Key takeaways
- Keep primary ownership in a company-controlled Google Account and retain access when an employee or agency is added.
- Give each person a separate account and the least powerful role that lets them do their job; never share one password.
- Record the profile ID, primary owner, backup owner, managers, purpose, approver, recovery details, and last review.
- Remove access as part of offboarding and test recovery before a departure, dispute, or compromise makes it urgent.
01
The dangerous setup often looks convenient
A marketing partner creates the profile in an employee account, verifies it, and handles every update. Months later the relationship ends. The client has invoices, signage, and a real location—but no primary ownership, no recovery route, and no record of who still has access. A routine handoff becomes a business continuity incident.
Start with an access register. For each profile, record the business and location IDs, company primary owner, additional owner, managers, role purpose, approving owner, account domain, multifactor status, recovery contact, date added, last review, and planned removal. Store the register somewhere the business controls, not inside an agency workspace that disappears with the contract.
Swipe to compare every column
| Role | Use it for | Do not use it for |
|---|---|---|
| Primary owner | Company custody and final transfer authority | A temporary employee or outside agency |
| Owner | A small number of accountable administrators | Routine posting by the whole team |
| Manager | Editing information, posts, and review responses | Changing users or custody |
| No access | People without a current operational need | Former staff kept “just in case” |
02
Separate custody from daily work
Google allows multiple owners but only one primary owner. Owners can add and remove users; managers can handle most daily profile work without controlling access. Use that distinction. A protected company account can hold primary ownership while named staff and partners receive the role they need through their own Google Accounts.
Google explicitly advises businesses to limit access, remove former employees, and make sure they retain access when a third party is added. Business groups can help multi-location organizations avoid password sharing, but their scope deserves the same care: a group manager may be able to edit every profile placed in that group.
03
Make access changes a controlled event
Require a business owner for every access request, a stated purpose, an expiry or review date, and a ticket or change record. Review owners monthly and managers quarterly. Flag personal addresses, dormant users, accounts outside approved domains, and agencies with access beyond the locations they serve.
Offboarding should revoke profile access, shared inbox access, API credentials, call-tracking consoles, directory tools, and recovery methods in one checklist. Remember that newly added owners and managers face temporary limitations on some ownership actions, so do not schedule a critical transfer for the last hour of a contract.
04
Practice the failure before it happens
Confirm that two trusted company-controlled accounts can reach the profile, that recovery contacts are current, and that ownership evidence is available. If someone else has already verified a legitimate profile, use Google’s ownership-request process rather than creating a competing profile.
Track orphaned profiles, unnecessary owners, overdue reviews, failed removals, and recovery tests. The objective is not the largest access list or the fastest agency onboarding. It is a profile the business can operate, audit, and recover without depending on one person’s inbox.
Primary sources and further reading
Use the source material to validate details against your own context and current platform configuration.
- Google: Manage Business Profile owners and managers
- Google: Help protect your Business Profile
- Google: Request ownership of a Business Profile
This field note follows the XenGrowth editorial policy: primary sources where available, visible limitations, material review dates, and no invented first-hand experience.
Stay with the problem
