Google Account Linked Services Audit for South Africa: A Handover Playbook for Ad Accounts

A four-layer inventory of every app, service link, Workspace grant and billing surface attached to a South African marketing login - built for the day you inherit an account from someone else.

Four Layers, Not One

OAuth apps, Ads/GA links, Workspace grants and billing ownership fail in different ways.

Inventory Before Keys

Map every connected service before granting or revoking access on day one.

Orphaned Tokens Distort Data

Stale connections quietly skew attribution and inflate reported conversions.

Published: 6 November 20265 min readGoogle Ads

Get a Quote

seo-and-google-ads-integration — google-ads hero

Add as a preferred source on Google

The Umhlanga Scenario: A New Agency, an Old Token, and a Reporting Number Nobody Trusts

A KwaZulu-Natal consumer-goods brand moves its paid media to a new agency. This is a hypothetical scenario. The marketing director hands over admin access on a consumer Gmail identity, campaigns look healthy, yet reported conversions in the new agency's dashboard are roughly double what the brand's order data suggests. The cause is often mundane: a previous agency's reporting tool still holds OAuth scopes over that login, a GA4 property link survived the handover, and nobody mapped the payments profile.

That gap between platform-reported and true numbers is why a Google account linked services audit matters before anyone touches bids. It is not a security product, and Google publishes no native 'linked services audit report' - you build the inventory yourself from four distinct screens.

What a Linked Services Audit Is - and What It Is Not

A linked services audit is a written inventory of every external app, service link, tenant-level grant and billing surface attached to a Google login that controls ad spend or measurement. It is not activity forensics, a billing setup guide, or a Workspace build - those are separate disciplines.

Do the inventory before you grant or revoke anything. Revoking a link you don't understand can break reporting or billing mid-flight.

Layer 1: Third-Party OAuth Connections at myaccount.google.com/connections

This screen lists every app and service a person has granted access to their Google Account. It is per-identity, not per-organisation - which is why a marketing director's personal Gmail is often the riskiest login in the estate. Auditing it means reading each grant's scopes, not just its name.

How to Read an OAuth Grant: Scopes, Send-As and the 'Analytics Readonly' Problem

A grant labelled 'Analytics Readonly' sounds harmless until you notice it also carries Gmail send-as or Google Ads edit scope bundled into the same consent. Scope creep is the norm. Record, per grant: the app name, the scopes listed, the date last used, and whether the business still holds a contract with that vendor.

myaccount.google.com/connections      # OAuth grants per identityads.google.com > Admin > Access       # who can enter the Ads accountgoogle.com/analytics > Admin > Product linksadmin.google.com > Security > API controls > App access controlpay.google.com > Settings             # payments profile ownership

Separate from OAuth, Google Ads holds its own linked-account relationships: Analytics, Merchant Center, Search Console, YouTube, Business Profile and Play. GA4 holds product links of its own. These links persist beyond individual user access - removing a person from the Ads account does nothing to sever a GA4 property still feeding conversions into the campaign. Check both directions and note which links are still commercially intended.

Reconciling the Four Layers: What Each Can Do in the Wrong Hands

Layer	What it can do if left in the wrong hands	Who normally owns the fix	Where the screen lives
OAuth app grants	Read mail, pull Analytics, or write to Ads via a stale token	The individual account holder	myaccount.google.com/connections
Ads / GA4 links	Skew conversion data, retain visibility of spend and audiences	Ads admin or GA4 admin	Ads Admin; GA4 Admin > Product links
Workspace app access	Tenant-wide data exposure across the .co.za domain	Workspace super admin	Admin Console > Security > API controls
Payments profile	Control of ZAR billing, cards and spend continuity	Finance owner or brand	pay.google.com > Settings

If you'd rather have the paid-media side handled alongside the audit, see our Google Ads management service.

Layer 3: Workspace Tenant App Access Control for .co.za Domains

If the brand runs Google Workspace on a .co.za domain, tenant-level controls sit above individual grants. In the Admin Console, App access control lets a super admin mark third-party and internal apps as trusted, limited or blocked. The practical wrinkle in South Africa: the super admin is often a founder's personal Gmail or a departed employee, so the audit stalls until that control is recovered. A grant removed at myaccount level does not override a tenant-wide trust decision.

Layer 4: Payments Profile Ownership - the Finding Most Audits Miss

The payments profile owns the ZAR billing relationship: legal name, currency, tax status and cards. A routine finding in handover reviews is that the profile is still owned by an ex-agency, meaning the new team can run campaigns but cannot see or change what funds them. Map ownership and the billing identity.

