Managing multiple ad accounts at scale: the agency playbook

TL;DR

An agency running paid media isn't managing one ad account — it's managing a matrix: clients × platforms, each cell with its own access model, billing relationship, conversion definitions, and failure modes. The matrix stays manageable under five disciplines. Access architecture: one agency-owned parent entity per platform (Google Ads Manager, Meta Business Portfolio, TikTok Business Center), connecting to client-owned assets through partner access — never personal logins, never shared credentials, never agency-owned client assets. Naming: one client slug, used identically on every platform and every internal tool. Access tiering + the quarterly audit: role-based levels per platform, reconciled against the actual team roster on a calendar, because off-boarded contractors with Admin are the standing security hole. Billing blast-radius control: know which accounts die together if one card bounces. Measurement coherence: standardized conversion definitions and one cross-platform spend table, because thirty accounts that each report their own version of truth aren't a portfolio — they're thirty arguments. Platform-specific mechanics live in the deep dives, starting with the Google Ads MCC playbook.

---

The failure mode is always the same shape, regardless of platform. The agency grows account by account, each one set up in whatever way was fastest that week: one on a founder's personal login, one inside the client's own Business Manager with a shared password in a spreadsheet, one in an inherited parent account named after an agency that no longer exists. At ten accounts this is friction. At thirty it's operational risk — and at the first contentious client offboarding, it's a legal conversation about who owns what.

Multi-account management isn't a platform skill. It's an architecture, and it has to be decided once, agency-wide, before the next account gets connected.

The access architecture: parent entities + partner access

Every major platform now has the same two-layer model, under different names:

Platform	Agency parent entity	Client-side asset holder
Google Ads	Manager account (MCC)	Client's Ads account
Meta	Business Portfolio (Business Manager)	Client's BM: ad account, Page, pixel/dataset
TikTok	Business Center	Client's advertiser account + pixel
LinkedIn	Business Manager	Client's ad account + Insight Tag
Microsoft Ads	Manager account	Client's account

The architecture that survives growth and offboarding is identical on all of them:

1. The agency owns exactly one parent entity per platform. All team access flows through it. No personal logins to client accounts, ever — a personal login is an access grant you can't audit, can't tier, and can't revoke when the person leaves.
2. The client owns their own assets — the ad account, the pixel, the page, the historical data. The agency connects via partner access from its parent entity. This is not generosity; it's self-protection in both directions. Agencies that create ad accounts inside their own parent entity for clients build a hostage situation that detonates at offboarding — the account history, the pixel's learning, and the audiences are trapped on the wrong side of the relationship. The clean-takeover version of this argument is the same one we make in the agency takeover migration guide: asset ownership follows the business that the asset measures.
3. Connections are revocable from either side, cleanly. When the engagement ends, the partner link is removed and both parties keep what's theirs. If removing the agency would break the client's tracking, the architecture was wrong.

The one legitimate exception: a brand-new client with no existing presence may need the agency to create the assets — create them in the client's entity (or create the client's entity first), not your own. Ten extra minutes at onboarding; weeks saved at offboarding.

One client slug, everywhere

Platforms default to whatever name the client typed in 2019, which is why every agency dashboard contains four accounts named "Marketing." Pick a slug per client — short, lowercase, stable — and apply it to the link name or account label on every platform, the same slug your CRM, task system, and reporting use. The payoff is mundane and constant: every cross-platform lookup, every report join, every "which account is this invoice for" question resolves instantly. The MCC post shows the Google-side convention; the point is that it's the same slug on Meta and TikTok.

Access tiers + the quarterly audit

Every platform offers role levels; every agency defaults to giving everyone the highest one. The portable tiering: admin for senior leads and finance only (user management + billing), standard/edit for the specialists who run campaigns, read-only for analysts and juniors, notification-only for client stakeholders where the platform supports it.

The discipline that actually matters is the quarterly access audit: pull the user list from each parent entity and each client asset, reconcile against the current team roster, revoke the drift. Run it as a recurring task with an owner, not an intention — in every audit we've run or seen, the findings are the same: one or two former contractors still holding admin on accounts that spend real money. This is the cheapest security work in the entire agency.

Billing: know your blast radius

Cross-platform, the billing choice is the same trade: client-direct (client's card on their account; agency touches no money) versus agency-consolidated (agency fronts spend, invoices the client). Consolidated buys a cleaner client experience and rebate opportunities at the cost of cash-flow exposure — and one failure mode that deserves its own sentence: when a consolidated card bounces, every account riding on it pauses simultaneously, cross-platform if you've consolidated broadly. Map which accounts die together before the Friday it happens. Backup payment methods on every parent entity, balance alerts on, and the strategic-tier-consolidated / everyone-else-direct hybrid is where most agencies sensibly land.

The operating cadence

Account count is exactly why ad operations run on beats rather than per-client heroics — the same batch-by-beat logic as the rest of the agency's department workflows:

• Weekly, batched by platform: the optimization pass (budgets, search terms, creative rotation) for all clients on one platform in one sitting — one mental model loaded once — plus a budget-pacing check against each client's monthly commitment. Pacing is the silent killer at scale: ten accounts each 12% over pace is real money nobody notices account-by-account.
• Monthly, per account: health check — billing state, access list deltas, conversion firing rates, audience freshness. Fifteen minutes per account when templated.
• Quarterly, per platform parent: the access audit above, plus structure review (orphan accounts, dead links, conversion library drift).

The checks are recurring, verification-shaped work — which means they belong in the task system as templates with owners, per the verification discipline, not in anyone's memory.

Measurement coherence: the portfolio view

Thirty well-run accounts still fail the agency if each reports its own version of truth. Two standardizations make a portfolio out of them:

1. Conversion definitions. Standardize what "purchase," "lead," and "qualified lead" mean — counting rule, attribution model, value source — and apply the standard per platform (Google's MCC-level conversion library is the canonical implementation; the MCC post covers it). Cross-client reporting on non-standardized conversions is a join on a homonym.
2. One spend table. Every platform's daily ad-level spend and performance data, exported into one BigQuery schema — the ads-data-to-BigQuery series is the build guide — refereed against GA4's independent count. This is what turns "each platform grades its own homework" into an actual portfolio view: blended CAC per client, platform exaggeration factors, cross-client benchmarks.

The structural record

Everything above produces structure: parent entities, partner links, ad accounts, pixels, conversion definitions, the pipelines that export them. At scale, that structure is exactly the thing nobody can hold in their head — which is why Phloz models it as a graph: every ad account is a node on the client's tracking infrastructure map, linked to the parent entity it inherits from and the conversions it depends on, with health states and last-verified dates. When a shared conversion action breaks or a customer list expires, the graph shows the blast radius instead of leaving it to Wednesday's ROAS drop to announce.

Start with the architecture decision — agency parents, client-owned assets, partner access, one slug — and enforce it on every new account from today. Migrate the legacy mess opportunistically, one account per quarterly audit. The platform-specific deep dives go from here: the Google Ads MCC playbook, the Meta Business Manager structure, and the budget pacing system. Or see pricing — per active client, which is the same axis this whole problem scales on.