The short answer
For a dental group of about 3 to 50 or more offices, change marketing agencies only after the group can open the accounts the public marketing depends on. The group should be the domain registrant, an owner of each Business Profile and of its business group, an Admin on the Google Ads client account, an Administrator on the GA4 property, an administrator in Tag Manager, and a verified owner in Search Console. The agency is a manager, or a manager account the group can unlink. Call-tracking numbers should be numbers the group can port, or the group should already know which numbers will be replaced. If public URLs will change, each old address needs a permanent redirect before the old site goes away. None of the source pages below publish a handoff calendar, a recovery percent, or a ranking bonus for doing this.
This guide is for a marketing lead at a dental group that is leaving one firm, hiring another, or bringing the work in house. It covers the ownership inventory and the handoff order. Ask counsel to review exit terms before you sign. The map of which guide covers each ongoing job is marketing a multi-location practice or DSO. Questions to score a firm before you hire one are in how to choose a DSO dental marketing company. The planning page for brand and reporting is DSO and multi-location marketing.
Ownership inventory
Read one asset at a time. Three offices and fifty offices use the same test. A larger group has more rows on the sheet. It does not get a different owner. "The agency has a login" is not the same as "the group can remove that login."
Domain registrar and DNS
Who should own it
The dental group is the Registered Name Holder on each domain, and a group login can edit nameservers or the DNS zone.
How to verify
Open the registrar account and compare the registrant name with the group. Confirm a group login can see the nameserver or the zone records. Ask the registrar for the AuthInfo code only when you are ready to move the domain.
Risk if the agency owns it
The agency can refuse a registrar transfer, point DNS at a host you cannot open, or leave the domain to expire. ICANN's transfer policy gives the Registered Name Holder the authority to approve a move to another registrar.
Website host, repository, and CMS
Who should own it
A group administrator on the host, on the code repository, and in the CMS. The group can export a copy of the site.
How to verify
Sign in with a group email and publish a harmless draft, or export the site, without asking the agency for a password.
Risk if the agency owns it
If the only admin is the agency, the group cannot publish, cannot move the site, and cannot keep redirect rules after that login goes away.
Business Profile owners, managers, business group, and organization
Who should own it
A person at the group is an owner on each location, and the group knows who the primary owner is. The group is primary owner of its business group. The agency is a manager, unless a written reason says otherwise. An agency organization is not a substitute for those owners.
How to verify
On each profile, open People and access and read the role next to each email. In Business Profile Manager, open the business group and read who the primary owner is. A new owner cannot take primary ownership during their first 7 days.
Risk if the agency owns it
A manager cannot add or remove users and cannot remove the profile. The primary owner cannot leave until primary ownership moves. If the only path in is the agency's organization, the group cannot invite the next firm or remove the last one.
Google Ads client account and manager link
Who should own it
A person at the group has Admin access on the client account. The agency uses a manager account (MCC) link. That manager is the owner of the client account only when it needs to change users.
How to verify
In the client account, open Access and security. Confirm a group email is Admin. Open Managers and see whether a manager is marked Owner. Admin is the access level that can accept a manager link and unlink one.
Risk if the agency owns it
If a manager created the client account, that manager becomes the owner automatically. An owner manager's admins can remove users. Without a group Admin, the group cannot unlink that manager. A client account has only one direct manager.
Google Analytics 4 property
Who should own it
A person at the group is an Administrator on the Analytics account or on each property the group uses.
How to verify
Open Admin, then access management, and read the role. An account-level role applies to every property in that account. Administrator is the role that can add and remove users.
Risk if the agency owns it
Editor can change settings and cannot manage users. If the only Administrator is the agency, the group cannot remove that user or add the next firm.
Tag Manager account and containers
Who should own it
At least two group Google accounts are Administrators on the Tag Manager account, and a group user can Publish the containers the site uses.
How to verify
In Admin, open User Management for the account and for each container. Read Admin versus User, and Read, Edit, Approve, or Publish on the container.
