Multi-party approvals (MPA)

Multi-party approval (MPA) is a security feature for a Google Ads account designed to protect your account from unauthorized activity by requiring a second account administrator to verify sensitive changes. Sensitive actions like adding users or changing user roles prompt other administrators of your account to approve these changes.

This guide explains how multi-party approval works and how to manage multi-party approval requests in your account.

Get started with multi-party approval

Multi-party approval secures your account by requiring another administrator's approval for sensitive actions. This can help to block hijacking attempts and unauthorized actions from occurring on your account.

Sensitive actions like adding a new user, removing an existing user, or changing user roles require approval from a second administrator to complete. As security needs evolve, additional actions may also require this approval process.

About the approval process

When you make a sensitive change to a Google Ads account, a request is sent to all administrators within the hierarchy for approval. All eligible account administrators within your hierarchy receive an in-product notification to review these changes.

Direct administrators and owner managers of the requester receive individual notifications for each request, while others in the hierarchy receive a combined digest for multiple requests. Since emails aren't sent for these approvals, it's important to check your in-product notifications regularly.

Account administrators have 20 days to approve or reject a request before it expires. Requests automatically expire if they aren't acted upon within 20 days. If the action is still necessary, restart the process to generate a new approval request.

The following request statuses show next to actions in the Google Ads UI and map to the corresponding status enum values in the Google Ads API:

  • Complete (APPROVED): The action was reviewed and approved by an administrator. The action takes effect and the initiator is notified.
  • Denied (REJECTED): The action was reviewed and rejected by an administrator. The proposed action is blocked.
  • Revoked (REVOKED): The original requester cancelled the pending request before another administrator acted on it.
  • Expired (EXPIRED): If no action is taken within 20 days, the request times out and the action is rejected.
  • Pending (PENDING): The request is awaiting review by another eligible administrator.

Review multi-party approval requests

You can review change requests on the Access and security page in your Google Ads account.

Approve or reject a request

After a request is submitted, another administrator must review and accept the request for it to take effect. Here's how to review your pending requests:

  1. In your Google Ads account, go to Admin > Access and security.
  2. In the Pending invitations menu, select Review request.
  3. Review the details of each request. Select Approve to approve the request, and Deny to reject it. You can manage added users in the Users tab under Access and security.

Revoke a request

If you need to revoke a pending request that you initiated, follow these steps. Note that you can only revoke a request if it hasn't already been approved or denied by another administrator.

  1. In your Google Ads account, go to Admin > Access and security.
  2. In the Pending invitations menu, select Revoke Request next to a request you'd like to cancel.

This deletes the notifications associated with the request for all other account administrators.

Supported actions in the Google Ads API

The Google Ads API supports multi-party approvals for three actions:

You can resolve or revoke a multi-party authorization request using the MultiPartyAuthReviewService.

Approve or reject a request

Another administrator must review and accept or reject the request for it to take effect. To approve or reject a request, call the MultiPartyAuthReviewService.ResolveMultiPartyAuthReview method using the credentials of the user who is authorized to resolve the request. This is typically a second administrator of the account.

Populate a ResolveMultiPartyAuthReviewOperation object with:

  • multi_party_auth_review: The resource name of the multi-party review request to be resolved.
  • new_status: Set to APPROVED to approve the request, or REJECTED to reject the request.

Note that only an authorized user other than the original requester can approve or reject a request.

Revoke a request

If you need to revoke a pending request that you initiated, you can do so by calling the MultiPartyAuthReviewService.ResolveMultiPartyAuthReview method.

This operation is similar to the approval workflows, except that this must be done with the credentials of the user who created the original request. Populate a ResolveMultiPartyAuthReviewOperation object with:

  • multi_party_auth_review: The resource name of the multi-party review request to be revoked.
  • new_status: Set to REVOKED.

Retrieve pending requests

You can retrieve the list of pending multi-party approval requests by running the following query using the GoogleAdsService.Search or GoogleAdsService.SearchStream method:

SELECT
  multi_party_auth_review.resource_name,
  multi_party_auth_review.multi_party_auth_review_id,
  multi_party_auth_review.review_status,
  multi_party_auth_review.creation_date_time,
  multi_party_auth_review.request_user_email,
  multi_party_auth_review.operation_type,
  multi_party_auth_review.justification,
  multi_party_auth_review.target_resource,
  multi_party_auth_review.customer_user_access_review.old_customer_user_access,
  multi_party_auth_review.customer_user_access_review.new_customer_user_access,
  multi_party_auth_review.customer_user_access_invitation_review.new_customer_user_access_invitation
FROM multi_party_auth_review
WHERE multi_party_auth_review.review_status = PENDING
Previous
Credential management