678eee88c56ab82e70a1d). The GA4 roles and levels, counted in Python: 5 standard roles plus None = 6 choices, and the role chain is 3 deep.

What you need

The Administrator role at the level you are managing. Only an Administrator can add, change, or remove users at that level.
The new user's Google account email address. Users are identified by their email addresses, and the address must be registered in a Google account. A non-Google email cannot be added.
The right role picked in advance. Decide before opening the panel: Viewer reads, Analyst builds and shares, Marketer runs audiences and key events, Editor configures, Administrator manages users.

The trace

Open Admin and pick the level. In Admin, decide the level first. Property access management adds the user to one property only. Account access management adds them to the account and every property inside it. For an agency reading one site's reports, the property level is the right one.
Start adding the user. In the access management panel, click the + button, then click Add users.
Enter the email address. Enter the email address for the user's Google account. Check the spelling before moving on — a mistyped address invites a stranger, and the invitation goes out as soon as you save.
Pick the role. There are 5 standard roles plus None, which removes all access: Administrator, Editor, Marketer, Analyst, Viewer, and None — 6 choices in the panel. Administrator has full control of the property, including adding and removing other users. Editor can edit all data and settings for the property but cannot manage users. Marketer can edit audiences, key events, attribution models, lookback windows, and events, and includes Analyst. Analyst can share created explorations with other users and includes Viewer. Viewer can see report data and configuration settings. The roles nest: 5 standard roles, and Marketer includes Analyst, which includes Viewer, so the chain is 3 deep.
Consider data restrictions. The panel also offers data restrictions, such as hiding cost metrics or revenue metrics from the user. Use them when the person needs the traffic numbers but not the money.
Send it and confirm. Choose whether to notify the new user by email, then click Add. Open the access list again and confirm the user is listed with the role you picked. The most permissive role always wins: if the same person already holds Editor at the account level, a Viewer role at the property level does not downgrade them.

Dead ends

DEAD END — SHARING THE OWNER'S LOGIN INSTEAD OF ADDING A USER. A shared login cannot be revoked without changing the password for everyone, and it gives every holder full control. Add the person with their own Google account email and the lowest role that works.

DEAD END — ADDING EVERYONE AT THE ACCOUNT LEVEL. Account-level access applies to every property in the account. A contractor hired for one site gets the whole account's data. Add users at the property level unless the work genuinely spans the account.

DEAD END — GIVING ADMINISTRATOR TO MAKE SOMETHING WORK. Administrator is full control, including removing other users. Nine times in ten the job is an Editor or Analyst task and the Administrator grant is the lazy fix. Pick the role that matches the work, not the role that ends the conversation.

End state

The new user is listed in Property access management with their own Google account email and the lowest role that lets them do the job. They sign in with their own account, see the property, and cannot touch anything their role does not allow.

Sources

Analytics Help — Google Analytics hierarchy — users are assigned at the organization, account, and property levels, with permissions at each level
Analytics Help — [GA4] Set up Analytics for a website and/or app — the Viewer role is enough to create an account; the Editor role adds properties — roles gate the work at each level

Checked 11 November 2026. The levels above are the ones in Google's hierarchy page, read 11 November 2026; the role descriptions match the access management panel as documented in Google's help pages. No step in this guide was run inside a live Analytics property, because that needs a Google sign-in and this site does not sign in as anyone. The reference file was checked in Python: its figures were recomputed from the documentation values and match the numbers on this page. Google moves menu items without warning; if a path on this page no longer matches, the linked help page is the current map.