Governance | HubSpot Admin HUG | September 12, 2023
Amy Chamness walks through HubSpot's governance tools: user management, permissions, approvals, audit logs, and the security center. For admins managing access and compliance across their CRM.
Okay, it's recording. There we go. Welcome to this session of the HubSpot admins user group. Today we are talking about governance and we're very happy to have Amy Chamness here with us. Amy, I'll just pass it right over to you.
Awesome, thanks. I'm going to give this sharing a screen a go and I'm going to rely on you folks to let me know if you can see what looks like slides.
I can see what's a boring fact about yourself.
Okay, yes, this we can move right beyond because I want to dive into the topic, but if people want something to talk about in chat. This was a recent icebreaker. Somebody asked me, which I thought was brilliant because nobody can think of a fun fact about themselves, but plenty people can think of boring facts about themselves. So feel free to answer that if you so choose. But I'm going to dive right into the topic for today, which is governance. I'm really happy to talk about this, partially because I hope it provides a little bit of a breather from the big three that most of you probably heard about at Inbound, but also to talk about how governance kind of fits into the smart CRM and some of the CRM customization launches that we launched at Inbound. So governance, broadly speaking, we're going to be talking about user management, security in your account and portals, approvals and more. All right, really quick slide on what you should aim to sort of gain from this talk. Talk. I want to sort of talk about why governance is critical. The benefits of HubSpot's governance solution broadly, and then most importantly, share some key resources and proof for you to take away. And there will also be, as always, a live demo, which we will dive into here in a little bit. Okay, let's take a step back though, and talk about what it is. I mean when I say governance, because it's a fairly loaded term if you just look it up in the dictionary. It's defined as the act or process of governing or overseeing control and direction of something, which I always laugh when I read that because, like, how many broad words could they fit into a definition? Generally speaking, when we talk about governance and HubSpot, we're talking about a layer, typically on top of our customer platform, of visibility and control of your users, your data and your accounts. Should you manage multiple accounts? I think the sort of like, underlying commonality between all of these things and the reason we leaned into the term governance at HubSpot is because they both have something to do with control, which is something that we typically hear in terms of a theme coming up from admins, which is why I wanted to talk to this group today. So let's dive into who cares about all of this control. I sort of foreshadowed the concept of admins, of course, caring about this. So generally speaking, if you have a super admin in your portal, that's probably the person or persons who care about controlling all of that data and users and processes. But we also see that across a new sort of like burgeoning group of HubSpot users. So we have the admin and then we have this new forthcoming user sort of Persona, and that's the tech executive. And oftentimes these two Personas overlap. I'm sure many of you on this webinar right now kind of inhabit both roles. Just to kind of give you a little bit of information about the tech executive and what I mean by that, those are typically people who hold roles like director of IT or the CIO or CTO of a publicly traded company, director of technology, things of that nature. They typically are really concerned about security platforms, governance platforms, compliance, scaling those systems, ensuring that they're cutting cost and proving ROI for those systems. So, so they are typically really strong influencers in the purchase of a new software. On the flip side, we have our admins, which I'm guessing most of you folks are, and these are people who are usually actually implementing these systems and ensuring that that control and that scalability and that security are all in place across the system. So that's CRM admins, system administrators, rev ops, sales and marketing ops, you name it. Typically, like I said, these are the folks who are actually contributing and building these things. I spell all this out for a very specific reason. And that being we're really going to be talking about the implementation of these tools, which is probably going to be most relevant to that bottom Persona, that admin or rev ops Persona. But it's worth keeping in mind that that sort of tech executive role is very much and increasingly so involved in these decisions as well. Well, a really quick stat which you may or may not find interesting that we recently did some research around IT executives or that tech executive. They are involved in 76% of the overall purchasing journey for software purchases and are responsible for making the software purchases purchasing decisions of 43% of the time. So just a note kind of underlying the point that they are very involved. Okay, but