Client Onboarding Software - What Agencies Actually Need

Client onboarding software: what it has to do for an agency

Client onboarding software collects the contract, the brief and the assets in one place. For a marketing agency it also has to carry the part that actually delays the work: platform access. That means one row per asset, the exact permission level requested, the click path for the client, and a verified date. If your tool does not track access per asset, it is a form builder, not onboarding software.

That distinction matters because access is where the first fortnight goes. The contract is signed on Monday and the campaigns do not launch on the first of the month, because someone is on their fourth email about a Google Ads customer ID and the client has sent a screenshot of the wrong settings page.

The one rule everything else follows

The client owns the assets. The agency is granted access to them.

The client creates the container, whether that is a Meta business portfolio, a TikTok Business Center, a Google Tag Manager account or a Google Ads account. The client creates or claims the assets inside it. The client grants your agency partner access or links your manager account. You then assign your own staff from inside your own container, without the client ever touching your staffing.

On day one the opposite is faster, which is why almost nobody does it. On Meta, whichever business portfolio creates or claims an asset owns it, and only one business can own a Page. Meta publishes self-serve ownership transfer for catalogues and apps. It publishes none for Pages or ad accounts, so plan on that being a conversation with support rather than a button. TikTok's documentation states an ad account transfer cannot be reversed once complete. Google Tag Manager has no self-service ownership transfer at all, and Google's own guidance is that the organisation whose tags are being managed should create the account.

If your existing client book already breaks this rule, do not fix it during a notice period. Add an asset owner column to your register and schedule migrations at a quarterly review, while everyone is still happy.

The steps, in both directions

Four platforms cover most of the delay on a typical onboarding. If your stack is wider than this, the same both-directions structure for thirteen platforms, including Search Console, Tag Manager, Pinterest, Shopify and Klaviyo, is in our complete guide to client account access for agencies.

One caveat before the click paths: Meta and Google rename these screens regularly. Treat the menu names below as the shape of the flow rather than a fixed script, and check the label in front of you if it does not match.

Meta: Facebook Pages, Instagram and ad accounts

What the client clicks (client-initiated). Open Meta Business Suite, then Settings. Under Users, click Partners, then Add, then "Give a partner access to your assets". Enter your agency's business portfolio ID, then Next. Select the assets to share and set the access level on each. Click Assign assets. The whole handshake is a portfolio ID, which is a number, not a credential.

What the agency clicks (agency-initiated). In your own portfolio, Settings, Partners, Add, then "Ask a partner to assign you their assets". Click Get started, then enter the client's email address and their business portfolio ID. Both are required, which catches people out, because the client-initiated flow needs only the ID. Choose roles and asset types, then Send request. An admin on the client side must approve. Nothing happens unilaterally.

A Page in no portfolio at all is a different route: Settings, Accounts, Pages, Add, then "Request shared access to a Facebook Page". Note the prerequisite Meta does not advertise, which is that you must already have a primary Page in your own portfolio before that option works. An agency with an empty portfolio cannot use it.

Instagram needs to be a professional account. The client adds it under Settings, Instagram accounts, then shares it to your portfolio through the same Partners flow.

Google Ads

Prefer the manager account link over individual email invites. Individual invites survive a staff member leaving your agency and have to be cleaned up client by client; a manager link is revoked once, in your own user list, and it cascades across every client. The mechanics of the manager account itself, including the linking errors you cannot resend your way out of, are covered in our guide to the Google Ads manager account and how agencies should structure an MCC.

You need the client's 10-digit customer ID, shown in the top right of their Google Ads account. You send the link request from your manager account and an admin on the client account accepts it.

The step people miss: linking is not ownership. Google states that a linked manager account does not have ownership of the client account by default, and ownership has to be turned on from inside the client account, at Admin, Access and security, Managers, then the Owner column dropdown. Without it, actions such as adding users, reactivating the account or unlinking another manager may need someone to sign in to the client account directly. Only one manager account can hold ownership, so if the client works with two agencies, decide which one up front.

Google Business Profile

The client opens Business Profile settings, then People and access, clicks Add, enters your work Google account, chooses Manager, and sends. Then, and this is the step everyone skips, they go back to People and access and confirm your name has moved out of PENDING. Pending invitations sit silently and the email frequently never lands.

Two time windows get confused constantly. A current owner has 3 days to respond to a Request Access. A newly added owner or manager must wait 7 days before they can manage all features, including removing other users or setting a primary owner. That clock runs from the moment the invitation is accepted, not from the moment it was sent, so a slow acceptance pushes the whole handover back. Never plan an ownership flip for the day someone is added.

Google Analytics 4

Admin, then under Property click Access Management, then the plus button, then Add users. Grant at property level, never account level. Roles inherit downward and effective permissions are the most permissive that apply, so account-level Editor makes your agency Editor on every property in that account, including brands you were never engaged to touch. If you are already sitting at account level, remove that row entirely and re-add per property rather than trying to reduce it.

Which permission level to ask for

The instinct is to ask for the maximum once, so you never have to ask again. It is the wrong default for three reasons: it usually includes payment methods and user management you have no business holding, it makes you look like a risk to a client who is already nervous, and on several platforms the top level lets you lock the client out of their own asset.

