In a growing business, it's common for a HubSpot portal to start with everyone as a Super Admin. It seems easier to give the whole team keys to the castle than to figure out who needs what. This approach, however, is a ticking time bomb. Unrestricted access inevitably leads to accidental data deletions, broken workflows, inconsistent reporting, and significant security vulnerabilities. As your team scales, moving from this chaotic state to a structured permission model is not just an IT task; it is a fundamental business requirement for maintaining data integrity and operational efficiency.
The core principle behind effective portal management is the Principle of Least Privilege (PoLP). This means each user should only have the absolute minimum permissions necessary to perform their job function. A sales development representative does not need the ability to publish a blog post, and a content marketer does not need to modify deal pipelines. Implementing PoLP reduces the risk of human error, protects sensitive customer and company data, and simplifies the user experience by hiding irrelevant tools and settings. A well-structured permission system is the foundation of a scalable and secure CRM.
This guide provides a comprehensive overview of how to manage user permissions in HubSpot effectively. We will cover the different layers of HubSpot's permission structure, the dangers of over-assigning the Super Admin role, how to create custom roles tailored to your business needs, and a framework for auditing and maintaining your setup. Following these steps will help you secure your portal, ensure data governance, and provide your team with the focused access they need to succeed. If you find your setup is already too complex to untangle, our HubSpot CRM setup and automation services can help establish a clean foundation.
Understanding HubSpot's Core Permission Structure
HubSpot's permission system is layered to provide granular control over your portal. At the highest level is the User, which is the individual account for each person on your team. Each user is then assigned a Role, which is a collection of permissions that defines what they can see and do. HubSpot provides a set of standard roles out of the box, and on Professional and Enterprise tiers, you can create custom roles. This is where you define access rights for CRM records, marketing tools, sales assets, and portal settings.
Beyond roles, HubSpot uses Teams to control record visibility. You can assign users to a team, such as 'North American Sales' or 'Customer Support Tier 1'. You can then set permissions so that users on a team can only view or edit records owned by their teammates. This is crucial for segmenting data in larger organizations and preventing users from being overwhelmed by irrelevant information. For example, a European sales rep does not need to see leads assigned to the Australian team.
Finally, for Enterprise customers, permissions can be extended to an even more granular level with property-level access and permission sets. Property-level permissions allow you to make specific CRM properties, like a 'Commission Amount' on a deal, view-only or hidden for certain roles. Permission sets are pre-packaged templates of specific permissions that can be quickly assigned to users for temporary or specific needs without creating an entire new role. Understanding how Users, Roles, and Teams work together is the first step toward building a secure and manageable HubSpot portal. You can see how we apply these principles in our work.
The Super Admin Trap: Why Less Is More
The Super Admin role grants complete and unrestricted access to every tool, setting, and piece of data in your HubSpot account. This includes billing information, user management, domain configurations, and the ability to permanently delete assets or export your entire contact database. While necessary for initial setup and high-level administration, assigning this role too broadly is the single most common and dangerous permission mistake a company can make. Each Super Admin represents a potential point of failure, whether through malicious action or, more likely, a simple mistake.
Consider the risks. A Super Admin can accidentally change DNS settings, taking your website offline. They could unintentionally delete a critical active list, breaking dozens of workflows and sequences. They have the power to modify custom object definitions, which can have cascading and irreversible effects on your data architecture. From a security standpoint, if a Super Admin's account is compromised, the attacker gains full control over your most valuable business asset: your customer data.
As a strict rule, the Super Admin role should be limited to no more than two or three individuals in your organization. These should be people who are responsible for the overall platform strategy and administration. All other users, including marketing managers, sales leaders, and even senior executives, should be assigned a custom role with permissions tailored specifically to their job requirements. This approach dramatically reduces your portal's attack surface and minimizes the potential damage from human error. If you've experienced issues from poorly managed permissions, our HubSpot support and maintenance retainers provide peace of mind.
Deconstructing HubSpot's Standard User Roles
Before diving into custom roles, it is useful to understand the standard permission sets that HubSpot provides. These built-in roles are designed around common job functions and are available across different Hub and subscription tiers. For example, you might see roles like 'Marketing Hub Professional User' or 'Sales Hub Starter User'. While these presets are a good starting point, they are often either too restrictive or too permissive for a specific company's needs, which is why creating custom roles is a best practice.
A standard 'Sales Hub Professional' user, for instance, typically has permissions to view, edit, and reassign contacts and deals. They can enroll contacts in sequences and use calling features. However, they usually cannot delete contacts in bulk or export large lists, which is a good default safety measure. In contrast, a 'Marketing Hub Professional' user can create and publish emails, landing pages, and social posts but may have view-only access to deal pipelines.
