HubSpot’s user management system controls who can access what across your portal – contacts, deals, campaigns, reports, billing, and integrations. Getting this wrong creates security gaps, accidental data leaks between sales teams, and reps seeing pipelines they shouldn’t. This guide covers how HubSpot’s permission model works, how to configure teams and partitioning correctly, and the permission mistakes that cause the most friction in real organisations.
That makes administration a central part of keeping the platform secure and usable.
HubSpot user management is important when permissions, teams, and partitioning need to be set up in a way that matches the business structure. It helps control access while keeping the CRM organised across different departments or regions.
How HubSpot’s Permission Model Works
HubSpot permissions operate at two levels: user permissions (what actions a user can perform) and record visibility (which records a user can see). These are configured separately and must both be set correctly.
User permissions are role-based – you assign a permission set (or use a preset role) to each user. Permission sets define access to CRM objects (view, edit, delete, create), tools (reporting, sequences, workflows, billing), and features (importing contacts, exporting data, managing integrations). HubSpot provides default roles (Super Admin, Admin, Sales, Marketing, Service) as starting points that you can customise.
Record visibility is controlled by teams and partitioning (the latter requiring Professional or Enterprise). A user can see records assigned to them, records assigned to members of their team, or all records – depending on configuration.
Super Admins vs Regular Admins
HubSpot has two admin tiers:
- Super Admins: Full access to everything – all settings, billing, all records regardless of partitioning, all users and permissions. Super admins bypass partitioning entirely. Limit Super Admin accounts to 1-2 people (typically the CRM owner and one backup). Every additional Super Admin is a potential data leak and an accidental-deletion risk.
- Regular Admins: Can be granted individual admin permissions for specific areas (marketing admin, sales admin, reporting admin) without full portal access. Use regular admin roles for team leads who need to manage their own team’s settings without accessing billing or other teams’ data.
Setting Up Teams
Teams in HubSpot (Settings ? Users & Teams ? Teams) serve two purposes: grouping users for management purposes and controlling record visibility. Create teams that mirror your org structure: Sales Team, Marketing Team, Customer Success, EMEA Sales, US Sales – whatever matches how your organisation actually works.
Assign each user to one or more teams. Users can be members of multiple teams and can have one primary team. Team membership affects which records they can see when visibility is set to “team” level.
HubSpot also supports hierarchical teams (Enterprise): parent teams contain child teams, and managers of parent teams can see all records across child teams. This supports territory-based sales organisations where a regional VP needs visibility into multiple territory sub-teams without accessing unrelated departments.
Record Visibility Settings
For each CRM object (contacts, companies, deals, tickets), users can be configured with one of three visibility levels:
- Everything: The user sees all records in the portal regardless of assignment. Default for admins.
- Their team’s: The user sees records owned by themselves and by any member of their team(s). Standard for sales managers.
- Only theirs: The user sees only records assigned to them directly. Standard for individual sales reps in competitive or segmented sales environments.
Configure visibility per user under Settings ? Users & Teams ? [User] ? CRM permissions. Note: visibility settings must be configured individually per user – there’s no bulk apply except through teams and permission sets.
Partitioning (Professional/Enterprise)
Partitioning extends record visibility to assets – emails, forms, landing pages, lists, workflows, reports. With partitioning enabled, you can restrict which teams can view and edit specific marketing assets. This is critical for agencies managing multiple clients in one HubSpot portal, and for large organisations with distinct business units that shouldn’t see each other’s campaigns.
To assign an asset to a team: open the asset, go to its settings, and set the team in the Assign teams section. Members of the assigned team can view and edit the asset; users outside that team cannot see it (unless they have “everything” visibility or are Super Admins).
Partitioning does not apply to contacts and deals by default – that’s controlled by the record visibility settings above. Partitioning applies to marketing assets (lists, forms, emails, workflows, landing pages, reports, dashboards).
“A sales rep can see other reps’ deals and contacts”
Check two things: (1) their CRM visibility setting – if set to “their team’s” and they’re on the same team as the other reps, they’ll see all team records by design. If each rep should only see their own, set visibility to “only theirs.” (2) Check if they have any admin permissions toggled on – some admin permissions override record visibility.
“A user can’t see a workflow/form/email they need to use”
This is a partitioning issue. The asset is assigned to a different team. Either add the user to the team that owns the asset, reassign the asset to the user’s team, or if appropriate, unassign the asset from all teams (making it visible to all users with access to that tool type).
“Someone accidentally deleted a contact list / workflow”
Prevent this by removing Delete permissions for assets from users who don’t need them. In the permission set, remove the ability to delete marketing assets for standard marketing users – leave Delete only for team leads and admins. This is one of the most commonly overlooked permission configurations.
