Permission templates vs copying an existing user

Smart CRM & Sales Hub Account & Settings
1

Hi everyone, I’m cleaning up our user/permission setup in HubSpot and I’m a bit lost on what’s “best practice”. I’d love some guidance on how other teams do this.

1. Real permission templates vs. copying from an existing user Right now, when I edit a user I see HubSpot’s built-in role presets like: Sales rep Service rep / Service manager Marketing management, etc. As far as I can see, I can select one of these, but I can’t see or edit the underlying permission matrix. My questions: Is there a way in HubSpot to create our own permission sets / roles (e.g. “Administration – standard”, “Sales – standard”, “Fulfillment – consultant”, “Marketing – standard”) that we can assign when creating a user? Or is the only option on some plans to copy permissions from an existing user (“copy permissions from user X”) each time?

If custom roles / permission sets are available only on certain subscriptions, how can I quickly see in the UI whether our portal has this feature enabled?

2. “Template users” that don’t cost extra seats Because we don’t want to depend on one real person (e.g. Aylin in Administration) as the “master” for permissions, I’m considering creating template users, for example: TPL – Administration TPL – Sales TPL – Fulfillment (Consultants) TPL – Marketing

The idea would be: Give each template user exactly the permissions we want for that department. When a new employee joins, create them in HubSpot and copy permissions from the appropriate template user.

Questions: Can these template users exist without consuming paid Sales/Service seats (i.e. as free/CRM-only users)? Is there any downside or known pitfall to using this “template user” pattern?

3. Using Teams + properties for roles like Lead Caller (LC), Quali Caller, etc. We already use Teams for role-style groupings: Lead Caller Quali Caller Consultants etc. We also have contact properties like “LC” (lead caller), “QC” etc.

These are currently dropdown properties with manually maintained name options (we add/remove names by hand). What I would like: If a user is in the Team “Lead Caller”, their name should automatically be available / selected in the LC property for contacts. Questions: Is there any no-code way to connect Teams with a dropdown property (e.g. “all members of Team Lead Caller are valid LC options”)?

Is it better to switch those fields to the property type “HubSpot user” instead of a dropdown with names, and then: use Teams only for grouping, choose the responsible user from the “HubSpot user” property? If we use “HubSpot user” properties: Can we filter or report by Teams (e.g. “LC is a user from Team Lead Caller”)?

Or would we need some kind of integration / workflow code to sync Teams into a normal dropdown property?

I was previously advised by another user to use Core Seats. However, my understanding was that Core Seats themselves are paid seats, and only view-only users are free.

In HubSpot’s new seat-based model (from March 2024), pricing is determined by the number of Core Seats (active users who can edit, log, etc.), while View-Only Seats are free and unlimited. Additional Core Seats are billed per user per month, whereas view-only seats are not. See for example HubSpot partner explanations of the new model, which describe Core Seats as the billable seats and View-Only as free seats.

https://knowledge.hubspot.com/account-management/manage-seats

Based on that, a “template user” configured as a Core Seat would still count as a paid seat, even if they don’t have extra Sales or Service add-ons. Am I missing something here? Is there a good workaround for this?

2

Hi @PBallerscheff,

Happy to help here :slightly_smiling_face:

1. Permission sets are an Enterprise feature: Create and assign permission sets - you would see a corresponding tab under Settings > Users & Teams.

2. Templates ( = permission sets) would require the aforementioned subscription. Without it, you’re “stuck” with the set templates that HubSpot provides. Permission sets or templates can have permissions include that require a seat or not - HubSpot will flag that when you’re trying to assign permissions to a user who would require a seat but currently doesn’t have one.

@PBallerscheff wrote:

The idea would be: Give each template user exactly the permissions we want for that department. When a new employee joins, create them in HubSpot and copy permissions from the appropriate template user.

Questions: Can these template users exist without consuming paid Sales/Service seats (i.e. as free/CRM-only users)? Is there any downside or known pitfall to using this “template user” pattern?

As long as the permissions don’t include anything that requires a seat, yes, that’s a good way of going about this.

