Shopify Plus role migration: an acceptance audit for multi-store Google Ads operations

Shopify Plus organizations using paid acquisition should treat the unified staff model as a change requiring acceptance, not as proof that operations are ready. Shopify announced on June 11, 2026 that POS and admin staff management is now handled in Settings > Users. The company says existing users, permissions and roles were automatically migrated, but it also identifies an exception with operational consequences: authority to create, edit or delete roles is now organization-wide and was not automatically granted.

Shopify also says merchants can manage POS users and PINs from the unified area, assign multiple or custom roles, suspend seasonal staff without deleting their accounts, and give Shopify Plus staff access across multiple shops through one profile. Four high-trust POS roles are identified: POS Administrator, POS Device Setup, POS User Administrator and Organization POS Administrator. These are confirmed product facts. The audit design below is CreatikLab methodology for deciding whether the resulting access model is safe and usable for multi-store Google Ads work; Shopify does not claim that the update validates advertising operations.

A migrated account can still fail at the moment a commerce team needs to inspect a product page, correct promotional content, verify a shop-specific destination or obtain approval for a change. The useful question is therefore not whether a user appears in the new interface. It is whether an identified person can complete an approved task in the intended shop, while someone else retains responsibility for reviewing sensitive changes.

CreatikLab separates identity continuity from task readiness. Identity continuity asks whether the expected user, history and role record remain present. Task readiness asks whether access is sufficient, excessive or blocked for a defined workflow. For Google Ads operations, the test should start with real dependencies: which shop serves each campaign, who owns the destination experience, who can authorize commerce changes, and who investigates a mismatch. This framing avoids turning a permissions review into a list of usernames with no connection to campaign risk.

Build the audit around tasks that affect the route from ad click to commercial outcome. The following CreatikLab matrix is deliberately evidence-based. It does not prescribe Shopify permissions; each merchant must map the task to its own approved role design.

• Shop-to-campaign mapping | Evidence: campaign destination and responsible shop | Action: confirm the accountable commerce owner | Owner: paid media lead.
• Product or offer review | Evidence: test product record and rendered destination | Action: record whether access is sufficient, blocked or excessive | Owner: merchandising lead.
• Landing-page correction | Evidence: approved test change or non-production walkthrough | Action: verify request, execution and review boundaries | Owner: ecommerce manager.
• User-role administration | Evidence: current role inventory and change log | Action: separate assignment of existing roles from organization-wide role design | Owner: designated access administrator.
• Seasonal handover | Evidence: active, suspended and returning-user list | Action: confirm reactivation ownership and remove obsolete assignments | Owner: retail operations.
• Measurement incident | Evidence: named escalation path and reproducible issue | Action: route investigation without granting broad permanent access | Owner: analytics or measurement lead.

Use a simple decision rule: retain access only when a named business task, accountable owner and review path can all be demonstrated. If one element is missing, pause the assignment and document the gap rather than expanding authority to make the immediate problem disappear.

The central design decision is who may perform commerce work and who may redesign the access system itself. Shopify's update makes role creation, editing and deletion an organization-wide authority. CreatikLab therefore recommends treating that authority as a governance function rather than bundling it automatically with campaign management, merchandising or local shop administration.

Start with four responsibility layers: requester, executor, reviewer and access administrator. One person may hold more than one layer when the organization is small, but the overlap should be recorded and approved. A Google Ads specialist might identify a broken destination or inconsistent offer; that does not automatically mean the specialist should edit organization-wide roles. Conversely, an access administrator should not be assumed to understand campaign intent. The handoff must include the affected shop, requested task, urgency, evidence, rollback path and final verifier. This creates inspectable accountability without claiming that any particular role structure is universally correct.

1. Inventory people and profiles. Evidence: exported or reviewed user list. Action: identify duplicates, unknown users and missing owners. Owner: access administrator.
2. Map each paid campaign to the shop and destination it uses. Evidence: campaign-to-shop register. Action: flag ambiguous ownership. Owner: Google Ads lead.
3. Select representative tasks instead of testing every possible click. Evidence: approved task scripts for product review, destination correction, seasonal reactivation and escalation. Action: run tests without making unapproved production changes. Owner: ecommerce operations.
4. Inspect privileged authority separately. Evidence: list of people who can alter the role model. Action: confirm business justification and reviewer. Owner: organization governance lead.
5. Test assignment boundaries. Evidence: screenshots or logs showing whether an existing role can be assigned and whether broader role administration is restricted as intended. Action: remediate only the failed boundary. Owner: access administrator.
6. Reconcile seasonal users. Evidence: employment or engagement status supplied by the business. Action: suspend, reactivate or investigate according to approved policy. Owner: retail operations.
7. Record every exception. Evidence: issue, affected shop, business impact, decision and due owner. Action: prioritize by campaign dependency and exposure. Owner: audit lead.
8. Obtain acceptance. Evidence: signed or recorded approval from commerce, paid media and access owners. Action: publish the operating map and next review trigger. Owner: accountable ecommerce leader.

