Skip to content

Guide 122 · Container · GA4 + Tag Manager

Manage Tag Manager users and permissions: two account levels, five container levels

Checked 11 November 2026 · Verification: container fragment validated structurally (16 checks, all passed) · Steps traced to Tag Manager Help, opened 11 November 2026 · 5-minute read

A container that one person controls is a container that locks everyone out when that person leaves. Google's user management page opens with that warning: if a team member who is the sole administrator of your Tag Manager account changes roles, you can get locked out of your account. The fix is deliberate access: two levels at the account, five at the container, granted per person. This guide adds a teammate at the container level with Edit access, and counts the levels on the way.

Expected signal

After step 3, the User Management list shows the teammate with Edit on this container and no access to the others, and the account still lists 2 administrators — never 1.

Download the container fragment: the user permissions fragment (JSON) (export format version 2, 1496 bytes, MD5 4ecd63a7293e3ffe6050314b159f2b47). It holds a reference record of the worked example's access table — 2 administrators, 1 Edit user, 1 Read user — plus the tags those users work on. The file is a hand-built import template, validated structurally — it was not exported from a live container.

What you need

  • Administrator access on the account. Only an administrator can add users and change permissions. A User-level account member can view the account but cannot grant access.
  • The teammate's Google account. Access is delegated only to Google accounts — Gmail, Google Workspace, or an account created at accounts.google.com. A non-Google email cannot be added.
  • The level the person needs, decided before you open the page. The worked example grants Edit: the teammate can create workspaces and make edits, but cannot create versions or publish.

The trace

  1. Click Admin and open User Management in the Container column. Admin has two User Management entries: one in the Account column, one in the Container column. The Account column sets who can view or administer the account; the Container column sets who can do what in this container. This guide uses the Container column, so the grant stays inside one container.
  2. Click the add button and enter the teammate's Google account. Type the Google account address. Tag Manager checks it is a Google account — a non-Google address is not accepted, because access is delegated only to Google accounts.
  3. Assign the container permission and save. The container levels are five: No access, Read, Edit, Approve and Publish. Read browses tags, triggers and variables but changes nothing. Edit creates workspaces and makes edits but cannot create versions or publish. Approve adds version creation. Publish adds publishing — full rights. The worked example assigns Edit. The account levels are two — User and Administrator — and the Administrator level can create new containers and modify user permissions for accounts and containers. A team of 4 in the worked example holds 2 administrators, 1 Edit user and 1 Read user: 2 + 1 + 1 = 4 people, with 2 administrators so the account is never one departure away from a lockout.

Dead ends

DEAD END — ONE ADMINISTRATOR FOR THE WHOLE ACCOUNT. A single administrator who leaves, loses access or changes roles takes the account's admin rights with them. Google's own warning is that you can get locked out. Keep two administrators at all times, even on a one-person account — the second can be a backup Google account you control.

DEAD END — PUBLISH ACCESS FOR A PERSON WHO ONLY EDITS. Publish access is the highest container level. Granting it to someone who only needs to edit means their typo can go live with one click and no second pair of eyes. Match the level to the job: Edit edits, Approve approves, Publish publishes.

DEAD END — ACCOUNT-LEVEL ACCESS WHEN CONTAINER-LEVEL WOULD DO. An Administrator at the account level can create containers and change permissions across the account. A teammate who works on one container needs container-level access to that container, not the keys to the whole account.

End state

One teammate on Edit for one container, no access to the others, and the account still holding 2 administrators. The permission ladder is now a deliberate choice per person, not a default everyone shares.

Sources

  • Tag Manager Help — Managing users and permissions — account levels User and Administrator, container levels No access, Read, Edit, Approve and Publish, access delegated only to Google accounts, the sole-administrator lockout warning, Admin then User Management in the Account and Container columns

Checked 11 November 2026. The click paths above are the ones in Google's help pages, opened 11 November 2026. No step in this guide was run inside a live Analytics property or a live Tag Manager container, because both need a Google sign-in and this site does not sign in as anyone. The container file was validated structurally instead: export format version 2, every tag's firing trigger resolves, every variable the tags reference exists in the file, and the tag types are the documented ones. Google moves menu items without warning; if a path on this page no longer matches, the linked help page is the current map. The container fragment for this guide is 1496 bytes (1.46 KB, 0.73% of the reported 200 KB container size limit), MD5 4ecd63a7293e3ffe6050314b159f2b47, and passed 16 structural checks.