A Google Analytics property access review checklist should identify who can see or change data, where each permission comes from, and whether the business can recover administration after staff or agency changes. Review inherited access and linked-account groups as carefully as direct users.
Map the Analytics hierarchy
List the organization, Analytics account, properties, data streams, and important linked products. Record the business owner and at least two durable administrators. Identify agencies, contractors, former staff, shared addresses, user groups, and Google Ads linked users.
Google Analytics permissions can be assigned at the account or property level. Account-level roles flow to properties, and a user's effective access is the most permissive role available for that resource (Google Analytics Help). A property list alone can therefore miss inherited access.
Export and classify access
From Account Access Management and Property Access Management, record each user or group, direct role, inherited role, data restriction, owner, and business need. Mark accounts that no longer belong to the organization or cannot be tied to an active contract.
Classify the required capability: view reports, build explorations, manage marketing assets, edit property settings, or administer users. Google documents roles including Viewer, Analyst, Marketer, Editor, and Administrator, plus restrictions for cost and revenue data (Google Analytics Help). Choose the least-powerful role that supports the actual task.
Review inherited and linked access
Check whether a user receives permissions from the account, property, organization, or group. Reducing a direct property role may not reduce effective access when a broader parent role remains. Review Google Ads linked users because changing the role for a linked-user group can affect everyone represented by that group.
Confirm who controls each user group and how membership changes are approved. A clean Analytics screen is not enough if an outside directory group can quietly restore access.
Make controlled changes
Preserve recovery before removing anyone. Confirm a second active administrator, verify their sign-in, and record the account and property identifiers. Google notes that the last Administrator cannot remove their own access, which is a useful safeguard but not a substitute for a second owner (Google Analytics Help).
Remove stale users, reduce excessive roles, and apply cost or revenue restrictions when reporting access does not require financial metrics. Change one group at a time and verify the resulting effective permissions. Do not delete a user merely because the email is unfamiliar; identify the linked service or agency first.
Test the resulting roles
Use controlled test accounts or ask role owners to verify what they can view and edit. Confirm that report viewers cannot change property settings, editors cannot manage users, intended marketers can manage the required assets, and administrators can reach access management.
Review change history after the edits and save an approval record with the reviewer, date, removed access, retained exceptions, and next review date. Recheck after staff departures, agency transitions, mergers, or major property changes.
Protect continuity
Store the property identifiers, ownership contacts, tag locations, linked-product inventory, and emergency access route in the approved operations system. Avoid relying on a single personal Google account. Keep recovery methods and organization-domain ownership current without sharing passwords.
Quick completion test
The review is complete when every user and group has a named business purpose, inherited permissions are understood, stale access is removed, roles and financial-data restrictions match the task, two administrators can sign in, and the next review is scheduled.
Sources
- Access and data-restriction management — Google Analytics Help
- Add, edit, and delete Analytics users and user groups — Google Analytics Help