Key takeaways
- The business should control its Search Console, GA4 and Business Profile properties and their recovery details.
- Invite a specialist through the product's user permissions; grant only the access their task requires.
- At handover, review users, verification tokens, integrations and documentation before removing access.
When you hire an SEO specialist, keep the underlying Google properties under your business's control. The specialist may need data access or editing rights, but the business should be able to see performance and manage permissions after the contract ends. This avoids a handover that depends on a former provider's login.
The exact role names differ across Google products. The checklist below is a practical access policy for a business owner, based on each product's published permission controls. It is not a requirement to give one person the same role everywhere.
Table of contents
Search Console: keep a verified owner
Search Console has owner, full user and restricted user roles. A verified owner proves control of the property through a verification method; delegated owners receive owner access from another owner. Google's permissions guide explains what each role can do. A business-controlled account should remain a verified owner so you can manage users even after a consultant leaves.
For an initial audit, Google specifically advises giving the SEO read access rather than write access. A restricted user is often sufficient for viewing data, but check the specialist's specific tasks against the current permission table. Grant broader access only when needed and with a named owner approval. If a provider set up Search Console for you, ask which Google account verifies the property and whether verification depends on a file, DNS record or other token they control.
GA4: separate analysis from administration
Google Analytics 4 lets administrators add users at the account or property level and assign roles. Google's access management instructions describe the steps. If a specialist only needs to inspect organic traffic and conversions, give an analysis role appropriate to that work. Editing key events, links or settings requires a different role and an approved task.
First confirm which GA4 property actually receives traffic from your site and who has administrator rights. A new property quietly created inside a vendor's account can leave the business without practical control. Record the measurement ID, property name, key events and any Search Console link. Check that your contact or enquiry measurement works before using it to judge an SEO engagement.
Business Profile: use owners and managers deliberately
For local SEO, Google Business Profile distinguishes owners and managers. Owners can manage users; managers can edit much of the profile but cannot add or remove users. Google's role guide describes the permissions. Keep a trusted business representative as primary owner and invite the specialist as a manager for ordinary profile work unless a specific owner-only task requires more.
Google says each person should use their own Google Account to access a Business Profile rather than sharing a password. Review the actual profile, not just a screenshot of a dashboard: business name, address or service area, phone, site URL, hours and other active managers should be known to you. If the profile is owned by an old agency or former employee, resolve that before an urgent update is needed.
Access matrix for a typical engagement
| Product | Business control | Specialist access for common work |
|---|---|---|
| Search Console | Verified owner under business control | Restricted or full user as tasks require; start with read access for an audit |
| GA4 | Business administrator on the correct account and property | Analysis role for reporting; editing role only for approved setup work |
| Business Profile | Trusted business primary owner | Manager for ordinary local SEO edits |
Roles can change, and complex organizations may have their own policies. Review the current Google help pages before adding a user. “Give me your password” is not a substitute for a documented access request.
A simple offboarding and handover checklist
- Ask for a list of every property, Google account and third-party tool used for the project.
- Confirm a business-controlled owner or administrator can open each property and manage users.
- Export the work log: changed URLs, content, redirects, tracking events, Business Profile edits and pending recommendations.
- Review Search Console verification methods, Analytics integrations and Business Profile users before removing the provider.
- Remove access that is no longer needed, then test that reporting and contact tracking still work.
Do not delete a verification record or integration blindly; it may affect access or measurement. Make the handover an agreed deliverable in the proposal. A good specialist should be comfortable explaining exactly which access was used and why.
What to ask your SEO specialist
Ask: “Which property do you need, what role, for which task, and for how long?” Request the answer in writing alongside the first work plan. The provider should also explain how changes are approved and where the final report lives. This makes collaboration faster because nobody has to reconstruct permissions during a launch or staff change.
If you want a review of your current search setup and access, my SEO specialist service can start with an inventory and a scoped audit. The business retains control of its accounts.
Sources and further reading
Want help auditing your SEO setup while keeping your business in control of its accounts?
Get in touch