now I want to sort of get into the actual product because that's the meat and potatoes of this talk and I want to Talk about the concerns of those admins who are actually implementing these governance protocols or governance controls within an account. The first concern that we typically hear come up is data security or data privacy. This has always been important. It's increasingly so in the age of AI and ensuring that our data is being used not only in a secure way, but in a responsible way and in a way that benefits not only the business, but customers at your business and all of that good stuff. A really good sort of pull quote or testimonial that we have heard around this is permissioning, right? So really needing separate permissions, meaning that there is no way in any world that one person is going to look at something they shouldn't be looking at or be able to access something they can't access. So this is a really common sort of point of concern when we talk about permissions. Another concern here is rli, which I don't know is entirely obvious when you talk about governance, but it does interestingly come up a ton, right? So having solutions and controls within your solutions that allow users to be really efficient and trusting of the data and the processes that they're accessing so that they can get up to speed, adopt it faster, and ultimately hit a return on investment, which is often about adoption. So I'll pull quote here. Coming onboard into HubSpot, right? Getting buy in from the entire team quickly allows you to move away from your legacy systems and have high adoption for less cost. And then lastly, scalability, right? So this really leans into some of the topics that you may or may not have seen at Inbound, if you followed the inbound updates, but making sure you have a scalable and adaptable solution so that your processes and your governance controls can scale with your business as it scales. And so we talk about, of course, having a CRM or a platform more broadly that has that functionality that can continue to scale. So when I talk about these specific concerns, I want to sort of align the HubSpot solution to each of those three concerns and then that'll help us break down what it is. Exactly. I'm going to demo to you all today. So what is the HubSpot solution? Grounding us back into that definition of governance, we have a solution for each of these three sort of components of governance. So when it comes to users, we have a solution that allows you to increase visibility and control of the user object. Note that term user object will come back to it and allow for faster adoption of the CRM. And that kind of ties into that return on investment point when it comes to data, we have a solution that allows even more granular control over your data so that businesses can have their teams working securely and then finally across again accounts. If you work in multiple accounts or even just one smart CRM that is easy to adapt so that you can scale your processes with your business. And in here I foreshadowed some of the actual product that I'm going to demo and talk to you about today. But I want to kind of spell that out a little bit more distinctly. I'm going to zoom past this slide a little bit. I'll leave it here for your memory. But really thinking about HubSpot solution as one that allows you to grow confidently. And now I'm going to jump in and I note that I am talking really fast right now. It is intentional, it's a fairly long demo, but I want to talk about some key product that fits into those governance solutions that we just talked about. I am recognizing that this font's a little small, so I'm actually going to read through this just in case. It's hard to see, but we're going to start by talking about a user record, which is a new and improved element in the HubSpot platform. It has a refreshed flow when creating a user and then it also has the ability to edit first and last name. With much more on the roadmap for the user record, which we will talk about. Then we'll move into some permissioning, so we have some new permissions to talk about, both custom object permissions and approval permissions. Again, much more on the roadmap to talk about there. I want to jump into a demo of approvals and all of the granular permissioning and functionality that is inherent to the approval solution in HubSpot. And then we're going to talk about two key governance tools in HubSpot, so centralized audit logs and the security center. I think I have a queue in here.
Yeah, yeah. Just before you hop in, I want to highlight a couple things coming up in the chat. A couple people just to color your demo as you're going. A couple people have mentioned wishing there there could be more separation between seats and permissions. Yep. And just treating those two things separately, which I'm going to guess you can talk through and then something I assume you will not be touching on. So I'll just address right now a couple people are, are bringing up HIPAA compliance and that is, that is a thing that every year in planning season someone suggests and so far has not happened in HubSpot believe me friends, if HubSpot ever works toward becoming HIPAA compliant, I will tell you.
