In a recent update Google Analytics has made user access management more granular and flexible than it had been before. In this article, we’ll look at how you can wrap your head around the new user permissions options and offer suggestions on how to make them work for you.

Gone are the old and generic ‘Administrator’ and ‘User’ roles that could only be applied at certain levels. Previously, Administrator permissions could only be bestowed at the ‘web property’ level, while User permissions were granted on a profile-by-profile basis. Furthermore, the ability to manage user access and the authority to grant or revoke administrative permissions was wrapped up with the ability to create profiles and manage goals or filters. If you wanted individual Google Analytics users under your account to be able to set up new profiles, goals, or filters, you would also have to entrust them with the ability to delete the whole account – a sticky situation any way you look at it.

In the new account management scheme, there are three different types of permissions that can be given to users: Manage Users, Edit, and View. These permissions can be applied at any level: account-wide, a single web property, or just a single profile.

For instance, if you wanted to give a new employee a sandbox where they can figure out how to use Google Analytics (yes, even goals, filters, and user management features), you could create a profile, then give them all three types of permissions at the profile level only. This way, they have full access to do whatever they want with that profile, but no access to the rest of the Google Analytics account.

In another case, you might have a human resources or information technology czar in your organization who demands the ability to regulate all user access to all accounts, but has no interest in (or clue about) Google Analytics or the data that’s in the account. To satisfy their no doubt very useful need to secure all the doors and windows, you can give them the Manage Users permission for the entire account, and leave it at that. That way, they can’t muck about with profiles, web properties, and all that other crazy stuff, but they can control what really matters to them: which brains can see and manipulate which sets of data.

One drawback I’ve seen in the new permissions setup is that it’s somewhat difficult to know which level you’re giving up permissions to. Here’s a bit of an explanation.

Log into Google Analytics as usual, click ‘Admin’, then click on whichever GA account you want to manage. When you arrive at the web property list for that account, you’re at the Account level. Any changes to user permissions you make in the User tab are applied at the Account level. This means that a user given Edit access will be able to edit all of the web properties and profiles beneath (or are ‘children’ of) the account you’re editing the settings for.

If you select a Web Property from the Account list, you will have descended to the Web Property level. Any changes to user permissions you make in the User tab here are applied at the Web Property level. A user given Edit access will be able to edit this web property and the profiles under each, but will not be able to edit neighbouring Web Properties or the Google Analytics Account as a whole.

Finally, if you choose an individual Profile from the Web Property list, you will find yourself at the lowest level at which Google Analytics accounts are divided – the Profile level. Any user permissions changes here apply only to the individual Profile you are currently in. A user given Edit access at this level will only be able to edit this specific profile, but not neighboring profiles.

To navigate between the levels, it’s much easier to use the breadcrumb navigation shown here:

To change user settings for an individual existing user on your chosen account level, select the ‘Users’ tab and click on the dropdown menu next to the e-mail address of the user you want to change permissions for.

Then, select the drop-down menu under ‘Profile Permissions’, and select or deselect the checkboxes corresponding to the permissions you want or don’t want that user to have.

You can also set permissions when adding a new user to your Google Analytics account – make sure you’re on the right ‘level’ (Account, Web Property, or Profile) before you start adding a user. Note: a good practice is to also make sure that the user you’re adding is notified by e-mail that they’ve been given access by checking the box ‘Notify this user by email’.

While a number of further user experience and interface design tweaks can and should still be made, the increased granularity in user management functionality is certainly a welcome development for Google Analytics users concerned with account governance issues.