POPIA framing, not legal advice: a responsible party carries safeguard obligations under sections 19-22, including notification where a compromise occurs. A stale link is a governance gap you can close cheaply.

The POPIA Dimension: Linked Services as a Processor Register

Each third-party connection is effectively an operator (processor) touching personal information - customer emails in a reporting tool, audience data in an ad platform. Treating the OAuth list as a processor register gives the Information Regulator framing a practical home without turning an inventory into a compliance claim.

The Post-Handover Sign-Off Artefact and a Quarterly Review Cadence

Tip: produce a one-page sign-off listing all four layers, dated, with named owners on both sides. Re-run it quarterly and at every agency or staff change.

Where an Orphaned Link Turns Into an Attribution Problem

A stale GA link or orphaned OAuth token quietly distorts conversion reporting - double-counted goals, inflated platform conversions, and a CAC/MER picture that flatters the account. Clean data pipelines and server-side tracking only help if the links feeding them are intentional. Our custom reporting approach and conversion rate optimisation work start from a reconciled source of truth, not the platform's own count.

Audit Cadence and Ownership: Who Fixes What After the Inventory

Assign each layer a single owner: the identity holder for OAuth, the Ads admin for service links, the super admin for tenant controls, and finance for payments. Revoke deliberately, log the date, and re-check in 30 days to confirm nothing broke. That cadence turns a one-off handover exercise into a repeatable control.

Sources

Get a Quote

Why Choose Us

Here's what sets us apart

500+ Expert Articles
A content hub covering SEO, paid media, CRO and web design for South African businesses.
200+ Success Stories
Campaigns and builds delivered across retail, services, B2B and ecommerce.
200+ Happy Clients
Businesses that trust Prebo Digital with their digital growth.
4.9 Average Rating
Rated 4.9 out of 5 across verified Google reviews.
24h Response Time
Questions answered within one business day, every time.
Google Premier Partner
Premier Partner status since 2022, placing us in the top 3% of agencies.
Amazon Verified Partner
One of the first verified Amazon Ads partners in South Africa.
Meta Business Partner
Certified to run paid social across Facebook, Instagram and beyond.

What Our Clients Say

Don't just take our word for it

Featured

“Great service and professional team.”

Emelda Schuster

Featured

“Shout out to Leesha @Prebo Digital for great diligence and care handling our Google Ads account. Other agencies take your money and do nothing until you ask. Not Leesha & Prebo Digital. They do what they say and show up with a friendly face. Work to fix issues. Highly recommended.”

Bradley Schmidt

Featured

“Excellent service and support.”

Des Brown

Featured

“Very skilled and knowledgeable in the digital industry and you understand the importance of budgets. Start-ups do not have hundreds of thousands to spend at first and you guys really make the most of every budget provided.”

Cat street

Featured

“Prebo will take your business to the next level. Extremely smart people, great service. Always go above and beyond.”

Mike Gray

Featured

“A dedicated, knowledgeable and enthusiastic team of individuals that are determined to see your brand grow!”

Alastair Waldeck

Featured

“A great agency to work with that always provides excellent service. Very professional and dedicated team.”

Lynelle van Niekerk

Featured

“In the 4 months since we joined hands with Prebo our leads quantity and quality has increased with much more direct impact on our target market. The team is on point and forever in contact with new ideas and solutions to maximize our potential within the set budget cap. Very innovative group of people!”

Rikus Booyens

Featured

“Great service from Prebo Digital team.”

Mothusi Calvin Mogorosi

Featured

“Great Agency - growth-minded, a diverse team of talented individuals with collaborative success at its heart”

David Delaney

Featured

“Outstanding digital marketing services.”

DUNCAN DUNSHAM

Featured

“Industry experts!”

Ricardo Banda

Featured

“Excellent work and professional service.”

Menzi Mohale

Featured

“Expertise, ethos, excellence”

Andrew Johnson

Featured

“Professional and reliable service.”