Yeah, yeah, yeah, I can talk about both of those. I can give a little bit of commentary and color around the HIPAA compliance convers exist within the HubSpot hallways. We definitely can talk about that. And yeah, let me know if any other sort of points come up. As I'm demoing here, I'm going to try to zoom in a little bit too so that you just can see what I'm talking about. We can talk about the seats piece actually more explicitly here. In the first part of the demo, which is talking about the user record and creating users there was actually I'm going to jump into the settings of my demo portal here and I'm going to specifically on the left hand side jump into users and teams. For those who haven't noticed this or noted it in your portals, there's a couple of UI updates in HubSpot that are relevant here. The first is that you'll see there was an update to the Global Navigation and the toolbar up top. So you'll notice, well, first and foremost we have sort of the new search experience in HubSpot. It's really hard to demo because you have to know what you're searching. But just to note that some of the changing in the UI here and some of the updates to the toolbar were in preparation for the updated search experience as well. So just wanted to quickly call that out. Another thing you'll notice different in the UI as we've actually started the process of something that'll be a longer term implication here, but separating seats out from users and from permission sets. So that gets to sort of the direction of the question of can we treat seats a little bit differently? I think we haven't finished the swing there. Right. So if I step into the seats tab, you can see some new elements in the ui. You can see how many seats are assigned compared to the number of seats available within that given account. You can remove unassigned seats if you need to do that for any reason, an account and then you can come down here and see users, what seat they have assigned and then a couple of other elements given to that user, like what is their permission set and have they accepted their invite and when were they last active. So this is. I just wanted to call that out. As to the seats piece, this is something that you're going to see more in the coming months just in terms of how we treat seats differently and making it a little bit easier to manage those seats. If you are an admin, people are.
Asking the state of this new ui. Is this a beta they need to opt into or is it rolling out?
Yeah, great question. It's rolling out so there is a chance you could could already see it. But it is in a beta. So if you go into where you would normally opt into a beta within your portal, you should see it there too. If you don't for any reason, let me know and I can take a look at it. But yeah, it's in a beta state, but it's in a beta state that's automatically rolling out as well. If you wait with enough time, you will see it.
If you don't have it now, you should have it soon.
Yes, yes, exactly. Cool. Let's jump into the user record piece. I'm going to go ahead and actually just create a fictional user for the point of this demo to show you guys couple of things. The first is that there is a new and improved creation flow. When you're creating users. You can do this in bulk from a CSV file, or you can just type in fake email if you want to do that. You can also type in multiple emails separated by commas if you need to do that too. I'm actually going to do that because why not show you guys what that might look like. Okay. When you click next, you'll notice something that looks pointedly different than the user creation flow used to look. You now have multiple options for how you want to provision a user in HubSpot or how you want to assign the permissions that they're going to have access to. It's going to default to starting with a template. So there will be some number of default templates available to you that will be dependent on what hubs that portal has and what access to the hubs those have. But you will see minimally some number of templates you can use. A really common one being of course the Super Admin templates. So if you just want a quick use a HubSpot generated template, you can do that. You can also use a custom permission set if you have the correct provisioning in that portal. So if you've never used permission sets or created permission sets, they're essentially a way of grouping and then naming a set of permissions and then assigning them to a user. In a way, it's like creating a template, but doing it from the ground up and in a way that is hyper specific to the needs of that portal. So you could of course use a permission set as you can see in my own test portal here I have a couple like, for example, Regional Sales Manager might be a permission set I use. Then finally you can also just start from scratch, which is historically the way you might have thought about assigning permissions to users. I'm just going to go ahead and use a template because it's easy and it's relevant to this demo. Another element that is different in this UI is this sort of preview look of what a given template or permission set or if you're starting from scratch, what the actual end result is going to look like for that given user. So you can see across our different hubs and the CRM what they're going to have access to. And then this UI is a little bit nuanced in that you'll see that we can know if it's partial access or full access or no access. So for a lot of areas, content or data in HubSpot, you can have this concept of partial access. So for example, rentals is a custom object in my portal. You could get access to view but not edit. That would be an example of partial access. Then as I scroll down, you can see this goes across reporting and account settings as well. Finally, you do have this option to actually continue to narrow down the access beyond a permission set or a template if you want to. When I go to narrow access down here, I'm actually going to see every permission available in HubSpot spelled out and editable to me. It's going to inherit the permissions of whatever template or permissions that I'm using. But I can tweak from there on out if I need to. I'm not going to, in this case, review access. This is also additional ui. It's new UI we're putting in plain English or depending on what language you speak and what language your portal set to putting it in plain language, what exactly these permissions are actually doing and granting for that user. And then finally you can go ahead and click Next you can send an invite. If you want to send an invite, I'm going to not do that. Click send and you've created created users with the relevant permissions. I'm going to go ahead and click Done. That sort of demonstrates that new user flow, but I also foreshadowed this concept of a new user record.
