Guide 93 · Admin · GA4 + Tag Manager
Property user management in GA4: add a user at the right access level, and remove access cleanly
Access in GA4 is set at account or property level in Access management. Add a user with the lowest role that does the job, and remove access from the same screen.
After the trace, Access management lists the user with the role you chose, and the role matches the job: no Editor where an Analyst will do.
Download the reference: the property user management reference (JSON) (575 bytes, MD5 4a7c31cc032dd1791c94d9e2e28b93ab). It holds the worked example from this guide with every figure recomputed. The file was built for this guide and checked the same day; it was not exported from a live property.
What you need
- Administrator access at the level you are changing.
- The user's email address, copied exactly.
- The job the user needs to do, so the role follows from it.
The trace
- Open Admin, then under Account or Property click Access management. Account-level access covers every property in the account; property-level access covers one property. Pick the level the job needs, not the wider one.
- Click Add users and enter the email address. Copy it exactly. A mistyped address grants access to the wrong inbox, and the mistake is silent until that person signs in.
- Pick the role from the standard set. GA4 roles are Administrator, Editor, Marketer, Analyst and Viewer. That is 5 roles. Administrator can manage users; Editor can change settings; Marketer can create audiences; Analyst can read and build reports; Viewer can read.
- Match the role to the job. The worked example in the download assigns 5 people: 1 Administrator, 1 Editor, 1 Marketer, 1 Analyst and 1 Viewer. That is 5 people in 5 roles, and only 1 of 5, or 20.0%, can manage users.
- Click Add, then read the list back. Confirm the email and the role are as intended. A role read back wrong is fixed now, before the person starts work.
- Remove access from the same screen. Open the user's row, open the menu, and choose Remove access. Removing a user at property level leaves their account-level access untouched, and the reverse is also true.
Dead ends
DEAD END — EVERYONE AS ADMINISTRATOR. Administrator can change who has access. Handing it out by default means anyone can remove anyone, including you.
DEAD END — ADDING AT ACCOUNT LEVEL FOR ONE PROPERTY. Account-level access opens every property in the account. A contractor for one property needs property-level access only.
DEAD END — REMOVING THE WRONG LEVEL. Removing property access does not remove account access. Check both levels when a person leaves a project.
End state
Five people hold five roles, and only 1 of 5 can manage users. The list was read back after adding, and removal runs from the same screen at the same level.
Sources
- Analytics Help — Edit / delete accounts, properties, and data streams — Editor role needed to edit and delete at property level
- Analytics Help — Examples of audiences in Google Analytics and how to create them — Marketer access or above to open the audience builder
Checked 11 November 2026. The click paths above are the ones in Google's help and developer pages, opened 11 November 2026. No step in this guide was run inside a live Analytics property or a live Tag Manager container, because both need a Google sign-in and this site does not sign in as anyone. The figures on this page were recomputed in Python 3 and are shown in the downloadable file, which was checked the same day. Google moves menu items without warning; if a path on this page no longer matches, the linked help page is the current map.