How to add a user to Google Search Console, and which role

To add a user to Google Search Console, an owner of the property opens Settings → Users and permissions, clicks “Add user”, enters the person’s Google Account email address and chooses a permission level: Owner, Full or Restricted. A full user can see all the data and take most actions; a restricted user can view most data and act on very little. For an agency, full access to the client’s Domain property covers nearly all day-to-day work, while the client keeps ownership.

What can owners, full users and restricted users do?

Google’s permissions table runs to more than twenty rows. These are the ones that decide what an agency or a colleague can actually get done:

Action	Owner	Full user	Restricted user
View all reports, including Performance	Yes	Yes	Yes
URL Inspection	Yes	Yes	Limited (fetch)
Submit sitemaps	Yes	Yes	No
Remove URLs (Removals tool)	Yes	Yes	View, no changes
Disavow links	Yes	Yes	No
Validate fixes in issue reports	Yes	Yes	No
Change of Address	Yes	View, no changes	View, no changes
Link a Google Analytics account	Yes	No	No
Add users and change permissions	Yes	No	No

Google describes a full user as having “view rights to all data” and the ability to “take some actions”, and a restricted user as having “simple view rights on most data”. Restricted users also receive messages from Search Console that specifically affect them, rather than everything.

There is a fourth relationship, the associate, which covers linked services rather than people browsing your reports. Google’s help notes that associates cannot open your Search Console account or view its data directly.

Verified owners and delegated owners

There are two kinds of owner, with the same powers. A verified owner proved ownership themselves, with a DNS record, an HTML file, a meta tag or another token. A delegated owner was made an owner by an existing owner, without a token of their own. In Users and permissions, a verified owner is labelled both “Owner” and “Verified”; a delegated owner is labelled “Owner”.

The difference matters when people leave. A property must have at least one verified owner. If every verified owner is removed, every other user, delegated owners included, loses access after a grace period. Data keeps being collected, but nobody can see it until someone verifies again.

How to add a user, step by step

1. Sign in to Search Console with an account that owns the property, and select the property.
2. Open Settings, then Users and permissions. The page is visible to owners alone, so if you cannot see it, you are not an owner.
3. Click “Add user”.
4. Enter the person’s Google Account email address. It has to be a valid Google Account; an email group will not work.
5. Choose Owner, Full or Restricted, then save.

Add people to the property that matches what they need. Adding someone to a Domain property (example.com) gives them every subdomain and protocol; adding them to a URL-prefix property (https://example.com/blog/) gives them that section and nothing else. If the difference is new to you, Domain vs URL-prefix properties explains it.

If Search Console refuses to add someone as a full or restricted user, they probably already own a property containing this one. Google treats that as implicit ownership, so they can be added as an owner and nothing lower.

How to change or remove access

In Users and permissions, open the menu next to the person. “Change permissions” switches them between levels; “Remove access” takes them off the property, and Google says the change takes effect quickly.

Verified owners are the exception. You cannot downgrade them, and removing them is not quite enough: their token may still be on the site, and if it is, they can regain access by verifying again. Remove the DNS record, file or tag they used. Google notifies all current owners if a removed owner re-verifies, so you will at least know.

A property can have up to 100 non-owners. Delegated owners can be added until verified and delegated owners together reach 500.

What an agency should ask a client for

An onboarding email that asks for “access to Search Console” gets whatever the client clicks first. Be specific instead:

• Full user, not owner. Full access covers reporting, URL Inspection, sitemaps, the Removals tool and validating fixes. Ask for owner when you genuinely need it: adding your own colleagues, linking Google Analytics or running a Change of Address during a migration.
• The Domain property, if one exists. It shows the whole site in one place. If the client has URL-prefix properties alone, ask for each one that carries traffic, both http and https and www and non-www where they exist.
• The exact Google Account to add. Tell the client which address to use, ideally an agency Google Account per person rather than a personal Gmail. Getting the address right up front saves a round of “it doesn’t show up for me”.
• A verified owner who stays. The client should keep at least one verified owner and leave the DNS record in place. If their one verified owner leaves the company and the record is removed, you lose access too, after the grace period.

When the engagement ends, ask the client to remove your access, and check that they did. Leaving old agency accounts on client properties is how strangers end up reading a business’s search data three years later.

How a newly shared property appears in third-party apps

Search Console access belongs to a Google account, not to an app. Every third-party Search Console app, ours included, asks the Search Console API for the list of properties that the signed-in Google account can see, along with its permission level for each. So once a client adds your address, the property turns up in any app signed in to that account the next time it refreshes its property list. Nothing needs to be shared with the app itself.

The same logic runs the other way. An app can never do more than your role allows: a restricted user’s app can read the Performance numbers but cannot submit a sitemap. When the client removes you in Search Console, the property disappears from every app on the next refresh. And if the client added a different address from the one you signed in with, the property will not appear until you sign in with that account too.

If you want to cut an app off without touching your Search Console access, remove it from your Google Account’s list of connected third-party apps.

Where QueryWatch fits

QueryWatch shows every property your Google account can see, whatever your permission on it, with real numbers on each and no site limit on the free tier. The permission level is shown on each property, so you know before promising a client something whether your role allows it. Client tags and colours are free, for grouping a portfolio by client; managing 20+ client properties shows how that works week to week. Pro adds multiple Google accounts, for clients who granted access to a different login. Users themselves are managed in Search Console, not in the app.

Your Google token stays on your phone unless you turn on push alerts; where does your Google token go explains what happens when you do. QueryWatch for agencies has the rest, and Google’s user and permissions help has the full permissions table. QueryWatch is an independent app and is not affiliated with Google.