The key limitation of standard roles is their one-size-fits-all nature. They do not account for the unique structure and processes of your business. For instance, you might want your sales managers to have the ability to edit team members' deals but not delete contacts. A standard role cannot accommodate this specific need. Analyzing these standard roles is a valuable exercise to map what you need before building your own, ensuring you cover all necessary permissions without granting unnecessary access. The table below illustrates some key differences.
| Permission Area | Sales Hub Starter User | Marketing Hub Pro User | Super Admin |
|---|---|---|---|
| View/Edit Contacts | Owned Records Only | Full Access | Full Control |
| Bulk Delete Contacts | No Access | No Access | Full Control |
| Export Contacts | Limited | Limited | Full Control |
| Create/Publish Marketing Emails | No Access | Full Access | Full Control |
| Modify User Permissions | No Access | No Access | Full Control |
| Access Billing Information | No Access | No Access | Full Control |
How to Create Custom User Roles in HubSpot
Creating custom user roles is a feature available in Professional and Enterprise tiers of HubSpot and is the key to implementing the Principle of Least Privilege. To begin, navigate to 'Settings' by clicking the gear icon in the top right, then go to 'Users & Teams' in the left sidebar and select the 'Roles' tab. From here, click 'Create role' to open the role editor.
Start by giving your role a descriptive name, like 'SDR - Sales Development Rep' or 'Content Creator'. Next, you will see a series of tabs for CRM, Marketing, Sales, Service, and more. Go through each tab and carefully grant permissions. For an SDR role, you might go to the 'CRM' tab and under 'Contacts', allow them to 'View' and 'Edit' but uncheck 'Delete' and 'Export'. Under the 'Deals' object, you might set their view and edit permissions to 'Team only', ensuring they can only work with deals owned by their team.
Be granular. For each object and tool, you can specify create, read, update, and delete (CRUD) permissions. For marketing roles, you can separate 'Draft' permissions from 'Publish' permissions for emails and landing pages, creating a review process. For example, a junior marketer can create and edit an email, but only a marketing manager can publish it. After configuring all permissions, click 'Save'. You can now assign this custom role to existing or new users, providing them with precisely the access they need. Building these roles correctly is a core part of our process; learn more about our pricing.
Controlling Record Access with Teams and Hierarchies
While roles define *what* a user can do, teams define *which records* they can do it to. This distinction is fundamental for organizing larger HubSpot portals. Without teams, a sales role with permission to edit deals could potentially edit any deal in the entire pipeline, leading to confusion and data ownership conflicts. By creating teams and setting record access rules, you ensure users only interact with the data relevant to them.
To set up teams, navigate to 'Settings' > 'Users & Teams'. You can create teams and assign a primary and secondary member to each. For example, you can create 'Sales Team - East' and 'Sales Team - West'. Once teams are established, you can use them in your custom roles. When editing a role's permissions for an object like Contacts or Deals, you will see options to limit access to records 'Owned only', 'Team only', or 'Owned and team only'. Setting this to 'Team only' means a user can only see records owned by themselves or anyone else on their designated team.
HubSpot Enterprise tiers take this a step further with 'Team Hierarchies', allowing you to create parent-child relationships between teams. A 'VP of Sales' team could be the parent of the 'East' and 'West' regional teams, giving managers visibility into their direct reports' activities without granting them access to the entire company's data. Properly structuring teams is as important as defining roles and is a key step in any scalable HubSpot CRM setup and automation project.
Conducting a HubSpot User Permission Audit
A permission audit is a systematic review of all users and their access levels in your HubSpot portal. It is not a one-time task but a regular process that should be conducted at least quarterly. The goal is to identify and remediate security risks, such as users with excessive permissions, dormant accounts that still have access, and improperly configured roles. This proactive maintenance prevents data breaches and operational disruptions.
Your audit should begin in the 'Users & Teams' section of your settings. Start by reviewing the list of Super Admins. Is everyone on that list still with the company and do they absolutely require that level of access? If not, downgrade their role immediately. Next, review all other users. Check their 'Last Active' date. If a user has not logged in for over 90 days, question if they still need access. This is particularly important for former employees or contractors whose accounts were never deactivated.
Examine your custom roles. Do they still align with your current team structure and responsibilities? You may find that roles need to be updated or that some users have been placed in the wrong role. HubSpot's Security Center (available in some tiers) can also help identify potential risks. HubStack frequently performs permission audits as part of our HubSpot support and maintenance retainers, providing an expert, third-party review to ensure our clients' portals remain secure.
A Framework for Ongoing Permission Management
Effective permission management relies on establishing clear, repeatable processes for your organization. Without a framework, your carefully structured portal will quickly revert to a state of chaos as new employees join, roles change, and people leave. The first pillar of this framework is a documented onboarding process. When a new employee joins, their manager should request access by specifying the exact custom role they require. An administrator then creates the user and assigns the pre-approved role, avoiding the temptation to grant Super Admin access 'just for now'.
The second pillar is an offboarding process. The moment an employee's departure is confirmed, their HubSpot account should be scheduled for deactivation on their last day. Part of this process involves reassigning ownership of all their CRM records (contacts, companies, deals) to their manager or a successor. This is a critical step that prevents data from becoming 'orphaned' and ensures a smooth handover of responsibilities. Forgetting this step can leave active deals and important contacts unattended.
Finally, schedule your permission audits. Put a recurring event on the calendar every three to six months for the portal administrator to perform the full audit described in the previous section. Document the findings and any changes made. By embedding onboarding, offboarding, and regular audits into your company's operations, you transform permission management from a reactive fire drill into a proactive security function. If you need help establishing this framework, please contact us.