Restrict visibility of Contacts by Team

[AAgarwal75]

Consider we have two teams Team1 and Team2, and two users Sara and John. Sara is in both teams Team1 and Team2. John is in only Team2. A particular contact record is owned by Sara. We want to make sure that John cannot see this record. How can we accomplish this?

Everything I find says that John can see any record owned by a co-member of his team. Well Sara is in his team, but she is also in another team. From the explanations I'm finding, it sounds like John can see everything Sara can because there is one team they are both in, but that seems like it defeats the point of a team. Can someone explain more precisely how the permissions work.

(Apologies if this has already been answered. I read all related posts on this topic that I could find but didn't a satisfactory answer.)

[AAgarwal75]

The reply by @BSmith08 was recently marked as the Accepted Solution. The menu includes an item "Not the Solution". I tried clicking that but nothing seems to happen. In case anyone sees this thread, I want to make sure it is known that that is not the solution. As the subsequent discussion makes clear, we concluded that what I requested cannot be done.

[tverdokhlib1]

@AAgarwal75 did you try to make John available to see only the Contacts he owns? In this case, the issue will be resolved.

So you need to go to Settings - Users & Teams - Find John and click on edit permissions - Find CRM - Contacts - and choose Contacts they own

If you want to set up John's permissions to see the Team's Contacts, in this case, he will be able to see all the contacts in any Team he belongs to.

[AAgarwal75]

> did you try to make John available to see only the Contacts he owns?

My example was too minimal. I do want John to see Sara's contacts when they relate to Team2's work, but prevent him from seeing Sara's contacts when they relate to Team1.

[BSmith08]

Hi @AAgarwal75 ,

To confirm what you're looking to do, you want Sara to be able to see all records owned by herself and John, whereas for John you only want him to be able to see records on his team? If that's the case, I think what would make sense is to create a parent team which Sara is a part of, and a child team which John is a part of nested under that team. This will give access for Sara to have full visibility into her team and all teams nested below, whereas for John he will only be able to access records as per the permissions set in that nested team.

Here is a good article on creating parent-child relationships within teams. 

Please keep in mind this is an enterprise feature. 

I hope this helps, 

Ben

[AAgarwal75]

Seems like this could work but team hierarchies require an Enterprise plan. We're on Professional. In Professional, I'm trying the following ideas but none accomplish what I need.

Config 1

Sara is not assigned a team and given permission to view everything. Define a single team Team1 and put only John in it. Set John's permissions to Team Only. This doesn't work because now John can never see any of Sara's contacts, but I do want them to collaborate on some work.

Config 2

Define a single team Team1 and put both John and Sara in it. Set Sara's permissions to view everything and set John's to Team Only. This doesn't work because now John can see everything Sara can, but we want John to not have access to some of Sara's contacts. By adding Sara to the team, everyone in the team inherits her permissions.

Config 3

Define Team1 and put only Sara in it. Define Team2 and put only John in it. Set both of their permissions to Team Only. This doesn't work because now they can't collaborate on any contacts.

I'm reaching the conclusion that teams have to be either completely disjoint (Config 3) or they actually are misleading. In all other configurations, everyone will have access to everything even though the team memberships and permission settings seem like you are restricting access.

[BSmith08 · Accepted solution]

I think what you're looking to do is rather than have the permissions determined by team, have them determined by the project. Unfortunately to the best of my knowledge hubspot does not allow you to configure permissions to view contacts that way.

It would depend on what you're looking to do, but if you assigned all of those contacts to John since he's a part of those projects that would be a way to regulate the visibility, then create a separate team property to categorize the contacts, and have a view for Sara so that she can monitor how those contacts are progressing. But if you have reasons that Sara needs to be the contact owner (notifications, email tokens, etc.) that may be less ideal. Let me know if you have further questions.

Thanks,

Ben  

[AAgarwal75]

Thank you for your answers. I'll keep trying things, but so far this is disappointing. What I want is pretty straightforward. I want two users that work together on some contacts, but also need to work on other contacts separately from each other. I’m a little surprised that Professional offers teams, but the supported features don’t allow this rather simple need.

[BSmith08]

@AAgarwal75 I completely understand where you're coming from, I think this would be a valuable feature. I just wrote out a proposed idea related to this feature on the ideas board so that the product team may be able to see it and look to implement it in future updates. Hopefully, we can see this implemented at some point! 

[AAgarwal75]

Thank you for posting on the ideas board. This is a significant feature request. I won't be surprised if it isn't addressed, but what I'm more surprised by is that it hasn't already been thought about deeply. The entire permissions model seems inverted. Only users own records, and then access to that record by other users is inferred by co-membership in a team (any team).