For example, in a large organization with hundreds of Analytics accounts, an Org admin might have a compelling interest in only a few of those accounts. Google Marketing Platform uses this approach in order to initially limit the number of Analytics accounts that are visible to Org admins and User admins so that the only accounts visible are the ones in which they have a compelling interest. If you have only inherited permissions for an Analytics account, you do not have access to that account from Google Marketing Platform or from the universal picker in Analytics. To see this information for a user, click Administration > Organizations > organization > Users > user name > Analytics > Analytics account permissions (last column). Note that even though the switch for the permission is turned off, there is still a checkmark present to indicate that the user has the permission. When you link an Analytics account to an organization, Org admins and User admins in that organization inherit the Manage Users permission for that Analytics account. Inherited permissions are Analytics permissions that are inherited by organization users, for example, when an Analytics account is linked to an organization.ĭirect permissions are Analytics permissions that are explicitly granted via the controls in Administration.

To ensure that someone always has access to the organization, when you create an organization, designate at least two users, preferably three, as Org admins. For example, if you lose access to an Analytics 360 account because the only administrator left the company, then an Org admin can designate other users as Analytics 360 administrators. Those permissions for the Org admin role remain intact as long as the product account is linked to the organization.Ī primary benefit of the Org admin role is to be able to recover lost access to a product account. For example, when you link Google Analytics 360, then Org admins automatically have the Manage Users permission in Analytics. When you link a product account to an organization, all Org admins are given the permissions described above for the product account. As an Org admin, they will be able to grant permissions to themselves and others for the organization and for all of the product accounts linked to the organization. Your primary consideration in choosing Org admins is how much you trust those people. When you link an Optimize account to an organization, Org admins don't inherit specific permissions, but they can:įor convenience, you should have at least two Org admins, but not many more.

Remove users from the account and its containers.View users in the account and its containers.When you link a Tag Manager account to an organization, Org admins don't inherit specific permissions, but they can: When you link an Analytics account to an organization, Org admins inherit Manage Users permission for that account, and for all properties and views in the account. Permissions inherited for linked analytics products You can see changes for the last two years. Having a record of these changes eliminates confusion over something like an increase in billing-instead of wondering, you can search your change history to see that one of your administrators changed the service level for a property from standard to 360, or made changes to the billing parameters. Change History lets you keep track of:įor example, you can easily see when someone linked a new account to your organization, added or removed users, changed the service level for an object, or changed the end date on an order. Org admins can also view the Change History for an organization. Accessing data via an API call, for example, in a Chrome extension or in the Analytics mobile app.The last date on which the user interacted with Google Analytics report data.The Analytics accounts, properties, and views, the Google Tag Manager containers, and the Optimize containers to which the user has access.Org admins can see which users have access to a product account, along with details about those users.

Change the service level from standard to 360 for objects in product accounts.

Link and unlink product accounts (linking requires that you are also an administrative user on the product account for example, in Analytics you have the Manage Users and Edit permissions).

Manage users: add, edit, remove, assign roles (including designating other Org admins).

The user who creates the organization has the role of Org admin.Īn Org admin has all administrative permissions for the organization (including all permissions listed below for User admin, Billing admin, and User):

Least permissions