HubSpot Ideas

DanielaMS9

Granular permissions for App Marketplace Access

Hi everyone!

(posting on behalf of a customer)

Currently, the Account > Settings > App Marketplace Access: will allow the super admin to "toggle the switch on to grant the user the ability to install apps from the HubSpot Marketplace. Users without this permission will be able to install apps from third-party websites as well as calendar integrationsemail integrationsHubSpot Ads integrations, and LinkedIn Sales Navigator."

However, it will be great to have an option that will allow selecting between 'view', 'edit', 'connect' or 'create' (for example) as other permission types. In this current scenario is "all or nothing". 

User case: They would like the users of the account to be able to download the apps from the Marketplace, but not edit the settings or to have access only to the settings of 'Salesforce', but not to 'Zoom' or not related apps. 

Thanks!

8 Replies
danny2327
Contributor

Seconded, and to add to it a bit, some more permissions/control over what apps can be installed.  If I want everyone to be able to install a certain app, I would like to be able to allowlist it, without allowing anyone to install anything they want from the marketplace.  We have security considerations such as SOC2 and having a bunch of different unknown apps makes it kind of messy.  

PSterkenburg
Contributor

Very much this: somewhere somehow each rep now needs to have full Marketplace access to be able to set up the Hubspot App for Zoom Meetings, but we don't want to do that, because then they will install whatever they want.

We need either:
* This app to just be able to be installed by a rep

* Or, blanket install on behalf of the rep

* App itself needs changing to not needing the rep to do it

* Marketplace access to be so that we can define what apps they can install
PHix
Participant

I find it insane that something like this is blanket on/off access. How is it possible that to install, for example, the Google Meet integration, individual users can install whatever they want? Many apps in the marketplace extract data from HubSpot, which is something we need to control very strictly for GDPR. Giving general marketplace access is not something that we can do.

 

The current advice provided by both HubSpot docs and CS reps is to give access, have the user install the app, and then revoke access. This is doable for smaller teams but breaks very quickly as a company scales. As @danny2327 said,  allowlisting specific apps would eliminate this issue and allow the fine-grained control we need.

PSterkenburg
Contributor

+1  to @PHix 🙌

monolithed
Contributor

Where did you find App Marketplace Access? ))

monolithed
Contributor

I faced a similar issue — it's really insane that you need super admin rights just to set up Google Meet.

ScottMoyse
Contributor

I find it baffling this is all or nothing.... I have to give full access to install apps, just so each HubSpot user can integrate Google Meetings for example. Crazy.

Shupershuff
Member

+1 on this. It's very poor security practice to grant users blanket access to all apps instead of just being able to allowlist allowed apps.