A few of these are worth stating plainly to a client, because they sell the arrangement. Klaviyo Manager gives your agency full working access while leaving export of recipient activity and address lists off the table. Meta Advertiser gives your media buyer complete campaign control and no sight of payment methods. Google Business Profile Manager can post, reply to reviews and edit business information but cannot add or remove people or delete the profile.

Where a platform's role names have moved, ask for the capability rather than the label. Meta in particular has been shifting from named roles toward task-based partial access, and a client reading a two-year-old checklist will not find the option you named.

What goes wrong

A pending invitation looks exactly like success from the client's side. They clicked the thing and they told you it is done. Nothing flags that you never accepted or that the email went to spam. On Meta specifically, granting Facebook access requires the person granting it to enter their own Facebook password and the recipient to accept an emailed invitation, so access is not live until that acceptance happens. Verify every grant the same day by logging in yourself and confirming both that the asset is visible and that the actions you need are available.

LinkedIn ads that will not build. Almost always a missing paid media admin role on the Page, specifically Sponsored Content poster, not the ad account role you have been re-checking. LinkedIn requires permission on both surfaces at once: a Page role plus a role on the associated ad account. Page access, ad account access and Business Manager sharing are three separate systems, and our guide to LinkedIn Business Manager for agencies untangles which one you are actually stuck in.

TikTok members who can see nothing. Inviting someone to a Business Center grants zero asset access. There is a separate Grant access step under Users. Treat an invite without a grant as an unfinished onboarding.

Nobody knows who currently has access. Before you request anything, ask the client to pull the existing user list on each platform. Half the time it finds a previous agency still holding admin, which is a conversation the client needs to have anyway.

Then the traps that only surface at the end:

Search Console verification survives removal. Deleting a user row does not remove a verified owner, because verification comes from a token, not the user list. On offboarding, clear the unused ownership tokens: the HTML file, the HTML tag, the DNS TXT record, the analytics or tag manager link behind it.

Google Ads billing must change before you unlink, never after. If the account is on monthly invoicing and the manager being unlinked is the paying manager, the account stops serving.

Revoking a TikTok partner can stop that partner's live campaigns. TikTok's own guidance on unsharing assets is that ads depending on the shared asset get paused, and it tells you to stop the affected campaigns yourself first. Reassign or pause deliberately rather than discovering it after the fact.

Revoking access is not revoking a credential. If anyone ever had a shared password, removing them from the vault changes nothing. Every departure is a rotation trigger.

Where the CRM fits

Once access is in place, the day-to-day problem changes shape. You are not chasing permissions any more, you are working nine clients' messages without logging into nine accounts. Inflowave is an agency CRM built for that stage: one inbox across Instagram, Facebook, WhatsApp, SMS, email and voice, an isolated workspace per client, role-based permissions so a freelancer sees one account rather than the book, pipelines, and white-label dashboards for client reporting. Plans start at $27 a month, with the agency plan at $149 a month.

It is worth saying what that does not replace. Platform permissions still live on the platforms. A CRM controls what your team sees inside your own system, which is the other half of the same problem and the half most agencies never write down.

FAQ

What is client onboarding software?
Software that carries a new client from signed contract to work starting: intake forms, documents and signatures, kickoff tasks, and, for an agency, the access requests for every platform you will manage. Generic customer onboarding tools handle the paperwork well and the access half barely at all.

Do I need dedicated software, or will a spreadsheet do?
Below roughly ten clients, a spreadsheet or a shared doc works, provided it has one row per asset rather than one row per client. It fails at the point where nobody can say which freelancer holds what. That is when onboarding software for small business teams starts paying for itself, less for the forms than for the register and the reminders.

What should be on an agency client onboarding checklist?
One row per ad account, analytics property, tag container, Page, pixel and Business Profile location. Each row carries the permission level requested, the named person on your side who will hold it, the date requested and the date verified working. Send the whole pack at once with the exact click path for each item. A client who gets one document with eleven rows does it in an afternoon. A client who gets eleven emails over three weeks takes three weeks.

Should I ever accept a client's password?
No. It defeats their two-factor authentication, destroys the audit trail so nobody can establish who paused a campaign, hands you their unrelated accounts and payment methods, and triggers security checkpoints on unfamiliar devices that cost more time than the delegation would have. Make it a written policy in your onboarding document rather than a preference. Most agencies cannot say "we will never ask for your password", so say it.

My client is not the admin of their own account. Now what?
This is where onboarding actually dies, usually because a coordinator claimed the asset on a personal account years ago. On Google Business Profile, start the Request Access flow and its 3-day clock on day one, not week three. On Meta, a legacy standalone Page needs a business portfolio created before partner access is possible at all, and a personal ad account sitting outside any portfolio has no partner-sharing mechanism at all. The answer is almost never a workaround. Their account structure is broken and fixing it is part of the value you provide.

How long should agency onboarding take?
The platforms are rarely the constraint. If the access pack goes out complete on day one and every grant is verified the same day it arrives, most books of assets are done inside a week. The three-week version is a sequencing failure, not a platform failure.