The super admin role in HubSpot gives one or more users access to account-level settings that regular users and even standard admins cannot reach. If you are setting up a HubSpot portal for a team, understanding what super admin controls and how to assign it correctly saves you from configuration problems later.
Super admin is not for every manager or team lead. Reserve it for the person responsible for billing and portal-level security. Most portals need one or two super admins at most.
In your HubSpot portal, click the settings gear icon. Under Account and Billing, you will find the Users and Teams section where super admin assignments live.
Find the user you want to elevate. Click their name to open their profile, then select Edit Permissions. Scroll to the Account section.
Toggle Super Admin on. You will see a confirmation prompt. The change takes effect immediately. The user now has access to billing, security settings and all account-level defaults.
After assigning super admin, check what that user can now reach: connected integrations, payment methods and portal deletion; it also controls security enforcement across all users.
What does a HubSpot super admin actually control?
Super admin is a separate layer on top of the standard HubSpot permission sets. A user can have full CRM access or Marketing Hub access without being a super admin. The super admin role specifically unlocks:
- Billing and subscriptions: viewing invoices, upgrading seats, managing payment methods
- Connected accounts: adding or removing Google Ads, Meta, LinkedIn, or other integrations at the portal level
- Security settings: enforcing two-factor authentication and managing login policies
- Private apps and API: creating and revoking private app tokens used by integrations or custom builds
- Account defaults: setting the default currency and time zone for the portal
- Domain connections: connecting primary domains and subdomains used by landing pages and email
Regular HubSpot admins can do a lot, but they cannot touch billing or security enforcement. That distinction matters when you are onboarding a team and want to give managers broad CRM control without exposing sensitive account settings.
How does super admin differ from a standard HubSpot admin?
A standard admin in HubSpot can manage users and configure most CRM settings. They are powerful inside the portal.
The difference is account-level authority. A standard admin cannot see or change billing, and cannot delete the portal. Super admin adds those capabilities on top of whatever else the user already has access to.
Think of standard admin as operating the portal. Super admin is owning the portal. In practice, this means:
- Your marketing manager might be a standard admin to manage their own team’s access
- Your IT or operations lead holds super admin to control integrations and security
- The business owner or MD often holds super admin for billing visibility
How many super admins should a HubSpot portal have?
HubSpot allows multiple super admins on a single portal. The practical question is how many you actually need.
For most small-to-mid-size teams in Southeast Asia, two super admins is a reasonable baseline. One is the primary owner; the second is a backup in case the primary is unavailable. Having a backup matters most when the account needs urgent changes, like rotating an API key after a security incident or updating billing before a renewal date.
Avoid distributing super admin broadly. Every additional super admin is an additional surface for account-level changes to be made without visibility. If someone needs to manage users or workflows, the standard admin role covers that without touching billing or security.
Review your super admin list once or twice a year. People leave organisations or move to roles where that access is no longer appropriate. HubSpot does not automatically downgrade a super admin when their responsibilities shift, so the review is on you.
Can you limit what a super admin can see or do?
No. Super admin access in HubSpot is all-or-nothing at the account level. You cannot grant a super admin billing access but block them from API settings. The role is a single toggle that unlocks the full account-level layer.
If you need to control specific capabilities within the portal, use standard permission sets and teams instead. Those are granular. Super admin is intentionally broad because it is designed for the people who are accountable for the account as a whole.
For portals where multiple clients or business units share one HubSpot instance, the alternative is HubSpot Teams combined with careful use of user permissions. Teams let you partition data visibility without making everyone a super admin.
What happens when a super admin leaves the organisation?
This is where many teams run into problems. If the only super admin on a portal is a person who has left, the remaining team may not be able to change billing or manage integrations.
HubSpot’s support team can assist with account recovery in documented cases, but the process takes time and requires proof of ownership. Preventing the situation is far simpler than resolving it.
Before offboarding a super admin:
- Assign super admin to at least one other active user first
- Confirm the outgoing user’s connected accounts and integrations are documented
- Rotate any API tokens the departing user created, to avoid orphaned credentials
- Remove super admin from the departing user, then deactivate their account
Deactivating without removing super admin first is a common gap. HubSpot deactivated users cannot log in, but the access flag remains in the system. Cleaning it up before deactivation is the cleaner path.
How should you document super admin access for your organisation?
Good portal hygiene includes keeping a record of who holds super admin access and why. For teams that go through audits or have compliance requirements, this record is useful evidence that access is controlled.
A simple document listing the current super admins and the date access was granted is enough for most organisations. Pair it with a calendar reminder to review the list on a set schedule, typically at the start of each quarter or after any significant team change.
If your HubSpot portal is connected to financial systems or platforms that store personal information, the super admin list is part of your data access controls. Treat it with the same discipline you would apply to any other privileged account in your organisation.
Frequently asked questions
Can I see a log of what super admins have done in HubSpot?
HubSpot maintains an audit log available to super admins under Settings. It records user login activity and some account-level changes. The depth of logging depends on your subscription tier.
Does the HubSpot free plan support super admin?
Yes. Super admin exists on all HubSpot plan tiers, including the free CRM. The account-level settings available will vary based on what features your plan includes.
Can a super admin grant super admin to someone else?
Yes. Any super admin can assign super admin to another user. The permission is self-replicating, which is another reason to keep the list small and reviewed regularly.
What if I forget who the super admin is on our portal?
Go to Settings, then Users and Teams. Filter or sort users by super admin status. Any active super admin will be visible there.
For more on managing who has access to what inside your HubSpot portal, see the guides on HubSpot user permissions and HubSpot Teams.
This guide is an independent informational resource produced by a HubSpot Platinum Partner. HubSpot is a trademark of HubSpot, Inc.
Planning a HubSpot setup or integration in the region?
Contact us