The first week of an agency engagement is usually spent chasing ad account access. It is avoidable, and the way access is granted in that week decides how easily it can be withdrawn in a year. Both problems are solved by the same approach: grant access as your own organisation, at the right level, to named people.
The principle behind the agency onboarding checklist
Every asset should be owned by your business and shared with the agency, never the other way round. That means your Google Ads account, your Meta Business Manager, your analytics property, your tag container and your domain, with the agency added as a user or partner. If anything has to be created new, create it under your business and then grant access. Why this matters becomes obvious only on the day the relationship ends, which is too late to fix it.
Ad account access, platform by platform
- Google Ads. Admin access for the lead, standard for others, or link your account to their manager account. Linking is cleaner than individual invitations and easier to revoke.
- Meta. Add their business as a partner in Business Settings and assign the ad account, the page and the dataset. Do not add individuals to your business; partner-level assignment is revoked in one action.
- Other platforms. LinkedIn Campaign Manager, Microsoft Advertising, TikTok Ads Manager and any marketplace ad consoles follow the same pattern. Grant at account level, not by sharing a login.
Measurement
- GA4. Editor at property level. Administrator only if they are expected to configure conversions and audiences, which is usually the case in the first month.
- Google Tag Manager. Publish rights on the container. If you want change control, give them approve rights and keep publish with your developer.
- Search Console. Full user, not restricted, if any SEO or landing page work is in scope. What it is actually for is broader than most people use it for.
- Call tracking, CRM, server-side container. Read access at minimum. Without outcome data, the account optimises toward form fills rather than customers.
Commercial and content
- Website or CMS. Editor or staging access if landing pages are in scope, or a clear route to your developer with an agreed turnaround if they are not.
- Brand assets. Logos, fonts, product photography, existing video, approved claims. Missing assets delay creative more often than briefs do.
- Billing. Keep your own payment method on the platforms. Paying the platforms directly means you see the real media cost and keep the credit line.
What not to share, ever
Do not share passwords. Platform access is designed to be granted per person, and sharing a login defeats the audit trail, breaks two-factor authentication and makes removal impossible without a password reset that locks out your own team.
Do not give access to your domain registrar, your email, your payment processor or your customer database unless there is a specific documented reason. An agency running ads does not need any of them.
The test for every permission: if you revoked it tonight, would anything of yours break? If yes, the ownership is the wrong way round.
Keep a record
One document listing every system, who has access, at what level, and when it was granted. It takes ten minutes to maintain and saves a week at the other end. It is also the thing that makes an exit administrative rather than adversarial.
A note on timing
Access before the kick-off call, not after it. An agency that spends week one requesting logins is spending week one not working, and the first fortnight is when the tracking problems that shape everything else get found. We send the list before the first invoice for that reason — it is part of how onboarding runs and the first thing a free audit needs, in read-only form.
Read-only is worth noting separately. For an audit or a pitch, read access to the ad accounts and analytics is enough to produce a genuine diagnosis, and it carries almost no risk. There is no reason to grant edit rights to an agency you have not appointed.
Questions people ask before hiring
What ad account access does a PPC agency actually need?
Admin or standard access to the ad accounts, editor rights on analytics, publish or approve rights on the tag container, Search Console if SEO is in scope, and read access to whatever records outcomes. Nothing beyond that.
How should I grant agency access to my ad accounts?
Per person, through each platform’s own access settings, never by sharing a login. Granting access properly preserves the audit trail, keeps two-factor authentication working and lets you revoke it in one click. Shared logins do none of those.
Is read-only access enough for an audit?
Yes. A genuine diagnosis of an ad account needs visibility, not edit rights. There is no reason to grant write access to an agency you have not yet appointed.
Who should pay the ad platforms?
You should, with your own payment method on the account. It keeps the real media cost visible, preserves your credit line, and removes any ambiguity between what was spent and what was billed.
How long should agency onboarding take?
Access should be in place before the kick-off call. With the list prepared in advance it is usually an hour of administration; without it, it routinely takes the first week of a paid engagement.