Which permissions are needed to link GA4 to BigQuery?

Definition: Linking a Google Analytics property to BigQuery requires an Editor or above at the property level in Google Analytics and a Google Cloud identity with the project permissions required for project discovery, IAM policy checks, and BigQuery API checks. After linking, the BigQuery project receives an Analytics link resource identity.

Key facts

• Google requires an Editor or above role at the Google Analytics property level to link the property to BigQuery, according to its BigQuery Export setup guide.
• The linking email address must have OWNER access to the BigQuery project.
• The guide calls five project and service permissions the minimal set for creating the link.
• Google says OWNER is a superset of those permissions.
• The link's built-in resource identity is added to the BigQuery project with the BigQuery User role, roles/bigquery.user.

Which Google Analytics role is required?

The Google Analytics role is evaluated at the property level. The account used in Analytics Admin must be an Editor or above on that property. This is separate from access to the Google Cloud project, so a property editor who lacks the required Cloud access cannot complete the link.

The setup flow starts in Admin, under Product Links, then BigQuery Links. The guide requires a signed-in Google Account and uses the property selector when the last opened property is not the intended one.

Which Google Cloud permissions are required?

Google's documented minimal set covers one project lookup, two IAM policy operations, and two checks for the BigQuery API. The permissions are:

resourcemanager.projects.get
resourcemanager.projects.getIamPolicy
resourcemanager.projects.setIamPolicy
serviceusage.services.enable
serviceusage.services.get

The first permission gets the project. resourcemanager.projects.getIamPolicy gets a list of permissions, while resourcemanager.projects.setIamPolicy checks whether the user can create the link on that project. serviceusage.services.enable enables the BigQuery API, and serviceusage.services.get checks whether that API is enabled. Google's guide describes OWNER as a superset of this set.

Google Cloud's BigQuery IAM roles and permissions documentation, updated 14 October 2026, explains that predefined roles contain permissions. Its entry for BigQuery User, roles/bigquery.user, says that the project-level role permits jobs, including queries, and creation of new datasets. That role is relevant to the resource identity created for the link.

What should be checked after the link is created?

The Analytics guide says that linking amends the BigQuery project's IAM policy for the new Analytics BigQuery link's built-in resource identity. The identity appears on the BigQuery link details page. In Google Cloud Console, the IAM policy should show the identity as a project member with BigQuery User, roles/bigquery.user.

The setup page also documents two policy conditions that can prevent creation: an organization policy can prohibit export to the United States, or it can prohibit service accounts from the domain used for the export. Those checks concern the selected Cloud project and its organization policies.

How does the permission split affect setup?

The link form lets the operator choose a BigQuery project, select a data location, configure data streams and excluded events, choose Daily or Streaming export, and submit the settings. The permissions above apply to creating the link itself. Later changes to data streams or excluded events still require Editor or above at the Analytics property level and OWNER access to the BigQuery project.

Related terms

• GA4 traffic acquisition
• How do I query AI referral sessions in the GA4 BigQuery export?
• Where is the page referrer stored in a GA4 BigQuery export?

FAQ

Do you need both a Google Analytics role and Google Cloud access?

Yes. You need Editor or above at the Analytics property level and an email address with OWNER access to the BigQuery project. The setup guide also lists the minimal Cloud permissions individually.

Can a property Editor create the link without OWNER access in Cloud?

No. The Analytics role and the Cloud project permission check are separate requirements. The documented alternative is an identity that has the listed minimal permissions, while OWNER covers them as a superset.

Where can you verify the Analytics link identity?

Open the BigQuery link details in Analytics, then inspect the Google Cloud project IAM policy. Google says the built-in resource identity should be a project member with roles/bigquery.user.

Sources

1. Google Analytics Help, "Set up BigQuery Export", n.d.
2. Google Cloud, "BigQuery IAM roles and permissions", 14 October 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer