HubSpot user permissions control who can see, edit, and delete data in your CRM. Getting them right early saves a lot of cleanup later — and prevents team members from accidentally changing pipeline stages, deleting contacts, or accessing data they shouldn’t.
This guide explains how HubSpot permissions work, what the common setups look like for Southeast Asian teams, and how to configure access so each person has exactly what they need.
| Permission Level | Typical Use Case | Key Access |
|---|---|---|
| Super Admin | CRM owner or implementation lead | Full access to all settings, users, billing, and data |
| Admin | Department heads, team leads | Manage users and tools within their scope; no billing |
| Standard User (custom) | Sales reps, marketers, support agents | Access limited to their tools and assigned records |
| View Only | Executives, finance, external reviewers | Read reports and dashboards; no edits |
How does HubSpot’s permission system work?
HubSpot uses a combination of account-level permissions and CRM-level permissions to control what each user can do. Account-level permissions cover things like accessing specific hubs (Marketing Hub, Sales Hub, Service Hub) and admin functions like adding users or changing settings. CRM-level permissions control what users can do with objects like contacts, companies, deals, and tickets.
Within CRM objects, you can set access to:
- View — whether the user can see the record at all
- Edit — whether they can update properties
- Delete — whether they can remove records
- Communicate — whether they can send emails or log activities from that record
Each of these can be scoped to Everything (all records), Team only (records owned by their team), or Owned only (records they personally own).
What is a Super Admin in HubSpot?
The Super Admin role grants full access to every setting in your HubSpot account, including billing, user management, integrations, and all CRM data. Most teams should limit Super Admin access to one or two people — typically whoever manages the HubSpot implementation.
If you are working with an external HubSpot partner, they will often ask for Super Admin access during setup. Once the implementation is complete, you can downgrade them to a standard user role or remove them entirely, depending on the ongoing support arrangement.
How do I set up permissions for a sales team?
A typical sales team setup in HubSpot gives each rep the ability to view and edit their own deals and contacts, but restricts access to deals owned by other team members. This avoids reps accidentally overwriting each other’s data and keeps deal ownership clear.
A common configuration for sales users:
- Contacts: View All, Edit Owned, Delete None
- Deals: View Team, Edit Owned, Delete None
- Reports: View only (not edit or create)
- Sequences: Access enabled (if on Sales Hub Pro or above)
Sales managers typically get a step up: View All on deals, the ability to edit team records, and access to forecasting and the full pipeline view.
What about marketing users?
Marketing users generally need broader access to contacts and companies (for segmentation and list building), but rarely need to edit deals or view the full pipeline. A clean marketing user setup typically includes:
- Marketing Hub tools: Full access to emails, forms, lists, landing pages, and campaigns
- Contacts: View All, Edit All (needed for list management and lifecycle stage updates)
- Deals: View only (so they can see what’s in the pipeline, not edit it)
- Reports: View and Create (so they can build their own dashboards)
If your marketing team is running automation workflows, make sure they have access to create and edit workflows. This is set separately under Marketing Hub permissions.
How do I use teams to manage permissions at scale?
As your team grows, managing permissions individually becomes time-consuming. HubSpot’s Teams feature lets you group users, then apply ownership-based access rules across the group. A deal owned by anyone in the “Bangkok Sales” team becomes visible to all members of that team.
This is particularly useful for regional setups common in Southeast Asia, where you might have a Bangkok team, a Singapore team, and a regional manager who needs cross-team visibility. You can set the regional manager’s access to View All across deals and contacts, while each team member sees only their own team’s records.
To set up teams: go to Settings > Users & Teams > Teams, create the team, and add users. Team membership then feeds into the “Team only” filter in every CRM permission setting.
What permissions do I need for HubSpot reporting?
Reporting permissions in HubSpot are set separately from CRM object permissions. Under a user’s permissions, look for the Reports section. You can grant:
- No access — cannot view or use any reports
- View — can see shared dashboards and reports, but not create new ones
- Edit — can create and modify their own reports and dashboards
Most users benefit from at least View access to shared dashboards so they can monitor performance. If you are using the HubSpot reporting features heavily, consider giving team leads Edit access so they can build their own views without needing a Super Admin to do it for them.
How do I add a new user in HubSpot?
Go to Settings > Users & Teams > Users and click Create user. Enter the email address, assign a permission set, and select which hubs the user should have access to. HubSpot will send the new user an invitation email.
If you add users frequently, it is worth creating permission sets — saved templates that apply a standard group of permissions in one click. You can create these under Settings > Users & Teams > Permission Sets. A “Sales Rep” permission set and a “Marketing User” permission set cover most recurring cases.
What should I audit before expanding the team?
Before bringing new team members into HubSpot, run a quick permissions audit:
- Review who has Super Admin access and confirm it is limited to the right people
- Check whether any departed team members still have active accounts
- Confirm that deal and contact ownership is assigned correctly (unowned records are a common data quality issue)
- Make sure your permission sets reflect the actual access levels your team needs today, not what was set up at launch
Clean permissions feed into better data quality across the board. When users have access to records they shouldn’t edit, small changes accumulate and create inconsistencies that are hard to trace later.
Frequently asked questions
Can I restrict a user from seeing specific contacts?
HubSpot’s default permission scopes are All, Team, or Owned. There is no built-in row-level filtering by contact property (e.g. hiding a specific industry segment). If you need granular data separation, consider using separate HubSpot portals or property-based lists to control what different teams see in their default views.
Does HubSpot charge per user?
HubSpot’s paid plans include a set number of paid seats. Additional seats cost extra, though the exact pricing depends on your hub and tier. Free CRM access is available to unlimited users, but paid hub features require a paid seat. Check the current pricing on HubSpot’s pricing page for your hub.
What happens if I change a user’s permissions?
Changes take effect immediately. If you reduce a user’s access, they will lose visibility of records or tools straight away. If they are mid-task, this can cause confusion, so it is worth communicating permission changes in advance.
Can I give a partner or agency access without making them a full user?
HubSpot does not have a native guest or limited-access mode for external parties. The practical approach is to create a standard user account for the agency contact, assign the minimum permissions they need for the engagement, and remove or downgrade their access when the project is complete.
Planning a HubSpot setup or integration in the region?
Contact us