Risk if the agency owns it
Google's help says the account should be managed inside the organization, not by an outside agency, and that a sole administrator can leave you locked out. A container with no administrator is deleted. Users who still have read access then have 30 days to export it from the trash.
Search Console properties
Who should own it
A person at the group is a verified owner of each property the group intends to keep. Delegated owner is not a substitute for one verified owner.
How to verify
In Settings, then Users and permissions, read Owner, Full, or Restricted. A verified owner proved control with a token on the site. Only an owner can add users.
Risk if the agency owns it
A property with no verified owner is a property nobody can open. If every verified owner is removed, remaining users lose access after a grace period Google describes without a length, while data collection continues. A verified owner can return if their token is still on the site.
Call-tracking numbers and porting
Who should own it
The group is the account holder on numbers patients and profiles already use, or the group has a written list of numbers it cannot port and the replacements.
How to verify
Match the name and address on a recent bill to the group. The FCC's portability questions say the new provider confirms identity from that account. If the bill is in a vendor's name, the group is not the account on that bill.
Risk if the agency owns it
A number the group cannot port leaves with the vendor. The profile phone and the sign then point at a line the group does not control. Porting does not erase a balance or an early termination fee, and the old provider cannot refuse a valid port for that reason.
Review platform logins
Who should own it
Each review site the group uses has a login on a group-controlled email, and that login can see every office.
How to verify
Sign in and count locations. There is no single transfer flow that covers every review site, so the check is whether the group can open the account without the agency's inbox.
Risk if the agency owns it
If the only login is the agency, the group cannot remove that user, answer a review, or add the next firm on that site.
301 redirects, if URLs change
Who should own it
The group holds the map from each old URL to the correct new URL, and the rules live on a host the group can still edit after the agency leaves.
How to verify
Request an old URL and confirm a permanent server-side response to the matching new page. If the public URLs are not changing, there is no map to verify.
Risk if the agency owns it
A host you cannot open can drop the rules. Google uses a permanent redirect as a signal that the target should be the canonical URL, and it is most likely to read a server-side redirect as you intend. A script-only jump can be missed.
| Asset | Who should own it | How to verify | Risk if the agency owns it |
|---|---|---|---|
| Domain registrar and DNS | The dental group is the Registered Name Holder on each domain, and a group login can edit nameservers or the DNS zone. | Open the registrar account and compare the registrant name with the group. Confirm a group login can see the nameserver or the zone records. Ask the registrar for the AuthInfo code only when you are ready to move the domain. | The agency can refuse a registrar transfer, point DNS at a host you cannot open, or leave the domain to expire. ICANN's transfer policy gives the Registered Name Holder the authority to approve a move to another registrar. |
| Website host, repository, and CMS | A group administrator on the host, on the code repository, and in the CMS. The group can export a copy of the site. | Sign in with a group email and publish a harmless draft, or export the site, without asking the agency for a password. | If the only admin is the agency, the group cannot publish, cannot move the site, and cannot keep redirect rules after that login goes away. |
| Business Profile owners, managers, business group, and organization | A person at the group is an owner on each location, and the group knows who the primary owner is. The group is primary owner of its business group. The agency is a manager, unless a written reason says otherwise. An agency organization is not a substitute for those owners. | On each profile, open People and access and read the role next to each email. In Business Profile Manager, open the business group and read who the primary owner is. A new owner cannot take primary ownership during their first 7 days. | A manager cannot add or remove users and cannot remove the profile. The primary owner cannot leave until primary ownership moves. If the only path in is the agency's organization, the group cannot invite the next firm or remove the last one. |
| Google Ads client account and manager link | A person at the group has Admin access on the client account. The agency uses a manager account (MCC) link. That manager is the owner of the client account only when it needs to change users. | In the client account, open Access and security. Confirm a group email is Admin. Open Managers and see whether a manager is marked Owner. Admin is the access level that can accept a manager link and unlink one. | If a manager created the client account, that manager becomes the owner automatically. An owner manager's admins can remove users. Without a group Admin, the group cannot unlink that manager. A client account has only one direct manager. |