Sorry, got some questions about the flow we just went through. First, several people are wondering if there's anywhere on your roadmap that will be able to clone permission sets. So if someone has created one permission set and then another Team needs a very similar permission set. Could you clone it and use a starting point to customize it for that group?
Really good question in terms of is it on our roadmap? Not in the short term. Is it something we've talked about? Yes, definitely. It's one of those things where we have to figure out the nuance of that and make sure that the use case makes sense. What I can say is will you see it in the next couple of months? No. Is it something we're talking about and something we'll consider as we move into 2024? Yes, definitely.
And then I'm also getting some questions about single sign on. If you have Okta or similar, can can user permissions be controlled by that?
That's a really great question. So we have single sign on and we have okta. In terms of like, is HubSpot compatible with those tools and can you log into HubSpot using those tools? Specifically, yes. In terms of can you provision HubSpot permissions via, let's say, Okta, for example? I actually am not. I don't have enough of a grasp of those tools to answer that confidently. What I can say is we do have updated provisioning tools and APIs. I'm going to give that a. Let me get back to you answer on that. My tentative answer is I think yes, but I'm not confident.
Yeah, I do vaguely remember hearing something about this at some point in the past, but I don't.
It's a little do we have a mode of answering questions post? Because I can write it down on a sticky note and look it up for you folks.
Sure, yeah. Oh yeah, I got you. Okay, yeah, perfect.
Great. Thank you. Yeah, I can follow up on that one.
You can continue on now.
No worries. I'm going to jump into a user now, one that's already been created. I'll just use one that doesn't have an admin permission. As you can see it, when you jump into a user now in HubSpot, it's going to look potentially different to you depending on when the last time you jumped into a user record. It's a full panel user record now, which is new to HubSpot. It took a lot of groundwork this year, but it opens up a ton of opportunity. The first opportunity is it just allows a new landscape and a new way to see information about users. In this user, you can see what seat they have. You can change their seat directly from the user record. You can see what permissions they have, if they have a permission set or not you can change it, then you can view their permissions and filter their permissions. This is not necessarily the same thing as that typical side panel where you might view and change permissions. This is a different UI that allows you at a glance to see, do they have a permission to something, Is it on, is it off? And you can filter this down to specific permission types as well. You can of course still edit permissions. So if I click Edit Permissions right here, I'm going to jump into our trusted side panel, which you guys are all probably familiar with if you need to again, change permissions in any way, or permission sets or teams. But then you'll notice that we have these three other tabs, which again are only possible because we have this new user record. We have the Access tab, which is where you can see what their main team is, if they have any extra teams. You can also access teams directly through that. You have setup if you have any presets assigned to the user. You would see that here, if you haven't played around with presets before. They are essentially a way to provide default settings for a user. Things like their email signature, what their default dashboard might be, things of that nature. And then finally, and I think most excitedly, we have this profile section where you can do things like edit the first and last name, which seems straightforward, but is actually something you couldn't do before. This is also acting as sort of a jumping point for, as you can imagine, more properties we're going to be adding to the user record, more information that you can track about the user record, which we'll talk about when we go through the roadmap here in a minute. Just wanted to call that out, the new user record. Keep an eye on it. More to come. I do want to call out a couple of new permissions before I move into approvals. I suppose the easiest way to do that would actually be to jump into editing permissions. Two things I want to call out, in case you haven't noticed this. We have broken out custom object permissions. Custom object permissions used to be in this top CRM Access section as a single line. You either had access to custom objects or you didn't. That's been broken out and now we have granularity there. So you can have access to some custom objects, but not others. And then within a given custom object, you can have granularity of whether you view, edit or delete them. This behaves just like any other object in HubSpot, right? So it can be all of that given Object all the records of that given object. Only the ones your team owns or only the ones that you personally own. Other permission I do want to call out is approvals, which we are going to talk about here in a minute under the marketing section in your user permissions. If you scroll down to approvals, you're going to see new permissions here. So you can have a permission to approve marketing emails, blog posts, landing pages and website pages. So most of the content relevant to the marketing hub, and again, these are all granular and can be separated. Right. So a user might be able to approve marketing emails but not landing pages as an example. And there are additional granular permissions that are very much on our roadmap. I will talk about that at the end of this presentation. So if you're wondering like where is XYZ permission? Hold off, I might talk about it in a minute. I do want to jump quickly into approvals and what that looks like now. So this is a new feature.
