Grant Google Tag Manager Access Safely (Workspaces, Roles, MFA)

Why GTM access needs care

GTM can inject scripts into your site. A rushed permission or a leaked login can break analytics—or worse, leak data. Good news: GTM already has the pieces you need to share access safely.

Principles to stick to

• Invite people, not passwords — never share a Google login.
• Least privilege — start with viewer or editor; reserve publish for a small group.
• Review & approve — use workspaces and approval flows before publishing.
• MFA — every Google account with GTM access should have 2-Step Verification.

Safe setup (10–15 minutes)

1. Verify the invite by phone or a known channel before clicking. Habit guide: Stop Phishing at the Source: Verify Links Like a Pro.
2. Add the user at the container level with the smallest role that works (Viewer → Editor → Approver → Admin).
3. Enable workspaces for changes and require approval before publish.
4. Document the handoff (what they can edit, who approves, when to publish).

Safer ways to share container exports

• Don’t email .json exports in attachments. If you must share, use a one-time, expiring link and send the access code by SMS/phone. Basics: The Safe Way to Share Passwords in 2025 (No Email).
• Disable link previews in chats to avoid auto-fetch: Prevent Accidental Link Previews.

Offboarding & audits

• Remove users when projects end, then rotate any related secrets (e.g., API keys referenced by tags). Playbook: Employee Offboarding.
• Quarterly permission review — viewer/editor/publish/admin lists drift over time.

Useful external references

• GTM Help: User management 🔗
• Google: Turn on 2-Step Verification 🔗
• GTM Help: Workspaces & approvals 🔗

Related reading

Client onboarding without shared logins: Secure Client Onboarding (Checklist)

When you must deliver a file or secret: Share Sensitive Photos & Documents Safely

Respond to suspicious changes: The Simple Incident Playbook for Leaked Passwords

Bottom line

Add users with roles, build in review, enforce MFA, and share exports ephemerally. That’s GTM access without the anxiety.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.