| Google Analytics 4 property | A person at the group is an Administrator on the Analytics account or on each property the group uses. | Open Admin, then access management, and read the role. An account-level role applies to every property in that account. Administrator is the role that can add and remove users. | Editor can change settings and cannot manage users. If the only Administrator is the agency, the group cannot remove that user or add the next firm. |
| Tag Manager account and containers | At least two group Google accounts are Administrators on the Tag Manager account, and a group user can Publish the containers the site uses. | In Admin, open User Management for the account and for each container. Read Admin versus User, and Read, Edit, Approve, or Publish on the container. | Google's help says the account should be managed inside the organization, not by an outside agency, and that a sole administrator can leave you locked out. A container with no administrator is deleted. Users who still have read access then have 30 days to export it from the trash. |
| Search Console properties | A person at the group is a verified owner of each property the group intends to keep. Delegated owner is not a substitute for one verified owner. | In Settings, then Users and permissions, read Owner, Full, or Restricted. A verified owner proved control with a token on the site. Only an owner can add users. | A property with no verified owner is a property nobody can open. If every verified owner is removed, remaining users lose access after a grace period Google describes without a length, while data collection continues. A verified owner can return if their token is still on the site. |
| Call-tracking numbers and porting | The group is the account holder on numbers patients and profiles already use, or the group has a written list of numbers it cannot port and the replacements. | Match the name and address on a recent bill to the group. The FCC's portability questions say the new provider confirms identity from that account. If the bill is in a vendor's name, the group is not the account on that bill. | A number the group cannot port leaves with the vendor. The profile phone and the sign then point at a line the group does not control. Porting does not erase a balance or an early termination fee, and the old provider cannot refuse a valid port for that reason. |
| Review platform logins | Each review site the group uses has a login on a group-controlled email, and that login can see every office. | Sign in and count locations. There is no single transfer flow that covers every review site, so the check is whether the group can open the account without the agency's inbox. | If the only login is the agency, the group cannot remove that user, answer a review, or add the next firm on that site. |
| 301 redirects, if URLs change | The group holds the map from each old URL to the correct new URL, and the rules live on a host the group can still edit after the agency leaves. | Request an old URL and confirm a permanent server-side response to the matching new page. If the public URLs are not changing, there is no map to verify. | A host you cannot open can drop the rules. Google uses a permanent redirect as a signal that the target should be the canonical URL, and it is most likely to read a server-side redirect as you intend. A script-only jump can be missed. |
Transition order
Four phases, in this order. No phase has a required length except the review window named below, and that window is not a promise about rankings or revenue. ICANN's transfer policy does name its own intervals for domain moves. Those are constraints to check on the domain, not a project calendar for the rest of the handoff. A registrar may deny a transfer requested within 60 days of the creation date shown in registry records, within 60 days after a registrar-to-registrar transfer, and during a 60-day lock after a change of registrant when the registrar imposed that lock and the holder did not opt out. The registrar must provide the AuthInfo code within five calendar days of the holder's first request if the holder cannot generate the code in the account, and must not refuse the code only because of a payment dispute.
1. Before notice
Build the inventory while the current logins still work. Export the user lists, a copy of the site, the Tag Manager container, and the URL list. Do not change DNS, primary ownership, or the live URLs in this phase. The point is to learn which assets the group cannot open, before anyone is asked to leave.
2. Overlap window
Add the group as owner or Admin on anything the inventory showed was missing, and add the incoming firm as a manager or a non-owner user. Leave the outgoing firm in place until a group login works.It lasts while both firms still have the access the inventory names. Do not point DNS at a new host, and do not change public URLs, until a redirect map exists for every address that will change.
3. Cutover
Move primary ownership of each Business Profile to a group user who is already past the 7-day wait. On the Ads client account, confirm a group Admin, then unlink the outgoing manager or turn off its ownership. Move the registrar login and the DNS login. If URLs change, publish permanent server-side redirects from the map. Start a number port only for a line whose bill already names the group. Contact the new provider to start, and do not cancel the old line first.