Sorry, pause. So FYI, Jenna's a hero and jumped in with information about using SDIM Octave for provisioning user roles. So everybody make sure you look for that. That comment there. If that was a question you had and then people are asking, shoot. Oh, ability to change users email addresses. Is that a thing that can be done or will be done? The example given is like if someone gets married and changes their name and they get a new email address.
Yep. Yeah, totally understand that Pain point. Is it possible right now? No. Is it possible in the very immediate roadmap? No. A lot is tied to that email address in HubSpot and so being able to change it is a lot more complicated than something like changing the first and last name. Though I am, now that I know Jenna is on this call, going to tag her if she has any commentary about the roadmap, she'd probably be the person to ask on that front. But in the short answer, no, it's not on the immediate roadmap though I'm certain our product team has considered it.
Yeah, someone just said, said if you do user impersonation login as another user, you could probably change it for them. But users can't even change their own email address, can they? Isn't that your username in HubSpot?
Yep. Yeah, you can't. When I changed my last name and my email when I got married, it was a problem for me. So yeah, I don't think you can even change your own.
Yeah, yeah, yeah. So I just wanted to call that out for those of you doing the admin thing, trying to help each other, which I love and I always encourage you to do in the chat. I just want to not foster any false hope. Your email address is your username, so there isn't an option for you to change it currently. And it would be thorny technically for us to enable you to do that. Even though sounds like Amy knows personally how useful that would be.
Yes, definitely. And I think it's worth noting that it's not. It's one of those I'm certain if we could, we would type of thing. So it's not to say we'll never do that. It's more of a once we untangle the web of the technical implications of it. So it's really good to hear that it would be useful. And if you have when speaking of the user record more specifically, if there are specific things you'd like to be able to edit or data you would like to be able to track about a user that are relevant, definitely let us know, drop them in the chat. That is something that is very top of mind for the team.
Yeah. And I mean if the main concern is, you know, being able to send one to one emails from the CRM, you can, you, you can add aliases and things. I think there are workarounds that way. But as far as actually changing the user. Yeah. Jenna has weighed in now what Amy said is right in terms of short term roadmap. I'm hopeful that down the line with the user object that we can make this easier.
So cool.
There you go.
You can sitting up pending. And Amy had approved it and Kyle's out of office or he was the wrong person or he doesn't feel strongly enough to approve it or something like that. Another approver who has already gone in here and approved it could come in here and reassign or a super admin could do this, could reassign approvers as well if need be. I'm not going to do that in this particular case, but you can. And then lastly you can if you want to approve it, of course you can just approve it, but you can also request changes and it uses the comment sidebar here to do that. So let's say it looks good but you want to make a couple changes. Like this is an abysmal subject line. Can you change your subject line? You can do everything you would normally do in a comment section so you can tag team members. I could come in here and say change the subject line and then I can save that comment. That comment and email notification form will go back to that user, they can make their changes, they can comment back to you when the changes have been made and then you can go ahead and approve. Then lastly, you can also. I'm just going to go ahead and prove it. But the last thing I want to note is you can recall an approval. So let's say you're the person who submitted for approval. You realize that you want to make a change or re request or do something of that nature. You can go in and recall that approval as well. Okay. I'm not actually going to send this email, so that is essentially where I'm going to stop this portion of the demo. Any other thoughts or questions?
Yeah, I'm going to hop in here. First of all, a couple people have observed that for teams with multiple super admins, not all of them necessarily want or should be approvers. They may, you know, not have training or opinions on whether an email is good or not. So will, will there be more, I don't know, flexibility or granularity on selecting approvals in the future?