3. There currently is no native way to have non-HubSpot-user properties automatically pull a list of users, no. If you need control over which users are displayed and if you’re fine with manually maintaining it, a dropdown is a good option. For anything else: HubSpot user property.

@PBallerscheff wrote:

I was previously advised by another user to use Core Seats. However, my understanding was that Core Seats themselves are paid seats, and only view-only users are free.

In HubSpot’s new seat-based model (from March 2024), pricing is determined by the number of Core Seats (active users who can edit, log, etc.), while View-Only Seats are free and unlimited. Additional Core Seats are billed per user per month, whereas view-only seats are not. See for example HubSpot partner explanations of the new model, which describe Core Seats as the billable seats and View-Only as free seats.

https://knowledge.hubspot.com/account-management/manage-seats

Based on that, a “template user” configured as a Core Seat would still count as a paid seat, even if they don’t have extra Sales or Service add-ons. Am I missing something here? Is there a good workaround for this?

That is correct. Only view-only users are free. Anyone who wants editing access to HubSpot, needs a paid core seat (either one of the included ones in your subscription or one that you have purchased on top of that).

If a user with a permission template or set gains editing permissions through such a template or set, they need a core seat. You can only assign view permissions to a view-only user.

There is no way around that. Users with editing access must have a paid seat - without one, they cannot edit.

Let me know if you have any follow-up questions!

3

Hi @karstenkoehler,
Thanks for your help!
We’re on HubSpot Pro and don’t have access to Enterprise permission sets. I’m looking for a clean way to standardize permissions for recurring roles (e.g. Lead Caller, Consultant, Admin) without manually clicking through the entire user-permissions matrix every time we onboard someone.

From the docs I understand:

My idea / proposed workaround:

  1. While a real employee is in a role, they just work as normal.

  2. When they leave (or when we redesign our roles), we deactivate the user instead of deleting them.

  3. This deactivated user should then:

    • no longer consume a Core Seat
    • still keep their permission configuration
    • still appear in the “copy permissions from existing user” dialog

  4. For new hires in that same role, we would:

    • create a new user
    • click “Copy permissions from another user”
    • choose the deactivated “template user” as the source

  5. We would never delete these template users, only keep them deactivated, basically as frozen snapshots of role-based permission profiles.

My questions:

  1. Is it correct that a deactivated user does not consume a Core Seat, but still keeps their permissions for copying? (In other words: we don’t pay for them, but can still reuse their permission setup for new users.)

  2. Is there any technical downside or hidden pitfall to using deactivated users like this as “permission templates”?

    • e.g. reporting oddities, issues when reassigning ownership, problems with future changes to the permission model, etc.

  3. Is there a better recommended pattern on Pro (without Enterprise permission sets) to standardize permissions for roles like “Lead Caller”, “Consultant”, “Admin” without manually clicking everything each time?

Goal: I don’t need these template users to log in or own anything new – I only want them as permanent, non-billable snapshots so that “copy permissions from user X” is effectively our home-grown permission set.

Thanks a lot in advance for any confirmation or warnings about this pattern!

4

@PBallerscheff

  1. I’m not sure if you can copy permissions from a deactivated user, otherwise yes, that sounds sensible. No, a deactivated user does not consume a core seat. Should that ever happen, simply reassign it - but it shouldn’t.
  2. No relevant ones, no.
  3. I’d aim for copying from an active user instead of a deactivated one, as I haven’t tested whether copying from a deactivated one works. Other than that, it is the solution that requires the least clicking without having to upgrade, yes.
5

Hi, I see that you have a good work around with the deactived user but I checked and Hubspot doesn’t allow us to copy deactived user’s permission. Have you figured out another way to work on this?

6

Hello @ThaoLe_Hublet,

Thanks for adding to the thread!

As of now, I’m not seeing a way around this besides temporarily activating that User. I understand that may not be ideal, but I believe this may simply be a limitation if you’re under the same circumstances as our original poster.
I may suggest creating your own post on this to see if there are any other workarounds pertaining to your specific use case. Otherwise posting a new idea in our Ideas Forums is the best way to raise feature requests and increase the chance it will become a feature in the future.

I hope this helps point you in the right direction!

Best,

Sam, Community Manager