Ebert Du Plessis

5.0/ 5

15 reviews

Keep reading

Google Ads

Google Account Delegated Access Management in South Africa: The Grant, Review and Revoke Playbook for Ad Accounts

The Stellenbosch Scenario: A Retainer Ends, and Three Logins Outlive It A hypothetical B2B software firm in Stellenbosch ends a six-month retainer with a freelance Google Ads buyer. Three months later, the marketing manager finds the contractor still holds Standard access to Google Ads, a stale OAuth token is pushing conversion data into a third-party dashboard, and the freelancer is a delegated owner on Search Console. None were granted maliciously - they were simply never revoked. This is the delegate-to-revoke gap South African marketing teams must close systematically. Delegated access management is not about trusting partners less. It is about building a lifecycle - grant, review, revoke - that survives staff turnover, agency changes and the common SA pattern of an in-house team working alongside one agency and one freelancer on the same account. What 'Delegated Access' Actually Means Across Four Google Surfaces Google uses the word 'access' across four distinct systems, each with its own permission model, revocation path and failure mode. Surface What You Delegate Where It Is Set Common Roles Google Ads Campaigns, billing and users Tools & settings → Access and security Admin, Standard, Read-only, Emails-only Search Console Property data and settings Settings → Users and permissions Owner, Full, Restricted Google Workspace Admin roles, email delegation, API scopes Admin console → Directory / Security Super admin, delegated admin, Gmail delegate Google Business Profile Listing management Business Profile Manager Primary owner, Manager Grant Access Without Handing Over the Keys: The Client-Owned Account Model The most effective control is structural: the client retains ownership of the Google Ads account, and the agency operates from its own manager account (MCC) with access granted. Never reverse this. When the client owns the account, revocation is one action - removing the MCC link - and data, billing profile and change history stay under client control. This is how Prebo Digital's Google Ads practice operates: the client holds the account, the agency holds delegated access, and the relationship can end cleanly without a migration project. Rule of thumb: if the agency created the account, request ownership transfer before the first invoice. A client-owned account also keeps billing on the client's payment profile, simplifying POPIA accountability and VAT documentation. The Minimum Viable Access Matrix: Matching Role to Permission Level Over-granting is the default failure mode. A reporting analyst does not need Standard access; a media buyer should not hold billing rights. Use this matrix as a starting point and document every exception. Role Google Ads Level Search Console Notes Reporting analyst Read-only Restricted No billing, no user management Media buyer Standard (billing off) Full Can edit campaigns, cannot change payment Strategy lead Standard Full Same as buyer; no admin rights Billing / owner Admin Owner Named client staff only, never agency Watch the Emails-only level. It looks harmless, but still exposes the account email address and can receive account notifications - a subtle exposure point when a contractor leaves. Remove it alongside Standard access. Why .co.za Workspace Domains and Consumer Gmail Logins Behave Differently Many South African marketing teams run the Ads account on a consumer Gmail address rather than a verified .co.za Workspace domain. A consumer login has no admin console, so there is no central place to revoke OAuth grants or audit app access. With Workspace, an admin can control app access by organisational unit and see login events. On a personal Gmail, the only revocation path is the owner visiting myaccount.google.com/connections - and if that owner has left, it becomes a recovery problem. Where possible, migrate the Ads account to a Workspace group email (e.g. ads@yourcompany.co.za ) so access follows the role, not the person. The Grant Checklist: What to Confirm Before Day One of a Retainer Second admin exists on the client side, with 2-Step Verification confirmed. Access is granted to a Workspace group email, not an individual's personal Gmail. Billing profile remains under client ownership and is not shared with the agency. MCC link is recorded in the access register with date and requesting party. Search Console ownership stays with the client; agency receives Full or Restricted. Third-party tools connect via a shared service account, not a personal OAuth token.

Nov 7, 20267 min read

Google Ads

Google Account Data Export Tool for South Africa: Mapping the Five Export Surfaces Before You Buy

