Granting Marketing Agency Access to Yandex Metrica: Roles, Filters, and Revoking Permissions

Grant access to your marketing agency based on specific tasks: viewing reports, managing goals, or adjusting settings. Establish the account owner and access revocation procedures in advance.

Four access roles and their application boundaries

Yandex Metrica distinguishes permissions by the level of interference with counter configuration. The "View" role grants the right to open standard and saved reports; a user with this access sees traffic, sources, and user behavior, but cannot add a new goal or modify a filter. This is sufficient for an agency that prepares weekly dashboards on reach and conversions: it's enough to download data or save the report to your own account. "Analytics" allows creating and editing goals, segments, and shared reports for the counter, but blocks changes to counter code, filtering settings, and user management. This level suits a performance marketing specialist who runs A/B tests of target actions and correlates conversions with utm tags from advertising campaigns. "Edit" enables modifying counter parameters, managing data collection filters, and uploading offline conversions; this access is needed for a developer or analyst integrating CRM with Metrica and setting up the transmission of order parameters. Representative access grants the contractor the same rights as the account owner across all counters in the account, including future ones; the documentation explicitly states that a representative receives full rights to view, edit, and delete.

Data access filters: how to limit metrics by ad campaign

A separate mechanism is the data access filter for a counter, which the owner creates in Settings → Access → Data Access Filters. The filter restricts the visible set of visits by conditions based on utm parameters, geolocation, device type, or traffic source; a user with such access sees only the portion of statistics that meets the filter condition, while all other data remains hidden. Documentation from 2025 allows one data access filter in Basic Metrica and multiple filters in Metrica Pro. This tool solves the access control task: for an agency running ads in Yandex.Direct, the owner grants a filter "utm_source = yandex", for a contractor managing contextual ads in Google — "utm_source = google", and each sees only the results of their own work. Filters stack: if a user already has a personal filter set in a report, the system applies both conditions simultaneously, narrowing the data set. When a filter is deleted, all users to whom it was granted lose access to the counter entirely, so before offboarding a contractor, the owner must first revoke rights, then remove the filter.

An access filter differs from a statistics collection filter: the former restricts data for a specific user, while the latter excludes visits from the overall counter database for all roles.

What access level a marketing agency needs at different stages

At the project kickoff, the agency requests "View" access to study the current audience, traffic sources, and funnel bottlenecks; this is sufficient for an audit and strategy development. When the contractor moves to campaign launches and needs to track conversions, the business owner grants "Analytics" access with a filter restricted to the agency's utm tag: the specialist creates goals for lead forms or add-to-cart events, saves repeat customer segments, and builds attribution reports, but cannot see organic traffic and competitor channels. If the agency implements cross-platform analytics or sets up offline conversion imports from a CRM, the owner temporarily elevates access to "Edit," documents the list of modifiable parameters and access duration in the contract, and establishes audit procedures. Admin access is justified for full-service agencies managing all of a brand's digital assets, operating multiple websites, and responsible for consolidated reporting; in this case, the contract should specify the representative's liability for actions taken and the change audit process.

Account owner's checklist for granting agency access

• Request Yandex logins from the agency for employees who will work with analytics and maintain a list in the contract appendix; do not grant access to a corporate account if you cannot control who logs in under it.
• Define the contractor's task and select the minimum sufficient role: "View" is enough for report preparation, "Analytics" for working with goals, "Edit" for technical integration; do not grant representative access for convenience.
• Create an access filter if the agency should only see traffic from its own campaigns: set a condition by utm_source or utm_campaign and apply the filter to the contractor's logins; verify the filter works by opening the report under a test account.
• Specify in the contract the validity period of access and list of permitted operations; state that changing counter settings without the owner's approval is a violation.
• Review the list of active accesses quarterly through "Settings → Access"; if the tab shows more than 100 users, export the full list via the access management API and revoke rights for laid-off agency employees and contractors who completed the project.
• Do not share account passwords and do not enable public access for the agency: public statistics do not show goals, segments, and offline conversions, and a shared password does not allow you to track who made changes.
• Document changes to goals and settings: ask the agency to duplicate notifications about creating a new goal or filter in the project chat so you have an audit trail.

How access revocation and filter deletion work

To revoke access, the owner opens "Settings → Access," finds the agency employee's login in the "Individual Access" list, and clicks the delete icon; the change takes effect immediately and the user loses the right to view statistics. If an access filter was configured for that login, revoking rights does not delete the filter itself: to delete a filter, the owner goes to the "Access Filters" section, selects the desired one and confirms deletion, after which all users who were granted access with that filter lose their rights entirely. The documentation warns: you can create two identical filters with different names, and the system won't block duplication, so the owner should maintain a registry of filters and their purpose. Representative access is revoked through "Account Settings → Representatives"; after removing a representative from the list, they retain guest access to individual counters that were granted to them personally, but lose rights to the owner's new counters. When switching agencies, the owner first revokes all individual access grants, then removes representatives, then deletes filters associated with utm tags from completed campaigns, and only then grants rights to the new contractor.

Frequently Asked Questions

What level of Metrica access does an agency need to set up conversion goals?

The "Analytics" role allows creating, editing, and deleting goals and segments, saving shared reports to a counter, and working with dashboards—this is sufficient for setting up conversion actions and building conversion funnels. The "View" role does not grant the right to create goals.

Can agency access be restricted to traffic from their campaigns only?

Yes, the counter owner creates an access filter with a condition based on utm_source or utm_campaign and applies it to the agency staff logins; in this case, the contractor sees only visits that meet the filter condition. All other traffic remains hidden from them.

What happens to agency access after a filter is deleted?

After deleting a filter, all users for whom this filter was configured lose access to the counter entirely, even if they were granted the "Analytics" or "Edit" role. Revoke individual permissions before deleting the filter.