Manage User Roles for Matomo Tag Manager

Matomo Tag Manager (MTM) permissions are managed through specific user roles that determine what actions users can perform within MTM. If a user can see the Tag Manager interface but cannot use certain features, it is likely due to restricted permissions.

Understanding these roles helps with properly assigning roles to prevent unauthorised changes while enabling collaborative use of Tag Manager.

Edit User Permissions

1. As a super user, navigate to Matomo > System > Users to set up user roles for Matomo and Tag Manager.
   Read more about setting user roles for Matomo.

2. Click the edit icon next to the user’s name.

3. You can select all or individual websites to set the user’s roles. To apply the same permissions to multiple websites, select each site and use the Bulk Actions drop-down to choose the relevant user role.

4. To add Tag Manager user roles for each website, click in the Capabilities drop-down to display available user roles.

5. Select a user role and repeat the step for each Tag Manager permission you want to add.
   

Default Tag Manager Permissions by Website Permissions

Certain website permissions automatically grant specific Tag Manager permissions that cannot be revoked. However, all other Tag Manager permissions can be added as needed to customise user access.

• View: No default Tag Manager permissions are included but you can assign separate Tag Manager user roles. By default, users with view-only permissions can access the Tag Manager interface, view the container configurations, including tags, triggers, and variables. They are restricted from editing, deleting, publishing or exporting any component configuration.

• Write: By default, the Tag Manager: Write user role is assigned with Matomo Write Access.

• Admin and Super user: By default, Admin and Super user roles are granted full access to all Tag Manager permissions. This includes the ability to create, edit, publish, and manage containers, as well as advanced features like working with custom templates.

Tag Manager User Roles

You can assign the following roles according to the level of access a user should have, such as the ability to create tags, publish containers, or manage custom templates.

Tag Manager: Write

Users can configure and test key components of Matomo Tag Manager without needing publishing permissions. This role grants users the ability to:

• Create, edit, export and delete containers, tags, triggers, and variables.
• Enable the Preview and Debug mode.
• Export version configurations.

Tag Manager: Publish Live Container

Only authorised individuals can deploy live updates to the tracking setup. Note that users must have the Tag Manager Write permission before assigning this role. This role grants users the ability to:

• Publish containers to live environments.
• Review and approve changes made by other users with Write Access.

Tag Manager: Use Custom Templates

This role is suitable for developers or advanced users managing complex tracking requirements. Note that users must have the Tag Manager Write permission before assigning this role. This role grants advanced users the ability to:

• Create custom tag templates.
• Modify the configuration of custom templates used within containers.
• Create Custom JavaScript variables and Custom Request Processing Function variables.

When you update permissions for an existing user, these changes will only apply to the websites that currently exist in your Matomo account. Any new websites created in the future will not automatically inherit these permissions for the user.