How-to · Updated October 11, 2026
Add or remove a user in Google Tag Manager
Updated October 11, 2026
10 minutes
Invite the person under Admin, User Management, with their account permission left at User and the lowest container permission that fits: Edit to build tags, Publish only if they should put changes live. Before removing anyone, keep two administrators from your own business, because an account or container with no administrator is deleted.
Before you start
- Administrator access to the Tag Manager account. Google says an Administrator is the role that can change user permissions for the account and its containers.
- The person's Google account email. Tag Manager only accepts Google accounts: a Gmail address, a Google Workspace address, or another address registered as a Google account.
- A decision on what they should do, look only, build tags, or build and publish them, and in which container.
Choose the permission before you invite
Tag Manager sets access at two levels, the account and each container, and the container level is where the day-to-day rights live.
- If you invite from the Account column, leave Account Permissions at User, which Tag Manager selects by default, for anyone outside your business. Google says Administrator lets a person create containers and change user permissions for the account and every container in it.
- Pick the container permission from Google's four levels: Read browses tags without changing anything, Edit creates workspaces and edits but cannot create versions or publish, Approve adds creating versions but still cannot publish, and Publish has full rights, publishing included.
- Give a developer or provider who builds tags for you Edit when someone on your side reviews and publishes, or Publish when the provider should finish the job. A person with Edit can save work that never reaches the site: changes stay in a workspace until someone with Publish publishes them.
Invite the person
Adding a user from the Container column gives them access to that one container at the permission you chose.
- In Tag Manager, click Admin.
- In the Container column, click User Management. To set access for several containers at once, use User Management in the Account column instead.
- Click the plus button, then select Add users.
- Enter the person's email address and set the container permission you chose.
- Click Invite. The person gets an email and an Invitations card on Tag Manager's Accounts screen, where they click Accept.
Remove someone or lower their access
Confirm two administrators from your own business remain before removing anyone, because an account whose only administrator loses their Google account is deleted, and Google support will not add users back.
- Click Admin, then User Management in the Account column, and confirm at least two Administrator users are people in your own business, not the person you are removing. Google recommends two active administrators and says ownership should not sit with an outside provider.
- If the person leaving is one of only two administrators, make someone else in your business an Administrator first.
- Select the person in the Account permissions list.
- Click Remove to take away their access to the current container, or lower their account or container permissions instead. If they have access to other containers in the account, check each container's User Management list as well.
- Click Save.
Tag Manager refuses to remove the last administrator, but if the only administrator's Google account is deleted elsewhere, the account is left with none. Google deletes an account or container with no administrator, and users with read access then have 30 days to export it from the trash.
Check it worked
Open Admin, then User Management in the Container column. The person should appear with the permission you set, possibly marked as invited until they accept. Until then, ask them to look for the Invitations card on the Accounts screen rather than the email.
After a removal, the person should no longer be listed for that container, and with no access Google says the container no longer appears in their list. For a provider with Publish, the Versions screen keeps a publish history showing when each version went live and who published it.
They still see the container after you removed them
Google says a permission can be inherited from a user group or organization role, as well as given directly. If removing the direct permission did not take their access away, look for a group or an organization role that still grants it, which applies to Tag Manager 360 accounts managed through Google Marketing Platform. There, anyone who is an Administrator on the account also inherits Read on every container, so lower their account permission as well.
Approve without an approval workflow
Request Approval, where an editor asks for approval before publishing and can name an approver, is available to containers owned by Tag Manager 360 accounts. In standard Tag Manager, Approve still lets a person create versions without publishing them, which is useful when one person prepares a version and another publishes it.