Your agency should run your ad accounts. It should never own them. Those are two different things, and most B2B teams only find out which one they have on the day someone leaves.
Paid media account ownership is a custody question rather than a marketing question. The company paying for the ads should hold the Admin seat on every ad account, tag container and analytics property, and everyone else, including the agency, should get the narrowest access that still lets them do the work. This guide is written for B2B marketing leaders at mid-market companies who inherited an account setup they did not build and have never actually looked at.
Key takeaways
→ If an agency created your Google Ads account inside its manager account, that manager is the owner of it by default, and Google's documentation says so plainly.
→ Ownership is recoverable by unlinking, but only if your own company already has a user with administrative access on the account.
→ The Admin seat should sit with someone who is not running the channel day to day, because that person churns fastest.
→ A handover is not a login transfer. The things that break are conversion actions, audience lists, product links and dashboard connectors, in that rough order.
What you actually own, and what you only borrow
You own the money and the data. You may not own the container the data sits in, and that distinction is where the damage happens.
Google's manager account documentation is direct about the mechanics. It states that "if a manager creates a new account, the manager will automatically become the owner of that account," and that a client account can only have one owner (Manager Accounts (MCC): About ownership of client accounts). Ownership is also transitive, so every manager account sitting above your agency's manager account inherits it too. If your agency opened the account for you on day one as a favor, this is almost certainly your situation.
What an owner manager can do is not trivial. The same page lists the powers of admin users on an owner manager account, which include inviting and removing users on your account, granting or revoking administrative access, accepting and declining link requests from other managers, transferring ownership to a different manager account, turning on remarketing list sharing so your lists can be shared with other accounts in that manager, and adjusting security settings on your account.
The honest counterweight is that this is not a hostage situation. Google is explicit that owner managers "do not take data ownership or administrative rights away from client accounts," and that the client account "still owns its data and has the ability to remove ownership access by unlinking."
That escape hatch has one condition attached, and it is the whole reason to read your user list this week. Google notes that turning off ownership requires the client account to have at least one user with administrative access. If the only Admin on your account is an email address at your agency's domain, you do not have the seat you need to use the escape hatch cleanly.
Ready for paid ads that pay off?
Book your free auditThe Admin seat belongs to someone who is not running the channel
Here is the part most teams get backwards. The Admin seat usually gets handed to whoever runs paid media, because that person is the one in the account every day. That is the wrong person, and the reason is turnover.
The people closest to the channel are the ones who move on soonest. A demand gen manager changes jobs, a marketing ops contractor finishes a project, an agency rotates its account manager on a cycle. Every one of those transitions quietly takes a permission with it if the permission was attached to a role rather than to the company.
Custody and operation are separate jobs. Put the Admin seat with someone whose tenure is measured in years rather than quarters, usually a head of marketing, a finance lead or an operations owner, and have at least two of them. Then let the operator, in-house or agency, work at the access level that matches the work.
The platforms themselves say this in their own documentation. Google Ads warns that "if your account has only one administrator, you may lose access to your tags if that user becomes unavailable," and recommends adding at least one more (About access levels in your Google Ads account). Google Tag Manager goes further, warning that a sole administrator changing roles can lock you out of your own account and telling you to "ensure that there are at least two active administrator accounts" (Managing users and permissions).
The Tag Manager page then says something I am going to quote even though I run an agency, because it is correct. It tells you to "make sure your account is managed by someone in your organization, not an external agency." Google is telling you not to let a company like mine hold your container, and there is no good argument against it. We can have publish rights inside your container. We should not be the account it belongs to.
What Admin actually unlocks, and why Standard is enough for your agency
The access-level table in the Google Ads documentation makes the split cleaner than most agency onboarding conversations do.
What Standard access already covers → editing campaigns, viewing and running campaign performance reports, viewing billing information, using planning tools, and creating conversions from Google Analytics events. That is essentially the entire job of running the account.
What only Admin can do → add or remove product links, link the account to Google Analytics to import conversions, give account access and change access levels for other users, accept and reject manager account link requests, unlink manager accounts, start and complete Advertiser Verification, and review each user's authentication method and last login time.
Read that second list again and notice what it is. Every item is a decision about who else gets in and what your account is connected to. None of them is an optimization. Standard is an operating level and Admin is a custody level, and your agency needs the first one.
This does cost you something, and I would rather say so than pretend it is free. During onboarding your agency will hit two or three things it cannot finish alone, usually the analytics link and a product link, and it will need an Admin at your company to click approve. That is a handful of requests in the first month and almost none after that. It is a small price for being able to remove a vendor in an afternoon.
