Created an Admin User for integrations and Connected Apps

Develop, Build & Integrate Marketplace Apps
, ,
1

Has anyone every used a distribution list email to set-up an admin account dedicated for connected apps, third-party integrations, and other possible connections to HubSpot from external systems.

Currently, my admin user is tied to approximately 30 different connected applications and services. From a security perspective, if I was to ever leave the company, my user would have to be disabled and it would break the connection to these applications.

I was thinking about creating a service or distribution email address that goes to multiple individuals so that if one person leaves the organization, the individual can be removed (and new individuals added), and the continuity of the service would be maintained.

Wondering how others have handled the issue before putting something concrete in place.

2

Hi @GaryMaggiolino ,

You’re thinking about this the right way. Having ~30 integrations tied to one person’s user is a real continuity risk.

Using a distribution list or shared company-controlled address for the dedicated integration user can make sense, so password resets and important notifications aren’t tied to one person. I’d avoid having several people share that login day to day, though. Create a dedicated integration user with only the permissions the apps actually need, and keep its credentials and MFA in a controlled password manager.

One thing to watch: the App Owner in HubSpot is separate from the user an app is actually authenticated with. Under Settings → Integrations → Connected Apps, you can open an app and manage its owner. However, changing the App Owner may not change the credentials the connection is using. For apps authenticated through your personal user, you may need to reconnect them while logged in as the dedicated integration user.

I’d approach the migration like this:

  1. Inventory the connected apps and note the owner and authentication method.
  2. Create the dedicated integration user.
  3. Reassign ownership and reconnect the user-authenticated apps, starting with a couple of non-critical ones.
  4. Deactivate the existing user last, once you’ve confirmed nothing is still dependent on it.

That should give you a much cleaner setup where the integrations are owned by the company rather than being dependent on one individual.

3

Exactly what I was thinking. Just wanted to see if anyone had any clever or unique ways to handle it before proceeding.