4. First 30 days
Use the first 30 days after cutover as a review window, not as a forecast. Rankings, call volume, and spend are not predicted here. Check that each office still has a report row, that a group owner is still on each profile, that old URLs still answer with the permanent redirect if URLs changed, and that the profile phone still reaches that door. Confirm Tag Manager still has two group administrators and Search Console still has a verified owner at the group.
Profiles, groups, and organizations
Google's owner and manager help says a Business Profile can have several owners and only one primary owner. Owners can add or remove users and can remove the profile. Managers, which used to be called site managers, can do most of the daily editing and cannot add or remove users or remove the profile. You cannot add a Google Group as an owner or a manager. The primary owner cannot remove themselves until primary ownership moves to someone else, and the profile needs at least one other owner or manager before that move is possible. A person added as an owner or a manager has to wait 7 days before they can delete the profile, remove other users, or transfer primary ownership. An attempt inside those 7 days returns an error.
Transferring primary ownership is how the listing's info, including reviews, stays on the same profile when the person in charge changes. Only owners can change roles, and only the primary owner can hand off primary ownership. Do that from People and access, edit the user, and choose primary owner. The day-to-day role sheet for a group, including bulk verification when you have ten or more eligible profiles of the same business, is in profile governance.
A business group, which Google previously called a business account, is the folder for a set of profiles. It can have several owners and only one primary owner. Owners can add or remove group users, delete the group, and transfer it. Managers can add, edit, and delete the profiles in the group, including profiles added later, and cannot add or remove people. The primary owner of the group cannot remove themselves until they transfer that role. Put the group's profiles in a business group the group owns. Do not leave them only inside a folder the agency can delete.
An organization account is the Business Profile type Google describes for a third party that manages locations for businesses it does not own. The organization can manage a location only after the location grants permission. Each company is allowed one organization. That structure belongs to the firm. It is not the group's owner list. Google's third-party policy says the business keeps ownership or co-ownership at all times, that the business decides whether a partner is a co-owner, a manager, or has no access, and that passwords are not shared. If the partner created the profile, the business is made the owner and the partner the manager. If the profile already existed, the business invites the partner as a manager. Within 7 business days of notice that the relationship is ending, the partner has to let the business remove the partner's Google account and take exclusive control.
A name change is a different project. If the switch happens at the same time as an acquisition, choose the public name in rebrand, co-brand, or keep the local name before you edit the profile name. Changing agencies does not, by itself, require a new name on the sign.
Ads, analytics, tags, and Search Console
A manager account, which the help title still calls an MCC, is a separate Google Ads account for viewing and managing other accounts from one sign-in. It is not an upgrade of the client account. Users of the client account can still sign in, and a user with administrative access can unlink the manager. The manager cannot change the client account's own sign-in. Google also says the manager can be given ownership, which is what lets it manage user access on the client account.
Ownership of a client account is separate from a plain link. A client account can have only one owner. If the manager created the account, that manager becomes the owner automatically. Linking an account that already exists does not grant ownership unless an Admin on the client turns it on. Ownership does not take the client's data away, and the client can remove it by unlinking. Users on the client account cannot turn ownership off without unlinking, and turning ownership off requires at least one Admin user still on the client.
Admin users on an owner manager can remove users, transfer ownership, and unlink other managers. Give the agency's manager ownership only when it needs those privileges. Access levels reserve accepting a manager link, unlinking a manager, and changing other users for Admin. Unlinking needs administrative access, and a Google Ads account can have only one direct manager. How budgets and call counts stay attached to an office, once the account is one the group can open, is in DSO Google Ads budgets and call attribution.
Analytics access is assigned on the account or on the property. Administrator can manage users. Editor can change property settings and cannot manage users. Marketer can work with audiences, events, and key events. A role granted on the account is inherited by every property in it. A more permissive role on one property still applies to that property. Read the role in access management. A view-only login, or a PDF, is not an Administrator.
Tag Manager permissions split in two. On the account, a user is an Administrator or a User. On a container, the rights are Read, Edit, Approve, or Publish, or no access. Google says to keep at least two active administrators, to use real user accounts rather than a shared login, and to have the account managed by someone in the organization rather than an outside agency. If no administrator remains, the container is deleted. Users who still have read access have 30 days to export it from the trash. That 30-day export is Google's recovery window for a container with no admin. It is not the review window in the transition order above.