Yeah, yeah, it's a good question. So in the, in the very short term, the way I would get around that is rather than setting it up so that all super admins can grant approval, I would do it just so that it's certain sets. Right? So like when you actually go into HubSpot and assigned permissions, you can really granularly go one by one and pick who can do it in the short term in terms of like, is there going to be a faster way to do that and to specify who on a team if not all super admins get access? I'm not actually sorry, actually sure. We can definitely bring that back to Thomas and team who owns the approvals piece and let you guys know. But I can say it's not on the short term roadblock because I haven't heard it come up in the short term there's a granular and manual solution to that, but not a great automated way to do it.
Cool. Then going back to the user record, someone is asking about setting working hours or business hours, which is a thing I know you can do for phone numbers now. You can have your calls go to voicemail at certain times. You can do it with chat availability also, I believe. But as far as just one place for me as a user to say these are my working hours does not.
Exist currently, is that it doesn't exist currently, but it's definitely on the roadmap. So this idea of. So there's two parts of that question, right? For user. So I'm going to go ahead and do that. A couple of things to note first is you will see that there is this approval status column. You might have to manage your columns to get it added there, but it's really useful in managing these approvals across content types. You can see if a piece of content has approval requested or not and if so, is it pending? Is it approved? Is it rejected? So you can see that we already have a couple in here. I'm going to go ahead and create a new email. Bear with me as I just pick random email templates and put in random subject lines so that we can get to the end goal here. So I'm going to put in some content that allows me to bypass this, pick a random list to send it to. Then you'll notice that I have the ability to request an approval here. I don't have the ability to simply publish it. I can still see those warning and suggestions if needed to. In this case there's probably plenty because this is a horrible email to send, but we're just going to ignore that. I'm going to click Request Approval. When you do that you can select your approvers. It doesn't go to every super admin in your portal. That wouldn't make a ton of sense. You can select specific approvers and then you can also add some notes. So I can say, you know, please approve this and request that approval. If you send it to multiple then the notification will go to multiple approvers as well. I'm just going to do it to one approver. Just to note in the background that user gets an email noting that they have a new piece of content that has requested approval, they can action that and access the direct piece of content from that email if they need to. In this particular case, I'm just going to go ahead and save and exit this and log back into my portal as myself. Give me a minute to do that. Speaking of okta, see we have that enabled.
While you're waiting for this to load, I got a question. If there are multiple approvers, do all need to approve?
That's a really great question. And if Thomas is on, let me know my I believe the answer is yes and it's certainly a question I should know the answer to. So great way to put calls in it. I think the answer is yes, but if somebody knows for sure on chat, let me know. If not by the end of this I'll look it up and let you guys know. But let's go with yes and see if I'm right to that question, though. I'm about to talk about the concept of changing your approvers at any point, which we've gotten that feedback before, where if you requested the wrong approver, you need to change your approver. You can do that, which I'll show you here in a moment. I'm going to jump into emails. Here's that last email right here. I'm going to go ahead and click it and you can see once this loads, I have the option to approve it. Because I have that permission and I am the approver on this email, I can also jump down and do a couple of things. So I can just simply view that approval so I can see what that note was, who requested it, I can see who the approvers are. So actually, I think this answers our questions. If there were multiple approvers, it would have to be approved by all this language kind of leads me to believe that. So if we had multiple approvers here, we could see if any of them have approved it. If they're pending and approval would only go through once they've all approved it. I can also reassign approvers. So let's say I'm sitting here and I asked Kyle and Amy to approve it, and Kyle's sitting up pending and Amy had approved it and Kyle's out of office or he was the wrong person or he doesn't feel strongly enough to approve it or something like that. Another approver who has already gone in here and approved it could come in here and reassign, or Super Admin could do this, could reassign approvers as well if need be. I'm not going to do that in this particular case, but you can. And then lastly, you can, if you want to approve it, of course you can just approve it, but you can also request changes and it uses the comment sidebar here to do that. So let's say it looks good, but you want to make a couple changes. Like this is an abysmal subject line. Can you change your subject line? You can do everything you would normally do in a comment section, so you can tag team members. I could come in here and say, you know, change the subject line and then I can save that comment. That comment, an email notification form will go back to that user, they can make their changes, they can comment back to you when the changes have been made, and then you can go ahead and approve. And then lastly you can also. I'm just going to go ahead and prove it, but the last thing I want to note is you can Recall an approval. So let's say you're the person who submitted for approval. You realize that you want to make a change or re request or do something of that nature. You can go in and recall that approval as well. Okay. I'm not actually going to send this email, so that is essentially where I'm going to stop this portion of the demo.
