How to Give Access to Google Tag Manager

You need to let a developer, an agency or a new team member into your Google Tag Manager setup, and you don’t want to hand over your Google password. Good news: you never have to. To give access to Google Tag Manager, an account Administrator opens Admin > User Management, adds the person’s Google account email, picks an account permission (Administrator or User) and a container permission (No access, Read, Edit, Approve or Publish), and sends the invite.

That takes about two minutes. The part people get wrong is the level of access. In this guide I explain every permission in plain words, show the exact clicks, and share the levels I use for agencies and freelancers.

How Access Works in Google Tag Manager

Google Tag Manager (GTM) has two layers, and each one has its own permissions.

• The account is the top level. It usually matches your company. One account can hold many containers.
• The container holds the tags, triggers and variables for one website or app. Its ID looks like GTM-XXXXXXX.

When you add a user, you set both: one permission for the account and one for each container in it. This is why someone can be “in” your GTM account but still see nothing useful. They have account access, but no access to the container they need.

One more thing to know early: GTM access is separate from your other Google tools. Giving someone Publish access in GTM does not let them see your GA4 reports. Each tool has its own user list.

There is one newer link between them. If you accept Google’s container upgrade (Google calls it “optimizing” the container), Tag Manager links the container to your Google Ads or GA4 accounts. Google says those linked accounts get Read access to the container by default. You can check these links under Admin > External Account Links.

GTM Account Permissions: Administrator vs User

There are only two account permissions.

• Administrator. Can create containers, change account settings and add, edit or remove users for the account and every container in it. Administrators also get Read access to every container automatically, and they can give themselves more. In practice, an Administrator controls who can do what.
• User. Can see basic account information. They get no container access on their own. What they can do inside each container depends on the container permission you give them.

My rule is simple. Administrator access is for people inside your business who own the setup. Everyone else, including agencies, gets User at the account level and the right container permission on top.

I also recommend at least two Administrators from your own team. This matters more than ever, because Google now automatically deletes an account or container that has no admin left (more on that in the problems section). Google’s help page makes the same point and advises against letting an outside agency manage the account. If your account has only one admin, Tag Manager now shows a Tag Diagnostics notification to warn you.

GTM Container Permissions Explained

Container permissions decide what a person can actually do with your tags. Each level includes everything from the level before it.

A few terms in that table need a quick explanation:

• A workspace is a private draft area. Changes made there don’t affect your live site.
• A version is a saved snapshot of the whole container at one point in time. You can go back to an older version if something breaks.
• Publish means making a version live. From that moment, the tags run for every visitor.

The jump from Approve to Publish is the big one. Publish access means a person can add any code to every page of your website. Treat it like giving someone the keys to your site’s front-end.

Direct vs Inherited Permissions

In Tag Manager 360 (the paid version, part of Google Marketing Platform), people can also get access through a user group or an organisation role. Google calls this an inherited permission. A permission you set on the person yourself is a direct permission.

The difference matters when you remove access. A direct permission stays even if the person leaves the group. So when I clean up a 360 account, I check both the groups and each person’s own permissions.

Before You Add a User

Check these three things first. They prevent most of the problems I see.

1. You must be an account Administrator. Users with only container permissions can’t add other people. If the User Management option is missing, ask an existing admin.
2. The person needs a Google account. GTM only accepts Google accounts. That can be a Gmail address, a Google Workspace address, or a work email that has been registered as a Google account at accounts.google.com.
3. Know which container they need. If you have several sites, write down the container name or GTM- ID so you don’t give access to the wrong one.

How to Give Access to Google Tag Manager, Step by Step

You can add users from the account level or from a single container. I prefer the account level, because you can set both permissions on one screen.

Add a User at the Account Level

1. Go to tagmanager.google.com and sign in with an Administrator account.
2. Open the right account and container, then click the Admin tab at the top.
3. In the Account column, click User Management.
4. Click the blue + button and choose Add users.
5. Enter the person’s email address. You can add more than one email if several people need the same access.
6. Under account permissions, leave User selected unless this person should manage users and settings. In that case, select Administrator instead.
7. Under container permissions, set the right level for each container. Anything you don’t change stays at No access.
8. Click Invite.

Add a User to One Container Only

1. Click Admin while inside the container you want to share.
2. In the Container column, click User Management.
3. Click +, then Add users.
4. Enter the email address and choose Read, Edit, Approve or Publish.
5. Click Invite.

The person gets an email about the new access. When they next open Tag Manager with that Google account, they see an Invitations card on the accounts screen. They click Accept (or Decline), and the account then appears in their list.

If you set up tracking with GTM in the first place, my Google Tag Manager for SEO setup guide covers the container install and the tags I find useful.

What Access to Give Agencies and Freelancers

This is where I see the most mistakes. People panic, grant Administrator plus Publish to everyone, and forget about it. Here is how I decide instead.

An Agency That Runs Your Tracking

Give User at the account level and Publish on the container they work on. They can build, test and publish tags without being able to add or remove other people.

Keep Administrator for your own staff. If the agency relationship ends, you stay in control and simply remove them.

A Freelancer or New Team Member

Start with Edit. They can do the work in a workspace, and someone with Publish access reviews and publishes it. Once you trust their work, move them up.

An SEO or Analytics Auditor

Read is enough. An auditor needs to see what fires and when, not change it. When I audit a site’s tracking, Read access is all I ask for, and I’d be wary of anyone who insists on more just to look.

A Developer Who Installs the Container

Often they need no GTM access at all. To add the container snippet to the site, they only need the code from Admin > Install Google Tag Manager, which you can copy and send. Give them Read if they need to check tags while debugging.

How Workspaces and Approvals Fit In

Permissions work closely with workspaces, so it helps to know how they connect.