The same logic carries to the other platforms even though the vocabulary changes. LinkedIn manages access per ad account inside Campaign Manager, with separate user roles governing who can view, edit and create, and a distinct billing admin role (User roles and permissions in Campaign Manager). Whatever the labels are on a given platform, the question you are asking is the same one. Who can add and remove people, and does that person work for you?
Run the access audit this quarter
This takes an afternoon and it is the highest-value hour of paid media admin work most B2B teams will do all year.
1. List every paid channel with money moving through it. Include the search engine everyone forgets, the review site placement someone bought two years ago, the retargeting line, and anything still charging a card.
2. Open the user list on each platform and read every email address out loud. Former employees and former vendors come off the same day you find them. This is the step that finds the surprises.
3. Count your admins. You want at least two, both at your own company domain, and neither of them should be a shared inbox nobody monitors.
4. Check the manager links. In Google Ads, look at which manager accounts are linked and which one, if any, holds ownership. If it is your agency, that is a conversation to have while the relationship is good rather than while it is ending.
5. Separate the tag container from the ad account. Tag Manager grants view or administer rights at the account level and read, edit, approve or publish rights at the container level, so your agency can have publish rights on one container without administering the account.
6. Find the billing trail. Whose card is on file, whose payments profile is attached, and who gets the receipt. Billing access is its own level in Google Ads for a reason.
7. Write one page and keep it. Channel, account ID, internal owner, admins, vendor access level, billing contact. If it is not written down it will be rediscovered in a panic.
Do this before you need it. An access audit run during an agency transition is a negotiation. The same audit run on a quiet Tuesday is just housekeeping.
The channel nobody owns
The audit usually turns up at least one line of spend with no named internal owner. It is often a legacy display or programmatic line, sometimes a review site placement, sometimes a retargeting pixel still firing into a platform nobody logs into.
A channel with no owner is not a strategy decision. It is budget nobody has to defend, which is a different and worse thing, because it never comes up in the meeting where budgets get argued over.
The test is one sentence. Name the person who would have to stand up next month and report what that channel produced. If you cannot name them, the channel either gets a real owner this week or it gets switched off, and switching it off is the more common right answer. Deciding which channels deserve funding in the first place is a separate exercise, and we walk through it in B2B paid channel selection.
What a handover actually has to transfer
The reason agency transitions go badly is that both sides treat them as a login transfer. Logins are the easy part. The order below is roughly the order in which things break.
Your own Admin seat, first. Before you announce anything to anyone, make sure two people at your company hold Admin on every platform. Everything else in this list depends on it.
Conversion actions and the tag container. Find out whether your conversion tags live in a container your agency owns. If they do, they move before the relationship does. A conversion action that stops firing is the failure that takes weeks to notice, which is why monitoring conversion tracking belongs in place before a transition rather than after it.
Audience and remarketing lists. Lists take months to rebuild and there is no shortcut. Note that an owner manager can turn on list sharing across the accounts in its manager, so confirm where your lists actually live and who else can reach them.
Product and analytics links. These are Admin-only actions on both ends. If the outgoing party holds the only Admin seat, relinking becomes a support ticket instead of a click.
Dashboard and reporting connections. When a dashboard connector loses its authorization, the channel usually disappears from the readout rather than showing an error, and the team quietly stops discussing a channel that is still spending. Check every data source against the platform after any access change.
Written account context. What was tested, what failed, and why a campaign is paused. Vendors rotate account managers on a cycle and every rotation resets institutional memory, so anything that is not written inside the account or in a shared doc is gone.
Billing. Last, not first, and only once everything above is done, because pulling the card early can pause campaigns you meant to keep running.
If you are at the point of weighing this seriously, the decision itself deserves its own look, and we covered the signals in when to switch PPC agencies. The related question of whether the next owner should be a hire or a vendor is covered in in-house versus agency PPC. Getting the access right is what makes either choice reversible.
When none of this is worth your afternoon
Some companies genuinely do not need this. If you opened your own Google Ads account, you hold Admin, you run one channel and one person has done it since the beginning, your custody is already clean and an audit will tell you nothing you do not know.
The moment it starts to matter is the second platform, the first vendor, or the first time someone with account access leaves the company. Any one of those three is the trigger.
Start with the user list
Open your Google Ads account, go to Admin and then Access and security, and read the user list. Count how many people have Admin, check which of them still work for you, and look at the Managers tab to see who holds ownership. Do the same in Tag Manager and in each ad platform. Most teams find at least one name they were not expecting, and fixing it takes about ten minutes once you have seen it.
When we take over a B2B Google Ads account, the access map is the first thing we build, before any structural or bidding work, because you cannot fix what you cannot reach. Our pricing page lists exactly which channels each engagement covers, and that written channel list is the same discipline applied to scope. Ambiguity about who owns a channel and ambiguity about who is paid to run it cause the same problem.
