Short answer
Ads Manager has two tenant-wide roles (global admin and ads admin) and three roles per ad account (admin, member, viewer). A person gets the highest role granted directly or through a group. ChatGPT workspace and API roles don't grant any Ads permissions.
The roles
| Role | Scope | Can do |
|---|---|---|
| Global admin | Whole organisation | Manage domains, identity providers, sign-in policy; create eligible ad accounts |
| Ads admin | Whole organisation | Create eligible ad accounts; no automatic access to existing ones |
| Ad account admin | One account | Manage the account, its users and groups |
| Member | One account | Use and update ad resources |
| Viewer | One account | View only |
Rules worth knowing
- Every ad account must keep at least one admin
- Roles combine: Admin beats Member beats Viewer
- Removing a direct role doesn't remove a group role
- Being an Ads account admin doesn't make you an OpenAI global admin
Removing someone
- Assign another admin first if they are the only one
- Open Users & groups for the account
- Remove the direct role or change group membership
- Update synced groups in your identity provider
- Check what access remains
Questions
Who should be admin at an agency client?
The client keeps admin; the agency usually gets Member. That keeps ownership with the advertiser.
Facts checked against the sources below on 12 October 2026. Platforms change quickly: if something here no longer matches what you see, tell us and we will update it.
