Hi all,
I have a rather unusal request from a client where they do not want to anyone have a SuperAdmin account for the day to day running, just a specfic selection, who will not be managing the account day to day and they have 2 teams, but want to lock down the teams.
For example we have Team 1 with subteams of Team A, Team B and Team C. We also have Team 2 with substeams of Team D, Team E and Team F. They want to have it so that Team A can only add users with a preset designed for Teams A, B or C and only add them to those teams and be locked out from adding someone to another team.
I have found a way around the limiting the presets as there a number of areas of the accounts they are not needing nor will never need for their use case so can restrict the limits by have only 1 element turned on for one team and a different element for the other team.
However, I am stuck if there is anyway to limit down the teams assignment. I can either appear to have access to add to teams on all teams or no access at all.
I know it’s a very unsual situation but any thoughts on this would be greatful.
Sam
Hey @SMumbyHarrison, Happy Friday!
This is indeed a unique scenario. One approach is to create custom user roles with specific permissions, allowing access only to the necessary areas. Additionally, setting up team hierarchies where permissions are inherited can help. Utilizing HubSpot’s permission sets to restrict team assignments is also useful.
To our top experts, @danmoyle and @TomM2 any recommendations for @SMumbyHarrison matter?
Thank you,
Pam
Hi @SMumbyHarrison and welcome to the Community. +1 for the suggestion on the resource from @PamCotton here.
From my perspective and experience, implementing such a granular level of team-based access control in HubSpot is challenging at best. It’s just not built the way you describe it.
But here’s a breakdown of the situation and some potential approaches:
- SuperAdmin restrictions:
HubSpot doesn’t have a built-in way to restrict SuperAdmin access for day-to-day operations while maintaining it for specific users. SuperAdmins have full access to all areas of the account, including user management and team assignments.
- Team-based user management:
There isn’t a native way to restrict user addition to specific teams as requested (e.g., Team A only adding users to Teams A, B, or C). HubSpot’s permission system doesn’t currently support this level of granularity for team assignments.
- Preset permissions:
Your approach of creating preset permissions with limited access for different teams is a good workaround. This can help restrict access to certain areas of the account based on team needs.
Given these limitations, here are some potential approaches I might consider:
- Minimal SuperAdmin access:
Keep SuperAdmin access limited to a very small group of trusted individuals who are not involved in day-to-day operations. This aligns with best practices for HubSpot account management.
- Custom permission sets:
Create highly specific permission sets for each team, granting only the necessary access for their roles. This can help mitigate the risk of users accessing or modifying data outside their purview.
- Regular audits:
Implement a process for regularly auditing user permissions and team assignments to ensure compliance with the desired structure.
- User education:
Train team leaders on the importance of adhering to the team structure when adding new users, even if technical restrictions aren’t in place.
- Feature request:
Consider submitting a feature request to the HubSpot Ideas forum (there might even be one in there you can upvote and comment on) for more granular team-based access controls. While not an immediate solution, it could lead to future improvements.
While these approaches don’t fully meet your client’s specific requirements, I feel like they’re your best bet for now. It may be worth discussing these constraints with the client to manage expectations and explore alternative solutions that balance security needs with system capabilities.