Summary and recommendation
HubSpot user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.
HubSpot's user management lives at Settings → Users & Teams → Users. Admins control access through a hybrid permission model: named permission sets (available on all paid tiers) layered with per-object, per-action, and per-scope toggles.
Every app in your stack that touches CRM data depends on these permissions being accurate, so seat type and permission set assignments both need to be correct at onboarding.
Three seat types exist independently of one another: Core, Sales Hub, and Service Hub. A user can hold a Core seat without a Sales or Service seat and will lack Hub-specific paid features even if the portal is on a qualifying plan tier. Seat assignments are additive and each incurs separate cost.
Quick facts
| Admin console path | Settings (gear icon, top nav) → Users & Teams → Users tab |
| Admin console URL | Official docs |
| SCIM available | Yes |
| SCIM tier required | Professional or Enterprise |
| SSO prerequisite | Yes |
User types and roles
| Role | Permissions | Cannot do | Plan required | Seat cost | Watch out for |
|---|---|---|---|---|---|
| Super Admin | Full access to all settings, all Hubs, billing, user management, integrations, and account-level configuration. Can grant and revoke any permission for any user. Bypasses all permission sets entirely. | Cannot be restricted by permission sets. No permission can be withheld from a Super Admin by another admin. | All plans (Free and above) | Counts as a paid seat on paid plans; free on Free tier | Super Admin status is separate from seat type. A user can be Super Admin without a Sales or Service seat but will lack Hub-specific paid features. Only existing Super Admins can grant Super Admin status to others. The UI blocks removal of the last Super Admin on an account. |
| Standard User (Core Seat) | Access to CRM objects (contacts, companies, deals, tickets), marketing tools, and shared content as configured by admin via permission sets. Default permission set applied on invite. | Cannot access billing, cannot manage users unless explicitly granted 'Users and Teams' permission, cannot access Hub-specific paid features without the corresponding paid seat. | All plans; Core seat included in base subscription | Included in base platform subscription (e.g., $15/seat/mo on Starter Customer Platform) | Core seat does not include Sales Hub or Service Hub paid features. Assigning a Sales or Service seat is a separate, additive action that incurs additional cost. |
| Sales Hub Seat User | All Core Seat permissions plus Sales Hub-specific features: sequences, calling, deal pipelines with advanced automation, sales analytics, playbooks (Enterprise), and prospecting workspace. | Cannot access Service Hub-specific features (e.g., customer portal, SLAs) without a Service seat. | Sales Hub Starter, Professional, or Enterprise | Sales Hub Professional: $100/seat/mo; Sales Hub Enterprise: $150/seat/mo | Sequences and some automation features are gated by both seat type and plan tier. A user must have an assigned Sales seat to use sequences even if the portal is on Professional tier. |
| Service Hub Seat User | All Core Seat permissions plus Service Hub-specific features: help desk, customer portal, SLAs, customer feedback surveys, and service analytics. | Cannot access Sales Hub sequences or prospecting tools without a Sales seat. | Service Hub Starter, Professional, or Enterprise | Service Hub Professional: $90/seat/mo; Service Hub Enterprise: $130/seat/mo | Customer portal and SLA features require Service Hub Professional or Enterprise seat assignment per user. Starter-tier Service seats have reduced feature access. |
| View-Only / Limited Access User (via permission set) | Can be configured via permission sets to have read-only access to specific CRM objects, reports, or dashboards. No edit or create rights. | Cannot create or edit records, cannot send emails, cannot manage settings. | All plans; permission set configuration available on all tiers | Still consumes a Core seat on paid plans | HubSpot does not have a dedicated free viewer seat type. Any user, even read-only, consumes a paid seat on paid plans. There is no cost reduction for restricting a user to view-only access. |
| Partner User (via Partner Portal) | Agency or partner users added through HubSpot's Solutions Partner Program can access client portals with scoped permissions as configured by the client account Super Admin. | Cannot exceed permissions granted by the client portal's Super Admin. | Requires HubSpot Solutions Partner Program membership | Partner access seats are managed separately through the partner program; may not consume client's paid seats depending on configuration | Partner access is managed through a separate partner portal view. Permissions must be explicitly granted per client account. Partner users are not provisioned via SCIM. |
Permission model
- Model type: hybrid
- Description: HubSpot uses a hybrid model combining predefined permission sets with granular per-object and per-feature toggles. Admins can create named custom permission sets (templates) and assign them to users. Permissions are organized into categories: CRM (contacts, companies, deals, tickets, activities), Marketing, Sales, Service, Reports, and Account. Each category has sub-permissions (view, edit, delete, bulk delete, import, export). Object-level permissions can be scoped to 'Everything', 'Team only', or 'Owned only'. Super Admin bypasses all permission sets entirely. Pipeline-level permission scoping requires Enterprise in some Hubs.