Okay.
Thoughts or questions?
Yeah, I'm going to hop in here. First of all, a couple people have observed that for teams with multiple super admins, not all of them necessarily want or should be approvers. They may, you know, not have training or opinions on whether an email is good or not. So will there be more flexibility or granularity on selecting approvals in the future?
Yeah, yeah, it's a good question. In the very short term, the way I would get around that is rather than setting it up so that all super admins can grant approval, I would do it just so that it's certain sets, right? So like when you actually go into HubSpot and assign permissions, you can really granularly go one by one and pick who can do it in the short term. In terms of like, is there going to be a faster way to do that and to specify who on team if not all super admins get access? I'm not actually sorry. Actually sure, we can definitely bring that back to Thomas and team who owns the approvals piece and let you guys know. But I can say it's not on the short term roadmap because I haven't heard it come up in the short term. There's a granular and manual solution to that, but not a great automated way to do it.
Cool. Then going back to the user record, someone is asking about setting working hours or business hours, which is the thing I know you can do for phone numbers now. You could have your calls go to voicemail at certain times. You can do it with chat availability also, I believe. But as far as just one place for me as a user to say these are my working hours does not exist currently. Is that a thing?
It doesn't exist currently, but it's definitely on the roadmap. So this idea of. So there's two parts of that question, right? First is just is there a way that we can delineate or note business hours on a user record? That would mean that we would have to have a place for you to store that data and a proper for you to enter it. The ability to sort of create new properties and create additional information on the user record is definitely on the Roadmap. So yes to that portion. The second and more nuanced portion is can then can we have the platform enforce those business hours? And I think there's some nuance to what we mean by that. Like do we mean that you can't get enrolled in a workflow if it's not in business hours? Is it that you can't engage in certain parts of the platform where we don't have business hours support, like in conversations or in live chat or something like that? I don't think we have that completely laid out in any way. Like I don't know if we really understand how exactly we'd want to enforce that. But what I can say is the ability to store and track that information is on the roadmap. And this concept of enforcing down the road elements of the user object throughout HubSpot is definitely something we're talking about. I think it's just going to be a longer follow up to actually being able to present the data on the user record.
Great. Then it turns out. This is weird, but some people, when they go to their settings General Security tab where their email is listed, they see a button to change their email. I do not personally see that. They say they get texted a code to authorize the change. I don't know if that's a two FA thing. Anyway, this is a weird mixed thing. Some people are seeing it. I'm not seeing it, so just wanted to call that out.
That's a great question.
If you go to your general preferences on the far left there. Yep, that one. And then security, the far right tab. Yep. See, I see what you see. Mine is just in a gray box and I can highlight it, but I cannot edit it. But some people are seeing an edit button underneath it and so that's intriguing.
I. In all my years of doing this and being a csm, I've never seen that in a customer portal. But it could very well have to do with Okta or it could very well have to do the Scion or.
Yeah, Chad also hypothesized maybe it's an okta thing since we are okta users. But anyway, so there's that and then I'm sorry, jumping all over here. Yeah, lots of people are seeing the edit button. Okay. Yeah. I wonder if that's a limitation we have because of Okta. And then it's lost now. But someone was asking on approvals in that sidebar. Can you see a history of who approved something when?
You can't see it right now, but way to foreshadow something on the roadmap. Yes. That is coming soon.
Cool. Yeah. All right. Lots of people.
The mystery of the edit email is stumping me. So I'm gonna have to bring that back to the project.
We've got a whole bunch of people weighing in. Seems like most people even. Even other okta users are seeing it.
So maybe it's. Yeah, Maybe it's a HubSpot thing, guys. Maybe we just are not trusted. I'm not entirely sure. We will dig into it. They don't want you guys changing your email address.
Right.