Search Console distinguishes owners from users. An owner has full control and is the only role that can add or remove users. A property must have at least one verified owner, or nobody can open it. A verified owner proved control with a token on the site, such as an HTML file or a tag. A delegated owner was added by a verified owner without a new token. Full users and restricted users can see data and cannot manage the owner list. You can remove a delegated owner in the user screen. A verified owner can regain access if the token is still on the site, so remove the token when you remove that owner. If every verified owner is removed, the remaining users lose access after a grace period. Google's page does not state the length of that period.
Data collection continues, and nobody can read it until someone verifies again. One property per site you are keeping. Whether those sites are folders on one domain or separate office domains is the choice in one domain or separate office sites, and it decides how many properties and how many redirect maps you have.
Numbers, reviews, and redirects
The FCC's wireless local number portability questions describe number porting as changing providers in the same local area and keeping the phone number. Moving to a different town or city is outside that description. The new provider starts the request, confirms identity, and asks the old provider to release the number. A recent bill should show the name and address on the carrier's account. Once a valid request is in, the old provider cannot refuse or delay the port because a balance or an early termination fee is still owed. The balance and the fee can still be owed.
A tracking number follows those terms only when the group is the account the new provider can confirm. If the bill names the vendor, put that number on the list the group cannot port, and decide the replacement before the profile and the sign still show it. Which number belongs on the profile, and which line is only a measured campaign number, is in office phones, a central call team, or a hybrid.
Review sites are a login check, not a Google product setting. Open each one with an email the group controls and confirm every office is on the list. If the only inbox that receives the password reset is the agency's, the group does not control that account.
Change public URLs only when the domain choice or a rebrand requires it. Google's redirect documentation names a move to a new domain, a merger of two sites, and removal of a page as reasons to redirect. A permanent redirect tells Google to show the target. A temporary redirect tells Google to keep showing the source. Use a permanent redirect when the old address will not come back. A 301 and a 308 are both permanent.
Server-side redirects are the kind Google is most likely to interpret as you intend. Use a script redirect only when you cannot do a server-side or meta refresh redirect, because rendering can fail and Google may never see the jump. Keep the map as old URL to the matching office or service page, on a host the group can still edit. Patient names do not belong in that map or in the report you hand between firms. Keep the export HIPAA aware: office, channel, and counts.
Red flags
These are operations checks during a handoff. They do not name or rank any firm.
-
1. The agency owns the accounts.
The failure is a registrant, a primary owner, an Ads owner-manager, a GA4 Administrator, a Tag Manager administrator, or a Search Console verified owner that sits only at the agency. Google's third-party policy says the business keeps ownership or co-ownership of each Business Profile. An Ads manager that created the client account becomes its owner. A Tag Manager account with a single outside administrator is the lockout Google's help tells you to avoid.
-
2. Tracking numbers the group cannot port.
The FCC's portability questions describe keeping a number when you change providers in the same local area, after the new provider confirms the account. A bill in the vendor's name means the group is not that account. Those numbers can leave with the vendor, and the profile phone and the sign still show them. Write the list down before the lines are treated as yours.
-
3. No admin access to the Business Profiles.
A manager can edit hours, photos, and review replies, and cannot add or remove users. If the group is missing from People and access, or the only path in is the agency's organization, the group cannot invite a replacement or remove the last user. An organization account can manage a location only after that location grants permission. It does not replace a group owner.
-
4. Reports with no office-level rows.
A group total cannot say which door the calls, forms, or bookings belonged to. During a handoff that gap hides a broken number, a missing profile, or a container that stopped firing at one office. The row has to name the office. It does not need a patient name.
Questions for the next firm
Put the same questions in the RFP and in the exit conversation with the current firm. A useful answer names an account and a group email. A weak answer describes the work without saying who can open the account when the contract ends. These are procurement questions. They are not legal advice, not a contract clause, and not a template. Ask counsel to review the agreement you actually sign.
