GA4 property configuration checks

GA4 access levels explained

• Administrator: Full control over the property, including creating and deleting data streams, modifying all settings, managing user access, and linking or unlinking products. Reserve for 1 to 3 people maximum: the analytics lead and a backup. Do not grant Administrator at the Account level to anyone who only needs access to specific properties.
• Editor: Can modify all property settings and configurations: create data filters, change attribution settings, modify custom definitions, edit conversion definitions. This is the access level where configuration mistakes happen. Grant Editor only to those who specifically need to make configuration changes.
• Marketer: Can create audiences and modify some configurations. Cannot change property-level settings. Appropriate for campaign managers who need to build audiences for Google Ads but do not need to touch property configuration. Editor access also covers high-impact toggles likeGoogle Signalsand Reporting Identity, so it should be granted carefully.
• Analyst: Can create and view Explorations, custom reports, and dashboards. Cannot make any configuration changes. Appropriate for analysts, data scientists, and anyone who needs to work with the data without changing the setup.
• Viewer: Read-only access to standard reports. Cannot access Explorations. Appropriate for executives who check specific standard reports periodically.

Account-level vs property-level access

Access granted at the Account level applies to all properties within that account. Access granted at the Property level applies only to that specific property. Almost nobody should have account-level access unless they specifically need to manage multiple properties simultaneously.

A common access management mistake: granting account-level Admin to a developer who only needs to add the GA4 tag to one website. They now have full access to every property in the account. Always grant access at the lowest scope that meets the actual need. The same principle applies when reviewingdata stream configurationandenhanced measurement settings— narrow scope reduces the chance of accidental drift.

Systematic property configuration audit

A thorough configuration audit covers more than just user access. Work through each layer of the property systematically to catch settings that were correct at launch but have drifted over time.

Protecting against accidental configuration changes

Even with correct access levels, configuration changes happen. Protect against the most damaging ones:

• Change history monitoring: In Admin > Account Change History, you can see all configuration changes made to the property. Review this regularly to catch unintended changes.
• Data filter testing mode: Data Filters have a Testing state that allows you to see their effect without permanently excluding data. Use Testing mode before activating filters, and require senior review before any filter moves to Active.
• Key event changes: Marking or unmarking key events is an Editor-level action. Changes are not retroactive, unmarking a key event does not recover historical conversion data. Require documentation of why a key event is being changed before making the change.
• Retention drift: ConfirmGA4 data retentionis set to the maximum your plan allows; the default 2-month setting silently caps the historical window available in Explorations.