SOP 116: Granting access to Google Tag Manager
Grant access to Google Tag Manager account to a new user so they can add a pixel or other code to your website.
Last Updated / Reviewed: 04/26/2025
Execution Time: 5 min to grant/revoke access
🚀 Goal: To grant access to your Google Tag Manager account to a new user (employee, contractor, agency).
🤞 Ideal Outcome: Your employee, contractor, or agency will have access to your Google Tag Manager account and be able to add a pixel or other code to your website.
🤔 Why this is important: So your employee, contractor or agency can independently implement tracking codes on your website.
🧐 Where this is done Google Tag Manager.
🗓️ When this is done: Every time you want to grant, request, or revoke access to your Google Tag Manager account.
👨 Who does this: The person with admin access your Google Tag Manager account.
__⚠️Prerequisites or requirements: __
You will need admin access to a Google Tag Manager Account. If you haven’t set up Google Tag Manager, refer to the following SOPs:
• SOP 004 (web version) to Set up Google Tag Manager on WordPress
• SOP 065 (web version) to Set up Google Tag Manager on Shopify
• SOP 066 (web version) to Set up Google Tag Manager on Squarespace
Click here to get the most up-to-date version of this SOP
User roles for Google Tag Manager:
There are 2 layers of access inside Google Tag Manager: Account and Container. To select which kind of access you want to grant:
Account-level
Important: It is recommended to have at least 2, but not much more than 2, account-level admins in your account at any moment. This is to avoid getting locked out of your account because the sole admin lost access to the account, or left the company.
Does that user need to manage other user’s access to that account, and do you absolutely trust that user?
Yes: Give that user “Admin” account-level access;
Important: Make sure you trust that user. A Google Tag Manager account does not have ‘ownership’. Admins can remove other admins, and you can get locked out of your Google Tag Manager account by a malicious user.
No: Give that user “User” account-level access;
Container-level
(Source: Google -https://support.google.com/tagmanager/answer/6107011?hl=en)
- No access: The user will not see the container listed in the account.
- Read: The user will see the container listed and may browse the tags, triggers, and variables in the container, but will not have the ability to make any changes.
- Edit: The user has the right to create workspaces and make edits but not create versions or publish.
- Approve: The user has the right to create versions, and workspaces, and make edits but not publish.
- Publish: The user has full rights to create versions, and workspaces, make edits, and publish.
Important: Make sure you only give “Publish” permission to users you trust, and that actually need to publish containers frequently. Remember, these users could potentially inject malicious code into your website or delete current containers.
Granting access to Google Tag Manager
01▸ Sign in to your Google Tag Manager account.
02▸ Click the three dots menu of the container (website) and select “User Management”.
03▸ Click “+” in the top right corner → “Add users”.
04▸ Enter the email address you want to grant access to (step 1) and check the type of access you want to grant the user (step 2), then click “Invite” (step 3).
Note: If you are not sure what type of access to grant, you can check that on the first chapter of this SOP under “Container-level User Roles”.
05▸ You have now granted access to your Google Tag Manager to the new user.
Remove access to Google Tag Manager
01▸ Sign in to your Google Tag Manager account.
02▸ Click the three dots menu (of the account you want to share access to) and select “User Management”.
03▸ To remove access, click on the three dots menu and select “Remove access”.
The user’s access will now be removed.