Roles, Permissions & Agency Access
This is how you let a team or agency work on your ads without ever handing over your password — and without risking losing control of your own assets. Set it up correctly once and offboarding anyone is a two-click job.
Give people the least access they need using full control or partial access, and bring agencies in as Partners with asset-level access only. Portfolio permissions take priority, so an agency can run your ad account without owning your portfolio.
01Two levels of access
Meta keeps it simple. Every person gets one of two levels — and this applies both to the portfolio as a whole and to each individual asset (Page, Instagram, ad account):
| Level | Formerly called | What they can do |
|---|---|---|
| Full control | Admin | Everything: settings, people, assets, billing — and can delete the portfolio. |
| Partial access | Employee / Basic | Work only on the specific assets and tasks you assign. The safe default. |
On top of these, you can add a few extras when needed:
- Finance access — view or manage billing, invoices, spend and payment methods.
- Apps & integrations (formerly “developer”) — set up the Conversions API and access tokens.
- Temporary access — basic access that auto-expires between 3 and 75 days. Perfect for a short project.
Portfolio permissions take priority. Someone can have full control of a single asset without any control of the portfolio. That's exactly how you give an agency power to run your ad account while they still can't add people, change settings, or touch anything else.
02Three ways to grant access
- People — individuals (employees, freelancers) added by email. Their personal Facebook account gets the access; no password sharing.
- Partners — another business, like an agency. You grant (or they request) access to specific assets using a business ID. Crucially, they never own your assets — your portfolio does. They manage their own team on their side.
- System Users — non-human accounts for tools, apps and API integrations.
03The safe way to onboard an agency
- Keep your assets in your portfolio (you set this up in Lesson 2.1).
- Add the agency as a Partner and grant access only to the specific assets they need — usually the ad account and Page.
- Give finance access only if they're managing your billing.
- When the engagement ends, remove the partner — instantly cutting all their access while everything stays yours.
Give the minimum access someone needs to do their job, keep full-control users to a trusted few, and review the People and Partners lists every few months. Remove anyone who no longer needs access.
Never share your personal Facebook login, and never give an agency full control of your portfolio. Asset-level partner access is all they need. Handing over the portfolio is how businesses get locked out of their own ad accounts and Pixels.
- Two levels: full control (admin) and partial access (employee) — plus finance, integration and temporary add-ons.
- Portfolio permissions take priority over asset permissions.
- Grant access via People, Partners or System Users — agencies come in as Partners.
- Give agencies asset-level access only; never the portfolio, never your password.
Frequently asked questions
How do I give an agency access to my Meta ad account?
Keep your assets in your own portfolio, add the agency as a Partner, and grant access only to the specific assets they need. Remove them instantly when the work ends.
What is the difference between full control and partial access?
Full control (formerly admin) can manage everything including settings and people. Partial access (formerly employee) can only work on the specific assets and tasks you assign.
Should I share my Facebook password with an agency?
Never. Add people and partners through your portfolio so access is granted to their own accounts. Sharing a password is a security and ownership risk.
Return to the Meta Ads course hub for the full curriculum.