Which role to ask for, by task
One row per job. Ask for the role in the second column and nothing broader: the smallest role that does the job is easier for the client to approve, easier to audit, and simpler to remove when the work ends.
| Task | Ask for | Access type |
|---|---|---|
| Publish container changes | Publish (container permission) | User access |
| Install tracking tags | Edit (container permission) | User access |
What the client needs before starting
Only someone with these rights can add the agency. If your contact doesn't have them, ask who does first.
- Google Tag ManagerAdministrator on the Tag Manager account.
- Google Tag ManagerAdministrator on the Tag Manager account that owns the container.
Step-by-step pages for Google Tag Manager
Publish container changes
- What Google Tag Manager access do I need to publish changes live?→ Publish (container permission) · Publish on the one container; still User, not Administrator, at account level.
Install tracking tags
- What Google Tag Manager access do I need to install tracking tags?→ Edit (container permission) · Edit on the one container, User (not Administrator) at account level.
What the client clicks
The top-level clicks in Google Tag Manager. Each task page above has the exact role to pick at the last step.
- Open Tag Manager → Admin → User Management.
- Add or select the agency's email.
- Set container permission to Publish on the right container.
- Save.
What breaks if the role is wrong
- Too low · Publish container changesEdit or Approve: your workspace changes sit unpublished.
- Gotcha · Publish container changesPublish permission on GTM can also be used to verify Search Console ownership; agree on that when offboarding.
- Too low · Install tracking tagsRead: you can browse tags, triggers and variables but can't make changes.
- Gotcha · Install tracking tagsEdit can't create versions or publish. Approve can create versions but not publish. If you need to ship changes yourself, ask for Publish.
- Too high · Install tracking tagsAdministrator at account level can create containers and change user permissions. Agencies don't need it.
Copy this access request
One message for every Google Tag Manager role above. Fill in the blanks and paste it into your email to the client. Nothing you type leaves this page.
Sources
- https://support.google.com/tagmanager/answer/6107011 · checked Oct 14, 2026
- https://support.google.com/webmasters/answer/7687615 · checked Oct 13, 2026
Last updated
Skip the back-and-forth: send your client one AuthHub link.
One branded link walks each client through official invites on 23 products. $29/$49/$89 for 3/8/Unlimited new connections a month.
Related
How to give agency access to Google
Every Google product, one page.
How to give agency access to Google Ads
Ask forRead-only / Standard / Manager account link (accepted by a client Admin)
How to give agency access to Google Analytics
Ask forMarketer / Viewer
How to give agency access to Google Merchant Center
Ask forStandard / Admin (Merchant Center) — or have the client do the link
How to give agency access to Google Search Console
Ask forFull user / Restricted user
How to give agency access to Google Business Profile
Ask forManager
All platform access guides
The long-form walkthrough, beyond the role table.
Not sure? Use the access level picker
Answer two questions and get the level to request.