Roles and what they can do
Profiles have owners and managers, and larger accounts may use groups. Owners can add or remove other users and transfer ownership. Managers can edit the profile but cannot remove an owner. Names and detail may change, so check the help center.
Aim for at least two owners you trust.
Use accounts tied to the business
Create a business email, not a personal one, to serve as the owner login where practical, and protect it with two-step verification. Store the recovery details in your password manager. If the owner is an individual who leaves, you need a way to recover.
Avoid sharing one password among many people. Invite individuals under their own accounts.
In the profile settings, open the people and access section, then invite by email and choose a role. The person accepts the invitation. When someone leaves, remove their access immediately.
Review the list of users every quarter. Remove anyone you do not recognize.
Working with agencies
If you hire an agency, give them manager access under their own account, not your owner password. Keep your own ownership. Put in your contract that you own the profile, the website, the domain and all listings, and that access will be transferred on request at the end.
If an agency created the profile under its own account, ask them to transfer ownership to you.
Transferring ownership
The current owner can usually make another user an owner and then step down, or use a transfer option. The new owner must accept. For a sold business, transfer the profile to the new owner's account as part of the closing checklist, together with the website and domain logins.
If you have lost access to the original owner account, use the ownership request process and be ready to verify.
Write down who owns what, which email is used and where recovery information is stored. Update it when anything changes. This small document can save weeks of effort in an emergency.
An onboarding and offboarding checklist
When someone joins who needs access, invite their individual account, assign the lowest role that works, record the date and the reason, and enable two-step verification on their account. When they leave, remove access the same day, change shared passwords you cannot avoid, and check that no automatic tools still use their login.
Do the same for your web designer, bookkeeper or agency, scaled to what they need. Once a year, audit all users on the profile, the website, the domain registrar and analytics. A tidy list of who can do what is among the cheapest security measures a small business can take.
Warning signs to watch for
Be alert to emails asking you to click a link to keep your profile active, to share a code, or to hand over access to a stranger. Legitimate notices appear in your dashboard. If you are unsure, sign in directly instead of using a link in the message. Report phishing and change your password if you clicked something suspicious. Setting up two-step verification now makes these attempts much less likely to succeed.
Common questions
How many owners should I have?
At least two trusted people, so one person's absence does not lock you out.
What if a former agency won't release my profile?
Submit an ownership request through Google and provide proof that the business is yours. Keep records of your communications.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.