The checklist is complete only when each result has evidence. A statement such as access looks fine is not an acceptance test. A stronger record identifies the task, expected boundary, observed result, owner and corrective decision.

Do not claim that a permission change caused revenue, ROAS or lead quality to improve. Access is an operational control, and its direct measures should remain operational: percentage of critical task tests passed, unresolved access exceptions, privileged assignments without documented justification, time to route an incident, and changes completed with the required review. These indicators reveal whether the operating model is dependable; they do not establish media incrementality.

Keep campaign and business measurement in a separate layer. For ecommerce, compare order, revenue, cancellation, return or margin information only when the business has reliable definitions and data. For wholesale or lead-generating journeys, report raw enquiries separately from qualified leads. CreatikLab defines qualification with the client before analysis, using inspectable CRM evidence such as valid commercial fit, sales acceptance or progression to an agreed stage. Reconcile those outcomes with Google Ads conversion records, but label discrepancies rather than forcing the systems to match. The official Shopify announcement does not specify advertising measurement behavior.

• Do not assume automatic migration proves that every workflow still functions; test representative tasks.
• Do not assume a former shop-level role manager received organization-wide authority. Shopify explicitly says that broader authority was not automatically granted.
• Do not assume the person running Google Ads should control organization-wide roles; determine that through governance.
• Do not assume access to several shops is necessary merely because one profile can support it. Require a documented business task.
• Do not test with unapproved live edits. Use a controlled walkthrough or reversible test agreed by the merchant.
• Do not interpret a passed access test as proof that products, offers, feeds, destinations or conversion measurement are correct.
• Do not infer rollout details, pricing or eligibility beyond what Shopify states. The announcement does not provide those particulars.
• Do not promise commercial uplift from permission cleanup. The defensible outcome is a clearer, evidenced operating boundary.

A narrow audit is preferable to broad access granted for convenience. When a task fails, diagnose whether the cause is identity, role assignment, shop scope, approval design or missing ownership before changing permissions.

For this use case, a provider should deliver more than an account screenshot. Ask for a campaign-to-shop dependency map, a user and privileged-role inventory, representative task scripts, an exception register, a responsibility matrix, remediation priorities and a retest record. The Google Ads portion should inspect destination ownership, conversion governance and the process for resolving commerce-side incidents. Exact platform permissions should remain a merchant-approved decision.

Compare providers by the quality of their evidence and decision boundaries. A credible proposal explains what will be tested, which production actions are excluded, who must participate, how qualified outcomes are defined and how unresolved risks will be reported. It should separate confirmed Shopify capability from its own operating recommendations. It should also avoid guaranteeing ROAS, rankings or lead volume. Seniority is demonstrated when the provider can trace a campaign issue to an owner and an acceptance test, not when it requests the broadest possible access.

Begin with a Google Ads account audit scoped to produce a campaign-to-shop dependency map, critical access-path tests, a conversion and destination change-control review, and a prioritized findings register. This is the primary diagnostic deliverable; it is not a promise of traffic, ROAS or lead volume.

If the audit exposes decisions about ownership, multi-shop operating design or remediation sequencing, use senior Google Ads consulting as the next decision step. The Google Ads Expert route explains the authority bridge between diagnosis and accountable implementation. To continue with context before choosing a scope, tell Lia how many shops are involved, what changed after migration, which campaign task is blocked and how your business currently recognizes a qualified sale or lead.

What changed in Shopify staff management?

Shopify announced that POS and admin staff management is unified under Settings > Users. The update also introduced organization-level role options for Shopify Plus, support for multiple roles, seasonal staff suspension and named high-trust POS roles.

Were existing users and permissions migrated automatically?

Shopify says existing users, roles and permissions were migrated automatically. The important exception concerns authority to create, edit or delete roles: that authority is now organization-wide and was not granted automatically.

Why run an acceptance audit if migration was automatic?

Automatic migration confirms that records were moved; it does not prove that every person can complete the correct business task in the correct shop. CreatikLab recommends task-level tests, evidence capture and explicit ownership before relying on the new model during paid campaigns.

Should a Google Ads specialist receive organization-wide role authority?

Not by default. CreatikLab recommends granting only the access required for an approved task. The owner of organization-wide role administration should be selected through an internal governance decision, not inferred from a media role.

How should qualified leads be measured in this audit?

For lead-generating or wholesale journeys, define a qualified lead using agreed CRM evidence such as sales acceptance, valid commercial fit or progression to a meaningful stage. Report that separately from raw forms, calls or platform conversion totals.

What should a buyer expect from the Google Ads audit?

The scope should identify shop-to-campaign dependencies, test critical access paths, inspect conversion and landing-page change control, document owners and produce a prioritized remediation register. It should not promise a particular ROAS, ranking or lead volume.