Audit agency and contractor access by matching every user, manager link, token and shared asset to a current task, contract owner and expiry decision.
Short answer: answer: Export every human, agency manager, service account, API token and connected app, then match each access path to a current task, named internal owner, valid contract and expiry date. Remove or reduce anything that cannot be justified, rotate shared secrets and verify revocation through the platform and a failed access test where safe. Audit manager links and tokens separately; deleting a visible user does not necessarily end access.
Most access reviews start with a list of names. Marketing systems also grant control through agency manager accounts, social-business partners, OAuth apps, API keys, automation users, shared inboxes and billing roles. A clean user list can coexist with an active forgotten token.
The second mistake is asking whether a contractor still “works with us.” A valid contract does not justify administrator rights to every property. CDM’s position is that access should follow a current task and its minimum permission, not historical trust or broad relationship status.
The Current-Task Access Audit
The Current-Task Access Audit runs Identity → Path → Task → Privilege → Time → Evidence. Each row represents one access path to one asset. If the team cannot complete Task, Owner and Expiry, the default decision is suspend pending validation.
NIST SP 800-53 provides a broad control catalog, including account management and least privilege; NIST SP 800-171 Revision 3 states requirements for covered CUI systems, such as authorizing intended use, monitoring accounts, disabling accounts under defined conditions and reviewing privileges. Those federal scopes do not automatically apply to an ordinary marketing team. CDM uses the underlying security principles as recommendations unless an organization has a binding requirement.
1. Inventory identities and paths
Export from every in-scope system:
- individual users and email domains;
- agency manager or partner links;
- roles inherited from organizations, groups or business portfolios;
- service accounts, API users and automation bots;
- OAuth applications, app passwords, API keys and refresh tokens;
- shared credentials, recovery addresses and phone numbers;
- billing, domain, tag, pixel, catalog and data-warehouse access.
Do not rely on a central identity provider alone. It may show employees but miss a partner granted directly inside an advertising or creator platform. Google Ads, for example, separates individual access and manager-account relationships; unlinking a manager is a distinct action.
2. Map every path to a current task
For each row, write the precise task: “edit paid-search campaigns for Brand A through 31 October,” not “agency support.” Add the internal sponsor, contract reference, deliverable, data accessed and system owner.
Ask whether the task still exists and whether this path is necessary. A reporting contractor may need read-only access, not campaign editing. A creative agency may need a file workspace but not customer-audience exports. If no internal owner accepts the row, it is orphaned.
3. Test least privilege
Compare current permission with the minimum role that can perform the task. Separate viewing, editing, publishing, user administration, billing and data export. Privileged roles deserve individual named accounts, stronger authentication and tighter review.
Google Ads documents access levels and allows administrators to edit or remove user access. It also offers manager-account security settings, including two-step verification and allowed domains for owned subaccounts. Product controls and availability change; verify the live account instead of assuming all child accounts inherit a setting.
Shared accounts defeat attribution and make offboarding unsafe. Replace them with named identities. Where a platform cannot avoid a shared secret, place it in an approved vault, limit users, rotate it on personnel change and record every dependent integration.
4. Check time and contract status
Record start, last activity, contract end, task end and access expiry. Use shorter expiry for privileged, temporary and emergency access. Renewal should require an owner’s positive decision rather than silently extending permissions.
Contract end and access end should be linked but not assumed to be identical. A contractor may need limited read-only access for an agreed handoff, or access may need removal before termination becomes public. Human resources, procurement, legal and security should coordinate sensitive departures.
5. Revoke the whole access chain
For a departure or completed task:
- suspend the named identity or remove the platform role;
- unlink agency or manager relationships no longer needed;
- revoke OAuth grants, tokens, keys and app passwords;
- rotate shared secrets and recovery factors;
- transfer ownership of campaigns, assets, dashboards and automations;
- remove scheduled exports and data destinations;
- preserve required audit and business records;
- confirm the person cannot regain access through another path.
Do not delete evidence indiscriminately. Deactivate where the platform retains historical attribution, and follow records, privacy and incident procedures. Google Ad Manager, for example, documents deactivation rather than permanent deletion of a user record.
6. Verify and close
Capture the platform confirmation, actor and timestamp. Where authorized and safe, test that the revoked identity or token fails and that current business workflows still run. Inspect activity logs for access after the expected end date and escalate unexplained events to security.
A 2024 joint CISA advisory described a threat actor leveraging a compromised former-employee account and recommended measures including least privilege, robust asset management and stronger authentication. That incident does not prove a particular marketing account is compromised; it shows why inactive credentials deserve prompt, evidence-backed closure.
Use the access audit register
The reader asset is a Current-Task Access Register:
| Field | Required value |
|---|---|
| Identity | person, agency, service account or app; business email/domain |
| Asset and path | platform, account, manager link, group, token or integration |
| Privilege | effective role, inherited rights, admin/billing/export flags |
| Current task | precise deliverable and data needed |
| Authority | internal sponsor, contract and system owner |
| Time | start, last activity, task end, expiry and review date |
| Authentication | SSO/MFA state, shared-secret exception and recovery owner |
| Decision | retain, reduce, suspend or remove; approver and evidence |
Reconcile the register to platform exports, not memory. Count rows before and after decisions and investigate unmatched identities. Keep a separate high-risk view for administrators, billing access, data export, domain control and publish authority.
Work an illustrative audit
A brand exports access from Google Ads, its email platform, social-business portfolio, analytics and file store. An agency contract is active, but one former freelancer still has direct administrator access to Google Ads through a personal email. The agency’s manager link also remains, and a reporting connector holds an OAuth token created by the freelancer.