In a standard (free) container you get the default workspace plus up to two more, so three at a time. In Tag Manager 360, the paid version, workspaces are unlimited. Each person or project can work in its own workspace without touching anyone else’s changes.

When one workspace is published, the others become out of date. GTM asks the people in those workspaces to update, and it flags a conflict if two people changed the same tag. If you have several editors, I suggest naming workspaces clearly, such as “Agency – form tracking”, so everyone knows whose draft is whose.

The Approval Flow in Practice

In a free container, the “approval” process is manual. An Edit user finishes their changes and tells a Publish user. The Publish user opens that workspace, checks it in Preview mode, and publishes it.

Tag Manager 360 adds a built-in approval queue. Editors can submit a workspace for review, and approvers can comment on it before it goes live. If you’re on the free version, a simple rule like “no one publishes their own work” gives you most of the same safety.

Google’s workspaces help page explains conflict resolution in detail if your team runs into it often.

How to Change or Remove a User’s Access

Review your user list regularly and remove anyone who no longer needs access. Here is how.

Change Someone’s Permissions

1. Go to Admin, then User Management in the Account column.
2. Click the person’s name. You can search or filter if the list is long.
3. Change the account permission, or click a container to change its permission.
4. Click Save.

Remove Someone Completely

1. Go to Admin > User Management in the Account column.
2. Tick the box next to the user, or open their details.
3. Choose Remove and confirm.

Removing a user at the account level takes them out of every container in that account. Removing them in a single container’s User Management only affects that container.

Before you remove an agency, check whether they have unpublished work in a workspace. Their drafts stay in the container, but nobody may know what they were for. I usually ask for a short handover note first.

Common Problems and How to Fix Them

“This Email Isn’t a Google Account”

GTM can’t add an email that has no Google account behind it. Ask the person to create one at accounts.google.com using their work email, without making a new Gmail address. Then add them again.

The Invite Didn’t Arrive

Ask them to check spam and any filters first. The email is only a notice, though. If they sign in to tagmanager.google.com with the exact address you invited, they should see the Invitations card there. Many people are signed in to a different Google account in the same browser, which is the cause I see most often.

They Can See the Account but Not the Container

Their container permission is still No access. Account access alone doesn’t open any containers. Open their user details and set a container permission.

They Can Make Changes but Can’t Publish

This is expected for Edit and Approve users. Only Publish users can push changes live. Either raise their level or have a Publish user review and publish their workspace.

You Can’t Find User Management

You’re not an account Administrator. Ask an existing admin to add you, or to make the change for you.

Nobody in the Business Is an Admin Any More

This happens when the only admin was an ex-employee or an old agency. Contact that person or agency first and ask them to make someone in your team an Administrator.

Tag Manager won’t let you remove the last admin. But it can’t stop the problem if the only admin’s Google account gets deleted somewhere else. Google says an account or container with no admin is automatically deleted. Anyone left with Read access then has 30 days to export the container from the Trash.

To recover, export the container, import it into a new account where your own staff are admins, and add at least two admins. If nobody has Read access, you’ll have to re-tag the site from scratch. That’s why I treat two in-house admins as a must, not a nice-to-have.

You Can’t Find Triggers or Variables

Google has redesigned the container screens. In the newer layout, Triggers, Variables, Templates and Folders sit inside a collapsible Advanced section. Nothing was removed. If you’re guiding someone new by phone or email, tell them to open Advanced first.

Security Tips for GTM Access

GTM can add any script to every page of your website. That makes its access list one of the most important ones you own.

• Never share passwords. Add each person with their own Google account. Shared logins make it impossible to know who changed what.
• Use the least access needed. Start low, and raise it only when the work needs it.
• Keep two in-house Administrators. Use named people, not one generic login.
• Review users every few months. I do it whenever an agency or staff member changes, and once a quarter anyway.
• Turn on publish notifications. Under Admin > Container Notifications, you can get an email when a version is published, so surprises don’t go unnoticed.
• Check the version history. Each version shows who created and published it, which makes it easy to spot unexpected changes.
• Review External Account Links after an upgrade. Anyone with Edit, Approve or Publish can start the container upgrade. I check Admin > External Account Links afterwards to see which Google accounts were linked.

You’ll probably need to share other tools with the same person. I cover those in my guides on giving access to Google Analytics 4 and adding a user to Google Search Console.

What Has Changed Recently

The way you invite people and the five container levels are the same. These are the changes I’d know about before you share access today.

• A simpler Overview page and an Advanced section (rolled out from July 2026). Triggers, Variables, Templates and Folders moved into a collapsible Advanced section. New users may think things are missing, so point them there.
• Container upgrade with automatic account links (live from October 2026). Google first announced it in 2026 as part of joining the Google tag and Tag Manager. A banner invites you to optimize the container. It adds a new Settings section and links the container to your Google Ads or GA4 accounts with Read access by default. Anyone with Edit, Approve or Publish can start it, so an Edit-level freelancer can create these links. Love’s Data reports that the links take effect as soon as the changes are added to the workspace, before anything is published.
• Clearer rules on admin-less accounts. Google’s user permissions page now says an account or container with no admin is deleted automatically, with a 30-day window to export it. It also shows a Tag Diagnostics warning when an account has only one admin. For you, that makes two in-house admins essential.

Google’s updates to Google tag and Google Tag Manager page has the official details of the upgrade.

Conclusion

To give access to Google Tag Manager safely, keep it simple: User at the account level for anyone outside your business, the lowest container permission that gets the job done, and at least two Administrators from your own team. Use Edit for people whose work you want to review, Read for audits, and keep Publish for people you trust with your live site.

Your next step: open Admin > User Management now, look at who already has access, and remove anyone who no longer needs it. Google’s user permissions help page has the full official definitions if you want to check a detail.