“A marketing user is changing contact properties they shouldn’t touch”
HubSpot doesn’t have field-level permission controls on contact properties for standard users – any user with contact edit permissions can edit any property. The workaround is to use read-only properties (set via the property settings to only allow editing via API/imports/certain tools) or to use workflows to enforce data integrity (overwriting manual edits with automation).
Inviting Users and Setting Permissions
Invite users: Settings ? Users & Teams ? Create user. Set their email, assign them to a team, choose a permission set (or configure custom permissions), and send the invite. New users receive an email invitation and must set their own password. HubSpot supports SSO (SAML 2.0) for Enterprise portals – users can authenticate via your identity provider (Okta, Azure AD, Google Workspace) instead of a HubSpot-specific password.
For bulk user setup, HubSpot allows importing users via CSV with pre-assigned roles – useful for onboarding large teams.
Seat Types and Costs
HubSpot’s pricing is seat-based. Core paid seats include:
- Sales Hub seats: Required for sales-specific features (sequences, prospecting, calling, deal pipelines). ~$90-100/user/month at Professional.
- Service Hub seats: Required for support-specific features (help desk, ticket management, customer portal). ~$90-100/user/month at Professional.
- Marketing Hub: Not seat-based – priced by contact volume, not per user. All portal users can access marketing tools at any seat tier.
Free seats: HubSpot allows unlimited free users with limited permissions – they can view (but not create or edit) CRM records, and cannot use paid features. Use free seats for executives who need read-only pipeline visibility, or for support staff who need to look up contact records without needing full CRM access.
Audit and Security Best Practices
- Review Super Admin accounts quarterly – remove Super Admin from anyone who doesn’t actively need it.
- Enable two-factor authentication (2FA) for all users: Settings ? Security ? Two-Factor Authentication. Require it for admins at minimum; consider requiring it portal-wide.
- Review connected integrations and which user accounts they use – connected OAuth apps inherit the permissions of the connecting user.
- When an employee leaves, deactivate their HubSpot user account immediately and reassign their owned records before deactivation to prevent orphaned records.
- Use the HubSpot audit log (Enterprise) to track user activity – logins, exports, property changes, workflow edits.
Sources
HubSpot, User Permissions and Teams Documentation (2026)
HubSpot, Partitioning and Asset Visibility Guide (2025)
HubSpot, Super Admin and Admin Roles (2025)
HubSpot, SSO and Two-Factor Authentication Setup (2025)
Is HubSpot easy to learn for beginners?
HubSpot has a learning curve, but its official free training platform HubSpot Academy provides structured paths from beginner to advanced. Most users handle day-to-day tasks within 2-4 weeks. Admin and developer skills take 3-6 months to develop proficiently.
What are the biggest HubSpot mistakes to avoid?
Top mistakes include: over-customizing before understanding your process, skipping user training, importing dirty data without cleansing, and not establishing naming conventions. Avoid these four and your implementation will be significantly more successful.
How often does HubSpot release new features?
HubSpot releases major updates quarterly. HubSpot also ships smaller updates continuously to all tiers.
Does HubSpot offer customer support?
Yes. Support is available via chat, email, and phone depending on your plan tier. Enterprise plans include dedicated customer success managers. HubSpot Academy and the HubSpot Community are excellent free support resources.
Can HubSpot integrate with other business tools?
Yes. HubSpot App Marketplace has 1,500+ integrations including Gmail, Slack, Zoom, Shopify, and WordPress.
The best user-management setup is the one that maps cleanly to how the company works. If the structure is vague, access rules become harder to maintain.
Common Permission Problems and Fixes
Common Challenges with HubSpot User Management and How to Solve Them
Problem: Getting Your Team to Consistently Use HubSpot
Adoption gaps occur when teams revert to old habits after initial training. Fix: Identify the 2-3 daily workflows where HubSpot adds the most value for your specific role. Focus training on those workflows first. Use HubSpot in-app guidance to provide contextual help at the moment of need rather than relying solely on one-time classroom training.
Problem: CRM Data Quality Degrading Over Time
CRM data decays at approximately 30% per year as contacts change roles and companies. Fix: Schedule a quarterly data quality audit. Use HubSpot deduplication tools to merge duplicate records. Establish data entry standards enforced through validation rules. Consider a data enrichment tool like Clearbit or ZoomInfo to update stale records automatically.
Problem: HubSpot Reports Not Matching Actual Business Results
Reports are only as accurate as the data entered. Discrepancies between CRM reports and actual revenue indicate data entry gaps. Fix: Audit closed-won records against actual invoices monthly. Make CRM data the source of truth for commission calculations so reps have a direct incentive to enter accurate data.