- Custom roles: Yes
- Custom roles plan: All paid plans (Starter and above); permission set creation available on all tiers
- Granularity: Per-object (contacts, companies, deals, tickets), per-action (view/edit/delete/export/import/bulk delete), per-scope (all/team/owned), per-Hub feature (sequences, calling, campaigns, etc.), and account-level settings (billing, users, integrations). Pipeline-level permission scoping requires Enterprise in some Hubs.
How to add users
- Navigate to Settings (gear icon) → Users & Teams → Users tab
- Click 'Create user' button (top right)
- Enter the user's email address (one or multiple, comma-separated for bulk invite)
- Select seat type to assign: Core, Sales Hub, Service Hub, or none for Core only
- Choose a permission set to apply or configure custom permissions inline
- Optionally assign the user to one or more Teams
- Click 'Send' to dispatch the invitation email
- User receives an email invite and must accept to activate their account and set their password
Required fields: Email address
Watch out for:
- Invitations expire after 7 days; admin must manually resend if user does not accept in time
- User's name and profile details are set by the user upon first login, not by the admin at invite time
- Assigning a paid seat (Sales, Service) at invite time immediately counts against the portal's purchased seat count and may trigger billing
- If SCIM provisioning is active, users should be provisioned from the IdP to avoid sync conflicts; manually invited users may not be fully managed by SCIM
- Email domain restrictions can be configured to limit which email domains can be invited (Enterprise tier)
- Bulk CSV import has limited field mapping; custom user properties cannot be set via CSV
| Bulk option | Availability | Notes |
|---|---|---|
| CSV import | Yes | Settings → Users & Teams → Users → 'Create user' → 'Import users from CSV' option within the create user flow |
| Domain whitelisting | No | Automatic domain-based user add |
| IdP provisioning | Yes | SCIM 2.0 available on Professional or Enterprise (all Hubs); SSO (required for SCIM in practice) requires Enterprise tier |
How to remove or deactivate users
- Can delete users: Verify in tenant
- Delete/deactivate behavior: This app exposes delete operations in its API documentation, but the admin-console path may present removal as deactivation, archiving, or deletion depending on tenant configuration. Confirm whether the UI action is reversible before treating removal as recoverable.
- Navigate to Settings (gear icon) → Users & Teams → Users tab
- Locate the user by name or email using the search bar
- Click the 'Actions' dropdown next to the user's name
- Select 'Remove user'
- In the confirmation dialog, optionally reassign the user's owned records (contacts, deals, tickets) to another active user
- Confirm removal; the user is immediately deactivated and loses portal access
| Data impact | Behavior |
|---|---|
| Owned records | Owned records (contacts, companies, deals, tickets) remain in the portal. Admin is prompted during removal to reassign ownership to another active user. If not reassigned at removal time, records retain the deactivated user as owner and must be bulk-reassigned separately via CRM views or workflows. |
| Shared content | Email templates, sequences, documents, and other content created by the user remain in the portal and are accessible to other users. The deactivated user is listed as the creator. Sequences enrolled by the removed user stop sending to enrolled contacts. |
| Integrations | Connected integrations (e.g., Gmail, Outlook, calendar sync) tied to the user's account are disconnected upon deactivation. Sequences or workflows using the user's connected inbox will stop sending. Meeting links created by the removed user break and return errors to prospects attempting to book. |
| License freed | The paid seat (Core, Sales, Service) is released immediately upon deactivation and becomes available for reassignment. Billing reduction typically applies at the next renewal cycle per HubSpot's billing terms, not immediately mid-cycle. |
Watch out for:
- Deactivated users cannot be permanently deleted; their record persists in the portal indefinitely and appears in owner dropdowns and filters
- If the removed user was the only Super Admin, the UI blocks removal; another Super Admin must be designated first
- Sequences actively enrolled by the removed user pause or stop with no automatic reassignment; enrolled contacts may not receive remaining sequence steps
- Workflows with the removed user as the 'from' sender for emails will fail unless updated to a different active sender
- Meeting links created by the removed user break immediately and return booking errors to prospects
- If SCIM-provisioned, deprovisioning in the IdP triggers deactivation in HubSpot automatically; manual removal in HubSpot UI while SCIM is active may cause IdP sync conflicts
- Deactivated users still appear in owner dropdowns and filter options in some CRM areas, causing confusion for active users
License and seat management
| Seat type | Includes | Cost |
|---|---|---|
| Core Seat | Access to CRM, marketing tools, shared dashboards, and basic platform features. Required for any user to log in on a paid plan. | Included in base Hub subscription; on Starter Customer Platform, $15/seat/mo covers all Hubs at Starter tier |
| Sales Hub Seat | Sales Hub-specific features: sequences, calling, deal automation, prospecting workspace, sales analytics, playbooks (Enterprise). Additive to Core Seat. | Sales Hub Professional: $100/seat/mo; Sales Hub Enterprise: $150/seat/mo |
| Service Hub Seat | Service Hub-specific features: help desk, customer portal, SLAs, customer feedback surveys, service analytics. Additive to Core Seat. | Service Hub Professional: $90/seat/mo; Service Hub Enterprise: $130/seat/mo |
- Where to check usage: Settings (gear icon) → Account → Account & Billing → Seats tab (shows purchased vs. assigned seats per type); also visible at Settings → Users & Teams → Users (seat column per user row)
- How to identify unused seats: Navigate to Settings → Users & Teams → Users, then sort or filter by 'Last login' date to identify users who have not logged in recently. HubSpot does not provide a native unused seat report or automated dashboard; admins must manually review last login timestamps in the Users table. Sales and Service seat assignments are visible per user in the Users table.