The Melrose Arch Meeting Where Three Dashboards Disagreed (Hypothetical Scenario) Picture a marketing director at a Johannesburg consumer brand opening a Monday finance review. The Ads UI shows R412,000 of attributed revenue for the month. GA4 shows R368,000. The CRM shows R341,000. Nobody is hacking the account. All three numbers are technically honest, and none of them can be reconciled quickly because the exports behind each dashboard were pulled on different days, from different surfaces, with different definitions of a conversion. The phrase "google account data export tool" implies a single switch that dumps everything into one tidy file. In practice, a Google account is a federation of surfaces, each with its own export mechanism, its own owner, and its own idea of what a session or a conversion is. The Five Export Surfaces, Side by Side Before comparing vendors, map what you are actually exporting. South African teams typically touch five surfaces: Google Takeout - a personal-account archive covering Gmail, Drive, Calendar and more. Useful for data-subject requests and offboarding, not for marketing reporting. Google Ads - campaign, cost and conversion data pulled via the Ads API or scheduled reports. Versioned and retired on a rolling schedule. GA4 - event-level data, best exported to BigQuery rather than CSV, because sampling and thresholds distort large pulls. Search Console - query and page performance, available through the bulk export to BigQuery or the API for smaller volumes. Workspace - admin-level exports of org data, governed by admin roles and audit logs rather than marketing definitions. Each surface has a different format, refresh cadence and access model. A tool that handles Ads well may not touch Search Console bulk export at all. That is why the buying question is not "which tool exports Google data" but "which surfaces does it cover, and how does it reconcile them". Why the Numbers Diverge: Definitions, Timing and Consent The Melrose Arch gap is rarely a bug. Ads reports at click time with the longest attribution window. GA4 applies consent-mode modelling and session-based deduplication, so a user who converts across two sessions may be counted once or modelled rather than observed. The CRM reflects refunds and returns that were never back-fed to Google. Add time-zone mismatches - a property set to UTC versus a team reporting in SAST - and a month boundary alone can shift a day of revenue. Documenting these causes is the difference between a reconciled number and a monthly argument. Vetting a Third-Party Export Tool Against POPIA Under POPIA, exporting personal data to a third-party tool makes that vendor an operator, and section 21 requires a written contract with security safeguards. Ask four questions before signing: which OAuth scopes does the tool request (read-only versus write access); where does the data land geographically; does it retain raw event data and for how long; and can it answer a data-subject access or deletion request within a reasonable window? A tool that cannot answer these in writing is a compliance risk, not a shortcut. What to Compare on the Shortlist Score candidates on surface coverage (all five or a documented subset), export destination (cloud storage versus local download), scheduling and retry behaviour, credential handling, and total annual cost in ZAR including FX and VAT. A cheaper monthly headline can lose on the annual figure once connector fees and BigQuery storage are added.

Nov 7, 20265 min read

Electrical meter and fuse box on a white wall in Cape Town, South Africa, for energy monitoring or billing.

Google Ads

Google Account Activity Monitoring in South Africa: A Change-Forensics Playbook for Ad Accounts

The Sandton Scenario: A ROAS Drop, a Former Contractor, and a 2am Budget Rule A Sandton-based e-commerce brand sees ROAS tumble from 4.2 to 2.8 over a weekend. The team blames creative fatigue. Then someone notices a campaign budget was doubled at 02:13 on Saturday - by an account that still carried a former contractor's email. The contractor had been offboarded from payroll three months earlier, but nobody revoked their Google Ads access. This is not a login problem; it is a change-integrity problem. The same pattern repeats across South African marketing teams: a GA4 configuration change, a GTM tag paused, or a budget rule altered without a record of who did it. Monitoring Google account activity is how you rebuild that record. Warning: Monitoring logs can themselves contain personal information. Under POPIA, define a lawful purpose, tell staff what is logged, and set a retention limit. This article is not legal advice; consult counsel before implementing monitoring. What 'Google Account Activity Monitoring' Actually Means Across the Three Accounts in Play The phrase is overloaded. In South African ad teams it usually refers to one of three distinct surfaces, each answering a different question: Personal activity (My Activity): What a signed-in user did across Google services - searches, YouTube views, location history, ad personalisation. It is a consumer privacy dashboard, not an audit trail for business changes. Security and Workspace logs: Login events, admin actions, Drive changes, and the Security Investigation Tool. This answers “who accessed what, from where, and when” at the identity layer. Marketing change forensics: Google Ads Change history, GA4 Change history, and GTM Version history. This answers “what changed in the campaign or measurement setup, by which user, at what time.” The Sandton scenario lives in the third category, but you need the second to prove who the user was, and the first only if you are investigating a personal account’s broader activity. The table below compares the surfaces. Surface What it records Who can see it Retention Best for My Activity Personal searches, YouTube, location, ad personalisation The signed-in user (and admins only via investigation tools on some editions) User-set auto-delete (3, 18, or 36 months) Privacy hygiene, not campaign forensics Workspace Admin log events Admin actions, login events, Drive log events Workspace super admins and delegated admins Edition- and setting-dependent; check your Admin console Identity and access investigations Google Ads Change history Budget, bid, targeting, status changes with user and timestamp Anyone with Ads account access Rolling window; verify in-product for current length Attribution of performance shifts to specific edits GA4 Change history Admin edits to properties, data streams, key events GA4 admins and editors Limited; export or screenshot for long-term records Measurement configuration audits GTM Version history Container versions, tags, triggers, variables, workspaces GTM account users with publish rights Version history retained until deleted; workspaces are temporary Tracking pipeline forensics The Personal Trail: My Activity and Activity Controls Explained Without Fear-Mongering My Activity is where a user reviews and deletes their own Google service history. Activity Controls let them pause Web & App Activity, Location History, YouTube History, and Ad Personalisation, and set auto-delete at 3, 18, or 36 months. For a South African marketing team, this is relevant in two narrow cases: (1) a staff member uses a personal Gmail for work and you need to understand what data exists, and (2) an investigation requires the user to export their own activity. It is not a substitute for business-grade logging. Do not ask employees to hand over personal account credentials; instead, move work to Workspace accounts where admin logs apply. The Workspace Trail: Admin Log Events, Login Events and the Security Investigation Tool If your team uses Google Workspace, the Admin console under Reports > Audit and investigation is the identity backbone. Admin log events show who granted Ads access, changed a group, or altered an organisational unit. Login events show authentication attempts and suspicious sign-ins. The Security Investigation Tool (available on premium editions) lets you query these logs across users and time ranges. Use it to answer: did the former contractor’s account log in after offboarding, and from which IP range? Pair this with the Google Account “Recent security activity” page for individual users. This is the evidence layer that makes the marketing trail credible.

