Article -> Article Details

A Google Ads Manager (MCC) is usually discussed in terms of convenience. One login. Centralized reporting. Easier client management. All true.

But there’s another side to consolidating access under one roof. When everything lives inside a single manager account, that account becomes the most valuable—and most vulnerable—target in the operation.

Lose access to the manager account, and suddenly every linked account becomes unreachable. A disgruntled former employee with lingering permissions can cause damage across dozens of accounts in minutes. A hacked login doesn’t just compromise one ad account; it compromises everything tied to it.

Security isn’t the glamorous part of Google Ads campaign management, but ignoring it turns a useful tool into a single point of failure.

The Access Problem Most Operations Ignore

When an agency or freelancer starts out, access management is simple. One person, one login, a handful of accounts. Permissions are rarely thought about.

As accounts multiply, the approach usually stays the same: share passwords, give direct logins to team members, and hope nothing goes wrong. This works until it doesn’t.

A Google Ads Manager Account offers a way out of that chaos, but only if used deliberately. The common mistake is adding people at the manager level with broad permissions and never revisiting those settings. Months later, former contractors, former employees, and people who switched roles still have access to everything.

A clean approach: treat the manager account like a security system, not just a convenience tool.

Building a Permission Structure That Doesn’t Leak

The first step is separating roles clearly. Not everyone needs admin access. Not everyone needs access to every account.

Inside the manager account, users can be added with different permission levels at both the manager level and the individual account level. The cleanest structure:

• Manager‑level admins: One or two people who can add new accounts, manage users, and change billing settings. This should be a small group.

• Manager‑level standard access: Users who can manage campaigns across accounts but cannot add new users or change account ownership. Most account managers fall here.

• Account‑specific access: Users who only need access to a subset of accounts can be added at the manager level but restricted to specific accounts using account‑level permissions.

The key is using the manager account as the single entry point for everyone. No direct logins to individual accounts. No shared passwords.

The Personal Email Trap

One of the most common security failures happens during initial setup. Someone creates the manager account using their personal Gmail address—name@gmail.com—because it’s quick and convenient.

Later, that person leaves the business. The manager account stays tied to their personal email. They may still have access, or the account may become inaccessible if they delete their personal email account.

The fix is simple but often overlooked: create the manager account using a business‑controlled email, such as ads@company.com or mcc@agency.com. This account belongs to the business, not any individual. Access can be managed through that email, and multiple people can be added as users.

If the original manager account was created with a personal email, it’s not too late. A new manager account can be created with a business email, and all linked accounts can be transferred. It takes a bit of time but eliminates a major long‑term risk.

Two‑Factor Authentication: Non‑Negotiable

Google offers two‑step verification. For a Google Ads Manager, it should be mandatory for everyone with access.

The reason: a compromised password is a disaster when it controls dozens of ad accounts. Two‑factor authentication adds a layer that makes unauthorized access significantly harder.

For manager‑level admins, using hardware keys (like Titan or YubiKey) provides the strongest protection. For other users, authenticator apps are a solid minimum.

Skipping this step because it’s inconvenient is a gamble that eventually costs more than the few seconds it takes to set up.

The Termination Process That Prevents Disaster

When someone leaves the team—whether amicably or not—their access should be removed immediately. With a manager account, this is straightforward: remove the user from the manager account, and they lose access to every linked account in one action.

The problem is that many operations don’t have a clear process. They rely on memory or assume someone else will handle it. The result is former employees or contractors retaining access for months or years.

A simple protocol eliminates this risk:

• Maintain a list of everyone with manager account access.

• When someone departs, remove their access the same day—before the exit interview, ideally.

• Revoke any API tokens or developer access associated with that user.

• Change the password for the business‑controlled manager account email if that user had access to it.

This sounds basic, but in practice, it’s frequently mishandled.

Client Access and Ownership Confusion

A Google Ads Manager is designed so that clients retain ownership of their individual accounts. They can revoke the manager’s access at any time. That’s the correct model.

But sometimes, well‑intentioned agencies create accounts under their own manager account and never transfer ownership. The client doesn’t have direct access. If the relationship ends, the agency controls the account entirely.

This creates a messy situation and can lead to disputes. It also violates Google’s policies in some cases.

Best practice: always create client accounts within the client’s own Google Ads login, then link them to the manager account. If creating a new account, use the manager account to create it, but ensure the client is added as an admin with ownership rights afterward. The client should always have the ability to unlink the manager account if needed.

The Risk of Shared Negative Keyword Lists and Audiences

The manager account’s shared library is a powerful feature. It allows sharing negative keyword lists, remarketing audiences, and conversion actions across multiple accounts.

But it also introduces risk. If a shared negative keyword list is updated incorrectly—blocking a term that drives conversions—it affects every account using that list. Similarly, if a shared audience list is compromised or misconfigured, it impacts campaign targeting across the board.

Best practice: limit manager‑level shared assets to those that truly need to be global. Use account‑level lists for client‑specific or campaign‑specific items. Document which accounts use which shared lists so troubleshooting is possible when something goes wrong.

Monitoring for Unauthorized Changes

Google Ads provides change history logs, but monitoring them across dozens of accounts is impractical manually.

Setting up automated alerts at the manager level catches unauthorized or accidental changes. For example, an automated rule can send an email whenever a new user is added to any account, or whenever a campaign budget exceeds a threshold.

These alerts don’t prevent problems, but they allow problems to be caught quickly—sometimes within minutes of an unauthorized change.

When to Consider a Second Manager Account

For larger operations, putting everything under one manager account creates concentration risk. If that account gets suspended—whether due to a policy violation or an administrative issue—every linked account can be affected.

A common mitigation strategy: maintain separate manager accounts for different purposes. One manager account for high‑spend, long‑term clients. Another for testing accounts or smaller clients. Another for internal business accounts.

This compartmentalization limits the blast radius of any single issue. It also makes access management easier for teams that only need access to specific segments of the client base.

The Real Cost of Neglecting Security

Security in ad account management rarely gets attention until something goes wrong. Then the cost becomes obvious.

A hacked manager account can lead to:

• Unauthorized campaigns running on stolen credit cards

• Malicious changes that damage client accounts

• Loss of client trust when accounts become inaccessible

• Time spent recovering access instead of managing campaigns

These outcomes are avoidable. The effort required to implement basic security practices—business email for the manager account, two‑factor authentication, clean permission structure, termination protocol—is minimal compared to the cost of a breach.

A Practical Security Audit

For anyone currently running a Google Ads Manager Account, a quick audit answers key questions:

• Who currently has access to the manager account? Does everyone listed still need it?

• Is the manager account tied to a personal email or a business email?

• Is two‑factor authentication enabled for everyone with manager access?

• Are there former employees or contractors still listed?

• Do clients have independent access to their own accounts?

• Are there automated alerts set up for critical changes?

• Is there a clear process for revoking access when someone leaves?

Running through these questions takes an hour. Addressing the gaps takes a bit longer. But the result is a structure that can scale without accumulating hidden risk.

Moving Forward

A Google Ads Manager is one of the most valuable tools for anyone managing multiple accounts. But its value depends on using it securely. The convenience of centralization shouldn’t come at the cost of exposing everything to a single point of failure.

The time spent locking down access, setting up proper permissions, and establishing clean processes pays back every time a team member changes, a client requests access, or an attempted unauthorized access is blocked before it causes damage.

For those currently relying on shared passwords and individual logins, moving to a manager account with strong security controls isn’t just an efficiency upgrade. It’s a risk reduction that protects every account underneath it.