- Billing notes: HubSpot bills on a per-seat basis for Sales Hub and Service Hub seats. Core seats are included in the base subscription up to the purchased quantity. Adding seats mid-cycle is prorated. Removing seats by deactivating users frees the seat immediately but billing reduction typically applies at next renewal. Marketing Hub is priced by contact tier (not per seat), so all users share Marketing Hub access without individual seat costs. Mandatory onboarding fees apply for Professional ($1,500) and Enterprise ($3,000–$7,000) tiers as one-time charges.
The cost of manual management
HubSpot does not offer a native unused-seat report. Identifying inactive users means manually sorting the Users table by Last Login - there is no automated dashboard or scheduled alert. For portals with dozens of users across multiple Hub seat types, this review compounds quickly.
Deactivated users are never permanently deleted. Their records persist in the portal indefinitely, continue to appear in owner dropdowns and CRM filters, and accumulate over time. Every app that surfaces owner fields - deal pipelines, ticket queues, contact records - will show these ghost users until an admin manually reassigns owned records.
Sequences and meeting links break immediately on deactivation with no grace period and no automatic reassignment. Workflows that use the removed user as an email sender will also fail silently unless updated before or immediately after removal.
What IT admins are saying
The HubSpot community has logged sustained feedback on three friction points. First, the inability to permanently delete users is one of the platform's most-upvoted Ideas submissions; deactivated records pile up and pollute owner fields across every app connected to the CRM.
Second, SSO is gated at Enterprise tier while SCIM is available at Professional - a gap that leaves mid-market customers unable to automate provisioning without upgrading solely for SSO access.
Third, multi-Hub seat pricing across Sales, Service, and Marketing tiers makes cost forecasting difficult when user roles shift between teams.
Common complaints:
- Users cannot be permanently deleted from a portal, only deactivated; deactivated user records accumulate indefinitely and clutter owner dropdowns and CRM filters
- SSO is gated at Enterprise tier despite SCIM being available at Professional, creating a disconnect for mid-market customers who want automated provisioning without full Enterprise pricing
- Complex multi-Hub seat pricing makes it difficult to predict total user management costs, especially when mixing Sales, Service, and Marketing Hub tiers across different plan levels
- User attributes (name, email) set via SCIM cannot be edited in HubSpot UI after provisioning; changes must be made in the IdP, which is not always obvious to admins
- Meeting links and sequence enrollments break immediately upon user deactivation with no grace period or automatic reassignment to another user
- No native unused seat report or last-login dashboard; identifying inactive users requires manual review of the Users table
- Invitation emails expire after 7 days with no automatic reminder sent to the invitee or admin, requiring manual resend
- Bulk user import via CSV has limited field mapping compared to SCIM; custom user properties cannot be set via CSV import
- Permission sets cannot be scoped to specific pipelines in all Hub tiers; pipeline-level permissions require Enterprise in some Hubs
- Deactivated users continue to appear in owner dropdowns and filter options across the CRM, causing confusion for active team members
The decision
Manual management is viable for small, stable teams on Professional tier where SCIM is available but SSO is not yet justified. The workflow is straightforward: invite by email, assign seat type and permission set, and deactivate via the Actions menu when offboarding.
The calculus changes at scale. Without SSO (Enterprise-only), there is no IdP-driven provisioning, which means every new hire and departure is a manual action. Invitation links expire after seven days, seat assignments trigger billing immediately, and deactivation leaves orphaned records that require separate cleanup across every app the user owned records in.
Teams managing more than 20–30 users, or those with frequent role changes, should weigh the Enterprise upgrade cost against the ongoing manual overhead - particularly the hidden cost of broken sequences, stale owner assignments, and the absence of any automated inactive-seat detection.
Bottom line
HubSpot's manual user management is functional but carries compounding operational debt at scale.
Deactivated users never disappear, seat costs accrue immediately on assignment, and there is no native tooling to surface inactive licenses - meaning every app that relies on accurate CRM ownership is only as clean as the last manual audit.
Teams that need automated provisioning face a hard tier boundary: SCIM is available at Professional, but SSO - its prerequisite for meaningful IdP integration - requires Enterprise, along with mandatory onboarding fees of $3,000–$7,000.
Automate HubSpot workflows without one-off scripts
Stitchflow builds and maintains end-to-end IT automation across your SaaS stack, including apps without APIs. Built for exactly how your company works, with human approvals where they matter.