1. Who will be the registrant on each domain, and who can request the AuthInfo code from the registrar?
A useful answer names
The group is the Registered Name Holder, with a named group login. The firm does not keep the registrar account.
Ask a follow-up if you hear
The firm will "hold the domain for convenience," with no named registrant.
2. Where are DNS records edited after launch, and whose login is that?
A useful answer names
A group login for the nameserver host or the DNS host, separate from the firm's personal email.
Ask a follow-up if you hear
DNS changes go through a ticket to the firm, and the group never sees the zone.
3. Who is primary owner on each Business Profile and on the business group?
A useful answer names
A group user is an owner now, the primary owner is named, and the firm accepts manager access.
Ask a follow-up if you hear
Profiles live only inside the firm's organization, or the firm must be an owner.
4. Will the Google Ads account be a client account the group administers, with the firm linked as a manager?
A useful answer names
A group Admin exists on the client account. The firm's manager account is linked, and you are told whether that manager will be the owner.
Ask a follow-up if you hear
The firm creates the account inside its manager account and does not add a group Admin.
5. Who is Administrator on the GA4 account, and who can Publish in Tag Manager?
A useful answer names
Group administrators on both, with a second Tag Manager administrator. The firm is Editor, Marketer, or a container user, not the only admin.
Ask a follow-up if you hear
The property and the container are created under the firm's login, and the group gets a view or a PDF.
6. Who is a verified owner on each Search Console property?
A useful answer names
A group user verifies with a token the group can see, and the property list matches the domains you will keep.
Ask a follow-up if you hear
The firm is the only verified owner, or the group is a restricted user.
7. Which call-tracking numbers can the group port, and which numbers stay on the profile?
A useful answer names
A list of numbers, the account name on the bill, and a statement of which lines the group can move. The profile phone is a number the group controls.
Ask a follow-up if you hear
Numbers are "included in the retainer" and cannot be moved when the contract ends.
8. If public URLs change, who keeps the 301 map after the contract ends?
A useful answer names
A URL-to-URL map, permanent server-side redirects, and a host login the group keeps.
Ask a follow-up if you hear
Redirects live only in the firm's account, or the firm says the old URLs can be abandoned.
9. What access is removed, and what does the group keep, when the engagement ends?
A useful answer names
A list of users to remove, a list of group owners who stay, and the exports the group will already have: site, container, and user lists.
Ask a follow-up if you hear
Access ends "when the contract ends," with no list of accounts and no export.
10. Will ongoing reports include one row per office?
A useful answer names
A sample that names each office for calls, forms, or bookings, with no patient name in the row.
Ask a follow-up if you hear
A single group total, or a deck that cannot be tied to a door.
Checklist
Twelve checks before you remove the outgoing firm. Ticks stay in this browser only.
Agency handoff checklist
12 items
What DDS Web Solutions builds
DDS Web Solutions builds practice websites. Our team has been building websites since 2014, and we have served 100+ practices. Offices are in Sacramento and San Mateo. The products are Smyly, SmileTrak, and ToothRank. The planning page is DSO and multi-location marketing.
Sources
Wording on these pages can change, so confirm the live page. This is marketing guidance, not legal advice.
- •Google Business Profile Help: Manage your Business Profile owners and managers
- •Google Business Profile Help: Transfer primary ownership of a Business Profile
- •Google Business Profile Help: Business Profile third-party policies
- •Google Business Profile Help: Manage business group owners and managers
- •Google Business Profile Help: Manage agency organizations
- •Google Ads Help: About Google Ads manager accounts
- •Google Ads Help: About ownership of client accounts
- •Google Ads Help: About access levels in your Google Ads account
- •Google Ads Help: Manage access to your Google Ads account
- •Google Ads Help: Unlink accounts from your manager account
- •Analytics Help: Access and data-restriction management
- •Tag Manager Help: Managing users and permissions
- •Search Console Help: Managing owners, users, and permissions
- •ICANN: Transfer Policy
- •FCC: Wireless Local Number Portability Frequently Asked Questions
- •Google Search Central: Redirects and Google Search