Property access management

[ohergli]

Hi all,

I’m encountering an issue while testing the Sales Enterprise properties access. When assigning access to users, I must choose between the following options on the contacts access:

All contacts
Their team’s contacts
Their contacts
None

However, I’ve noticed the following problems:
On one hand, When team members have access to "All contacts," they can modify all properties, not just the ones I have assigned to them.
On the other hand, When assigned access to "Their team’s contacts" with specific property modifications, they’re unable to do so as they don't belong to the team that owns the contacts even if the property is assigned to them. This appears to be due to team-level access rather than property-specific permissions.
In our set up , people need to modify contacts across teams since all records relate to students, which complicates the current access structure. The user and property access settings seem to conflict each other . Could you kindly provide any recommendations or solutions for addressing this issue? Thanks,

[mike533]

It appears that team-based limitations and property-specific permissions are at odds with one another in your access settings. Changing team access to permit more extensive changes while preserving property-specific restrictions is one way to solve the problem. In order to prevent problems with team ownership, if your system permits it, think about using role-based access instead of team-based access. As an alternative, see if it's possible to establish a new permission set that allows cross-team adjustments without granting complete access to every contact. Finding a solution could also be aided by looking at the support documentation and permission hierarchy in your CRM.

[mike533]

It sounds like your access settings are conflicting between team-based restrictions and property-specific permissions. One solution is to adjust team access to allow broader modifications while maintaining property-specific controls. If your system allows it, consider using role-based access rather than team-based, so users can edit assigned properties without team ownership conflicts. Alternatively, check if a custom permission set can be created to grant cross-team modifications without full access to all contacts. Reviewing your CRM’s permission hierarchy and support documentation may also help identify a workaround.

[karstenkoehler · Accepted solution]

Hi @ohergli,

Could you please share screenshots of the exact contact access settings and property access settings?

Generally, there is a note in the documentation about this: https://knowledge.hubspot.com/properties/restrict-view-edit-access-for-properties

Please note: this feature does not provide complete restricted access, so it's not recommended to use property restrictions as a security measure. All users, regardless of access, can set or edit restricted properties via HubSpot's API, or when manually creating a record. To avoid this, you can restrict access to certain objects or applicable tools.

Still, screenshots would be good to understand which settings exactly you made.

Best regards

[ohergli]

Hello @karstenkoehler ,

Thanks for your prompt response.

I have attached two screenshots  regarding both access management tools, the first one stats that the user can modify all contacts and the second one restricts the property access however he still can edit it.

I hope there is a way on the contacts object access among these options ( all contacts, teams's contact, their contacts , none) that allows to choose (based o property access) Let me know your thoughts, any recommendations will be really helpful.

Best,