Hello!
I am attempting to limit our Salesforce → Hubspot sync to two types of contacts we have in our system. I have set Salesforce’s Contact Sharing Settings to Private in the organization wide defaults.
Then, in Contact Sharing Rules, I have set up one set of rules for the Hubspot integration user, and a second set of rules for everyone else in the organization.
Despite all this, I am having contacts sync over that don’t fit the Hubspot integration user criteria! Can someone take a look at the criteria and see if anything is obviously off there, or let me know if they have any other suggestions? Attached is the Contact Sharing Rules as well as a snapshot of our user hierarchies.
Sharing Settings
Role Hierarchy
Hi @itsmebethany,
The underlying architecture of the Salesforce integration is currently being updated - and there is a product update just from earlier this week on this topic exactly: HubSpot Login and Sign in
Selective sync for Salesforce objects
What is it?
You can now set filters to control which Salesforce objects sync with HubSpot, giving you the level of control you’ve had on the HubSpot side, now on the Salesforce side too.
Selective sync works similarly to inclusion lists, but applies specifically to Salesforce objects. Set your filters, and any Salesforce object that matches will sync with HubSpot. Objects that don’t match are skipped.
Why does it matter?
Managing which data moves between HubSpot and Salesforce just got simpler. Customers no longer strictly need to set up integration users in Salesforce to control what data is shared with HubSpot.
How does it work?
Find selective sync in your Salesforce app settings.
It is currently available for the following objects:
- Custom objects
- Tickets
- Companies (once upgraded to v2)
- Deals (once upgraded to v2)
Support for Contacts will be released later this year.
Who gets it?
Content Hub Professional, Content Hub Enterprise, Marketing Hub Professional, Marketing Hub Enterprise, Sales Hub Professional, Sales Hub Enterprise, Service Hub Professional, Service Hub Enterprise, Smart CRM Professional, Smart CRM Enterprise
This might be another way to tackle this.
Best regards!
Thanks Karsten, but I need something that works now, not at an undefined time in the future.
@itsmebethany of course.
In your rule 2, did you remove the filter criteria or is it actually blank? If so it essentially shares almost every contact with the System Administrator role. If the HubSpot integration user is operating under or alongside the System Administrator in the role hierarchy, it may be inheriting access to those records – bypassing Rule 1’s filters entirely.
Sharing rules using “Role and Internal Subordinates” pass record access down the hierarchy. If the HubSpot integration users sits beneath system administrator in the hierarchy (which your screenshot suggests), it may be getting access via hierarchy, not just via Rule 1? Ideally it should be in its own branch of the hierarchy, not subordinate to system administrator.
Hi Karsten. The filter criteria is Last Name is not equal to and then a blank field.
They are in separate hierarchies. More clarity here:
@itsmebethany thank you for your reply - could you confirm if you have “Grant Access Using Hierarchies” enabled? Users in the parent role (or any role that has access) may be cascading records downward to the HubSpot user unexpectedly.
Looking at this from another angle, can you confirm that the integration user does not have “View all” or “Modify all” permissions? Sharing rules are irrelevant if the user’s profile or permission set grants View All/Modify All on the Contact object.
Grant Access Using Hierachies is checked! But View All/Modify All might be my issue! I am going to switch it off and do some testing. I’ll come back and update with the result. Thank you!
Hey @itsmebethany,
Thank you for following up with this context! Re-tagging @karstenkoehler for visibility.
Shane, Senior Community Moderator
Sounds like you’re dealing with a role hierarchy override issue. But this one’s fixable. Even if you have Private org-wide defaults set up, Salesforce’s role hierarchy can sometimes give visibility that goes beyond what your sharing rules are meant to allow. So, if the HubSpot integration user sits at a level that inherits access from above, contacts outside your criteria will still sync.
Take a moment to check where the integration user falls within your role hierarchy and see if ‘Grant Access Using Hierarchies’ is turned on for the Contact object. That’s where the problem usually lies.