The current task needs agency campaign editing and read-only analytics. The team retains the manager link at the minimum role, removes the freelancer’s direct user, transfers connector ownership to a controlled service account, revokes the old token and requires managed-domain authentication. It verifies current reporting and records platform confirmations. This is illustrative; CDM did not access or test these accounts.
Choose a risk-based cadence
Audit at onboarding, role or task change, contract renewal and offboarding. CDM recommends monthly review of privileged external paths, quarterly reconciliation of all external marketing access and immediate review after suspected compromise. Those intervals are recommendations, not federal or platform mandates.
Automate collection where available, but keep human ownership. A script can find an inactive user; it cannot determine whether a confidential launch still requires an agency’s access. Conversely, manual spreadsheets miss newly created tokens unless compared with source systems.
Boundaries and specialist review
An access audit is not a full security investigation. If logs show unexplained use, privilege changes, new campaigns, billing changes or data export, preserve evidence and involve security incident responders. Employment, contractor, monitoring and notice rules vary; coordinate with HR, legal and privacy specialists.
Platform screenshots show a point in time. They do not prove a credential was never used elsewhere or that exported data was returned or deleted. Address data return, confidentiality and deletion separately in the contract and exit process.
Related guides
Frequently asked questions
Is removing a contractor's user account enough?
No. Also inspect agency manager links, inherited group roles, OAuth grants, API keys, service accounts, shared credentials, recovery methods and scheduled exports. Transfer ownership of assets and automations before revoking where continuity requires it. Then verify that the old path fails and review logs for unexpected activity.
The caveat is evidence preservation: deactivation may be safer than deletion when the platform uses the identity for audit history. Follow security, records and privacy procedures rather than erasing the trail. Record every remaining exception with an expiry owner.
Should agencies use personal email addresses for account access?
Prefer named, business-managed identities with enforced authentication and an accountable domain owner. Personal emails are harder for either organization to govern after role changes. Google Ads provides mechanisms for administrators to identify or move unmanaged users and restrict allowed domains in some manager configurations.
The caveat is legitimate freelancers and platform limitations: if personal identity is unavoidable, use minimum privilege, short expiry, MFA, a named sponsor and more frequent review rather than granting broad permanent access. Remove that exception when a managed identity becomes available.
How often should external marketing access be audited?
Review on onboarding, task or role change, contract renewal and offboarding. CDM recommends monthly checks for privileged external access and quarterly reconciliation for all external paths, plus immediate review after a suspected compromise. These intervals reflect risk, not a universal requirement.
The caveat is scale: high-volume organizations may need continuous identity monitoring, while a small low-risk tool can use a lighter cadence. Every system still needs a trigger that removes access promptly when the task ends. Track missed reviews as control exceptions, not calendar noise.
What should happen to shared agency passwords?
Replace them with named accounts wherever possible so actions are attributable and each person can be removed independently. If a platform forces a shared secret, store it in an approved vault, restrict retrieval, use MFA where supported, rotate on every personnel change and inventory every dependent automation.
The caveat is that rotation can break integrations. Test the transition, assign a service owner and preserve emergency recovery without emailing or messaging the new password to a broad group. Log who retrieved the secret and why.
Can inactive accounts simply be ignored?
No. Inactivity does not remove permission; a dormant credential can be stolen or reused. Confirm whether the task remains valid, then suspend, reduce or remove access and preserve the decision record. Last activity is a signal, not the sole rule—some emergency or seasonal roles are legitimately quiet.
The caveat is platform reporting: activity logs may be limited or omit token use. Combine contract and task evidence with user, manager and integration inventories rather than trusting one “last login” field.
Who should approve agency administrator access?
Require the system owner and a business sponsor to confirm the current task, with security review for high-privilege or sensitive-data access. The person requesting access should not be the only approver. Set an expiry and require a fresh decision at renewal.
The caveat is urgent incident work: temporary emergency access may use an accelerated route, but it should be tightly scoped, strongly authenticated, logged and automatically expire. Urgency should not create a permanent administrator relationship. Review emergency actions after the incident closes.
Next decision: What Should a Marketing Team Do When a Critical Tool Fails on Launch Day?
Related reading: How Do You Run One Approval System Across Employees, Freelancers and Agencies? · How Do You Plan an Exit From an AI Marketing Vendor Without Losing Data or Workflows? · How Do You Build a Data-Risk Register for Marketing AI Tools?
Sources and research notes
- NIST SP 800-53 Revision 5 — checked 26 September 2026; broad security and privacy control catalog including account management and least privilege.
- NIST SP 800-171 Revision 3 — checked 26 September 2026; covered CUI requirements include account management and least-privilege controls, with limited applicability outside its scope.
- Google Ads: Manage access to your account — checked 26 September 2026; documents granting, editing and removing individual access.
- Google Ads: Unlink manager accounts — checked 26 September 2026; documents manager-link removal as a separate administrative action.
- Google Ads: Manager Account Security Mandates — checked 26 September 2026; documents two-step-verification and allowed-domain mandates for manager-owned subaccounts.
- Google Ad Manager: Add and edit users — checked 26 September 2026; documents immediate access revocation by deactivation and the inability to permanently delete a user record.
- CISA joint advisory on a compromised former-employee account — checked 26 September 2026; primary advisory supporting least privilege, authentication and asset-management concerns.
Limitations: CDM did not inspect contracts, identities, tokens, activity logs or platform roles and did not perform the illustrative revocation. Cadences and default decisions are CDM recommendations. Involve security, legal, privacy, HR and procurement specialists where actual findings require them.
This article is editorial guidance. Apply the principles in proportion to your market, evidence, and responsibilities.