Nov 6, 20267 min read

Google Ads

Managing Google Account Billing in South Africa: The Payments Profile, VAT and Card Playbook

The Midrand Scenario: A Card Decline the Week of a Seasonal Push A Midrand direct-to-consumer brand, mid-way through a Black Friday build, sees its ads stop serving on Wednesday. Nobody touched the campaigns. The cause is a declined card on a Google Payments profile set up two years ago by a staff member who has since left. The card has expired and finance does not know which Google login owns the money layer. That is a billing-governance failure, and it is the problem this playbook addresses. Which Google Billing Are You Actually Managing? A Disambiguation Table South African finance teams regularly conflate three separate systems. Before changing anything, identify which one is on the credit card statement. Billing type What it charges Where it is managed Typical owner Google Ads Ad spend on Search, Shopping, PMax, YouTube Google Ads > Billing > Settings Performance marketer or agency Google Workspace Per-seat licence fees Admin console subscriptions IT or Workspace super admin Google Cloud Compute, storage, API usage Cloud console billing accounts Engineering This article covers the first row only: the Google Ads payments layer, where most South African budget surprises originate. The Payments Profile Is the Money Layer, Not the Login A payments profile is the standalone Google record holding the legal business name, billing address, currency, tax status and payment methods. It is not your Gmail login and not your Google Ads account. One profile can fund several Google products; one Ads account can move between profiles only within limits. This separation lets you hand ad-spend control to an agency without handing over the card, provided profile ownership is structured correctly. What Lives Inside a Payments Profile: Legal Name, Currency, Tax Status, Cards Four fields drive almost every reconciliation headache in South Africa: Legal name and address - must match the entity claiming the expense. Currency - the billing currency on every invoice. Tax status - whether a VAT number is attached. Payment methods - primary card plus, ideally, a secondary. Currency lock-in warning: the profile currency is fixed at creation. A ZAR profile cannot simply be switched to USD in place - you generally need a new profile. Set this deliberately on day one and confirm current rules in Google's documentation, since billing screens change. Automatic vs Manual Payments: Choosing by Cash-Flow and FX Exposure Automatic payments charge your card after you spend past a billing threshold or at month-end, whichever comes first. Manual payments are prepaid: you load credit, then spend it. For SA advertisers this is a cash-flow and FX decision as much as a convenience one. Factor Automatic payments Manual payments Cash-flow timing Pay after spend; less upfront cash Pay before spend; needs working capital FX exposure Rate set at charge date, varies monthly Rate fixed at top-up; predictable Risk of pause Higher if a card declines Lower; stops only when credit runs out A predictable ZAR budget line usually favours manual; a scaling account chasing demand favours automatic plus a funded backup card. See how this fits a wider reconciliation process in Prebo Digital's reporting approach . Entering a South African VAT Number and Downloading Tax Documents Services invoiced by Google Ireland typically carry VAT at the standard 15% rate, and a valid VAT number on the payments profile lets the tax treatment be reflected correctly on the tax document. Retrieve tax documents from Billing > Documents in Google Ads; statements live in the payments profile under Transactions. Download them monthly - older statements are easier to lose when staff change. Tax caveat: VAT treatment depends on your entity, VAT registration status and current rules. Treat this as a pointer to the right screens, not tax advice. Confirm with a registered tax practitioner and check the SARS VAT guidance .

Nov 6, 20266 min read

Back to Home

Get Google Ads Consultation

Speak with our Google Ads specialists. Free Google Ads account audit (worth R1,500).

GET FREE ADS STRATEGY