# Google Workspace and separate client accounts, for agencies > Give each person a Google Workspace account and let clients invite that address. Your agency never holds a client's Google password, and leaving ends access. Source: https://mosaicbrowser.com/blog/google-workspace-client-separation ## Separating client work with Google Workspace accounts Give each person a Google Workspace account and let clients invite that address. Your agency never holds a client's Google password, and leaving ends access. ![Shared login versus Invitation, each name in its own tile: Invite the person, not the password](https://mosaicbrowser.com/covers/google-workspace-client-separation.webp) An agency that gives each person a Google Workspace account, and gets into client tools through invitations to that address, never has to hold a client's Google password. The client adds `maria@youragency.com` to their Google Ads, Analytics or Search Console, Maria signs in as herself, and her access ends the day you suspend her. Separate client accounts are rarely needed; what needs separating is people. ## Google Workspace accounts per person, not separate client accounts The tempting setup is one Google account per client, `acme@youragency.com`, that everybody on the Acme team signs in to. It looks tidy in the Admin console and it is the shared password problem again. Two-factor has to be passed around, every change in the client's Google Ads change history carries the same name, and when somebody leaves the only way to cut them off is to change a password three other people use. Tie each grant to one person instead. Each person gets one Workspace user, with 2-Step Verification enforced from the Admin console, and every client tool is reached through an invitation to that user: - Google Ads: the client accepts a link request from your manager account, and your people reach the client's account through it. - Google Analytics: the client adds the address under property access management, with the role the job needs. - Search Console, Tag Manager and Merchant Center: each has its own user list in its settings, and each takes an email address. - Google Business Profile: the client adds the address as a manager, which is why [an organisation account for Business Profile](https://mosaicbrowser.com/blog/business-profile-organization-account) is worth setting up once you have more than a handful. - Drive: share the client's folder with the person, or with a Google Group of the people on that client, so a new hire is added in one place. The client keeps ownership the whole time. The account, its billing and its recovery details are theirs, and so is the decision to remove you. Mosaic is a desktop app Email yourself the link and open it on your computer. How it works: Bulk actions ## The setting that blocks the first invitation The first time a client sends an invitation, it often fails, and the client is not the problem. Workspace treats Google Ads, Analytics, Search Console and the other services outside Gmail, Drive and Calendar as additional Google services, and an admin can switch each one on or off per organisational unit. A new Workspace with conservative defaults may have them off. The user then cannot accept, or signs in and is told the service is not available for their account. The fix is in the Admin console, under the apps section for additional Google services: turn on what your people need for the units that do client work. It is worth doing before the first client sends anything, because "your invitation didn't work" is a poor first week. ## When someone leaves Suspending the person's Workspace user blocks their sign-in, so every grant made to that address stops working at the same moment, at every client. Nobody has to change a client's password, and the client does not have to be told before it takes effect. Two loose ends stay. The address is still on each client's user lists until someone removes it, and a suspended address there looks like a door left open to anyone reading the list. And their Drive files need a new owner before the account is deleted, which the Admin console does as part of deleting a user. We keep the removal as a line in [the quarterly access check](https://mosaicbrowser.com/blog/quarterly-access-audit), and the rest of the leaving list is in [what to do with a client's profile when the contract ends](https://mosaicbrowser.com/blog/client-offboarding-browser-profiles). ## When a client issues their own account Some clients will not invite an outside address. They create a user in their own Workspace, `maria@acme.com`, and their admin controls it: its password rules, its 2-Step Verification, how long its sessions last. That is a reasonable choice for them, and it gives Maria a second Google identity to keep apart from her first. One browser handles two Google accounts with the account chooser, and the first one signed in is the default. A link from an email or a chat opens in whichever account the browser picks, so the Acme report gets opened, and sometimes edited, as the agency user, or a calendar invite is accepted from the wrong one. A new browser asking Google to "verify it's you" on every switch is the other common symptom ([why Google asks on a new device](https://mosaicbrowser.com/blog/google-verify-its-you)). That is where we use Mosaic. Maria keeps one profile for her agency account and one for each account a client has issued her. Each profile has its own cookies, so each stays signed in to one Google account and no chooser is involved. The setup key for each account's authenticator codes goes into that profile's credentials, so the code shows up in the window that needs it. Mosaic has no seats or shared profiles: each person on the team runs their own copy on their own computer, with the profiles for the accounts they hold. For everything reached by invitation, one profile with the agency account is enough. Google's own tools already show Maria every client she was invited to, under one sign-in, and that is the setup to aim for. ## Questions ### Should an agency create a separate Google Workspace account for each client? Usually not. One Workspace account per person, with each client inviting that address into their Ads, Analytics or Search Console, ties access to someone you can name and remove. A per-client account is a shared login with a nicer domain. ### Why can't my Workspace user accept a Google Ads or Analytics invitation? Workspace admins decide which Google services outside the core apps their users may use. If Google Ads or Analytics is switched off for that user's organisational unit, the invitation has nothing to land on. Turn the service on in the Admin console and try again. ### What happens to client access when an employee leaves? Suspend their Workspace account and every client grant made to that address stops working at once, because sign-in is blocked. The address still appears on each client's user list until someone removes it there. ### Can two staff members share one Mosaic profile? No. Mosaic has no seats or sharing, and a profile lives on the computer that made it. Each person runs their own Mosaic with a profile for each Google account they hold. ## Related [Giving a virtual assistant access without handing over the password](https://mosaicbrowser.com/blog/va-access-without-password): Seller Central, Meta and Google each let you add a virtual assistant under their own login, with chosen permissions. A shared password is the fallback. [What to do with a client's browser profile when the contract ends](https://mosaicbrowser.com/blog/client-offboarding-browser-profiles): Agency client offboarding goes wrong when access is revoked before the client can sign in. Confirm the handover, export, then trash the profile by id. [A quarterly check of who can reach each client account](https://mosaicbrowser.com/blog/quarterly-access-audit): A social media account access audit is two lists per client: who the platform says has access, and which of your profiles hold a login. Each gap is a finding. [Why Google says 'verify it's you' on a new device](https://mosaicbrowser.com/blog/google-verify-its-you): Google asks you to verify it's you when a sign-in comes without the cookie its last sign-in left, or from an address in a place you have not been.    [Amazon Ads Partner Network access, for agencies](https://mosaicbrowser.com/blog/amazon-ads-partner-network): Amazon Ads Partner Network access lets an agency link clients' ad accounts to its own manager account, so nobody hands over a Seller Central password. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.