It would have been very useful for me circa three years ago. But I digress. We'll look into it. Great. Awesome. I will jump into. I think I was gonna talk about audit logs next, so I'm gonna do this also live to all. You will see it if you have access to it on the left sidebar here. Going to jump into this. This has been around for a little bit. So many of you might have already seen this demoed or have already talked about it. But I just want to call it out because it does have some improvements. The centralized audit log is essentially a singular place. We've had audit logs before that you could export from HubSpot or that were really sort of like tied to a niche element of HubSpot. But we've never, until this year had a centralized place where an admin can go and see what users are doing across the tool. You can see a lot here. You can see certain categories and then subcategories. You can see if they're doing security actions like logins. You can see if they're performing actions within content or data within the tool. You can see if they're doing imports, things of that nature. You can also see who is doing that and when they modified it. We can see somebody just logged into the portal. This is a demo portal, so it's not surprising. And then you can see dates and sources as well. You can of course filter and then probably most importantly, you can export this as well. A thing I want to call out is there's additional side panel information available now. So you can see I'm zooming past all the stuff I've done because I know what I did in my own portal. But you can see when other people maybe are coming in. Like you can see Kyle logged into this portal. You can now click on that individual audit event, open it up, see additional information if needed in the side panel, and then if I click view more information, I'm going to get even more granular Information about what happened with the case of a login. It's not particularly interesting, but if somebody is doing an import editing data, if somebody's left the company and you want to filter down to everything they've done in the past 90 days, those are all really useful use cases for the centralized audit logs. That is essentially all that I want to show on that front. But if you guys have any questions, let me know. I'll quickly pause. Kyle, anything worth noting?
Sorry, I got a dm.
You're good, you're good. I can keep moving. You just pause me if you see something of interest.
Are there resources that really detail what you get from paid seats?
From paid seats? That is tangential to the point, but actually yes, because I know the answer. I'll just let you know. What I would probably do is go to our product catalog. So you're gonna go. I have it bookmarked, but you're gonna want to go to legal.HubSpot.com backslash product. Yeah, let me just put it in the chat. This is where I go. It's my golden ticket to anytime. I have a seats question. So there you go. That's probably the best resource. You're not showing the other tab.
She just dropped the link. Yeah.
Oh, dropped it in chat.
Okay. Yeah, I think you can continue on.
Awesome. All right, last piece here is I want to talk about the Security Center. It's going to be again in settings. That's the trend today. Left hand side, jump into security. Give us a minute to load. Can everybody see the Security center or is it still showing user? I think it's probably.
I'm still saying user. Yeah.
Here, let me jump in here. Now you should see the Security Center.
Yep.
This is additionally new to HubSpot. It's really meant to give admins proactive activities they can do to improve their security score or the security settings in their portal. We've had reactive elements that help you do this before, but we've never really been as proactive as we are being in the Security Center. So you may have received a notification at some point for an account or a portal that notes that your security score needs work or that there's something you can do if you have that's likely coming from this Security center. And you can see a whole bunch of stuff. Right. So you can see, do you have two factor authentication turned on? What percentage of users are actually using it or have it set up? How many super admins do you have and if you have any of these security points to resolve you can come in, review them. If you hover over the information tooltips in here, you're going to get more information and then when you go to resolve, you'll get the actual relevant action you need to do so. In this case, I need to actually remove super admins. I'm not going to do that because this is an internal demo portal and everybody's a super admin. But I did want to call this out, especially if you are, as I've heard from other folks, getting those notifications and not knowing where they're coming from or what they're referencing. That would be the Security Center.
Awesome. Lindsey mentions what if you have numerous partner users in there and they're all super admins? That hurts your security score. I, I, my, my personal opinion on that is this isn't binding. We're just trying to highlight things that could be wrong. And if you are confident with the way you're operating, HubSpot will continue to operate. It's fine. Amy, I don't know if you have thoughts on.
Yeah, I completely agree. It's use best judgment, as we would say here, HubSpot. Right. So like ignore it if you know there's a good reason for you to have it. That security score is not going to follow you. Nobody knows what it is. HubSpot doesn't track it for any real implications. So if you have a good reason to have a bunch of super admins, for example, I think I do in this portal. I just ignore it and I think that's fine. Cool. Okay, that concludes my demo. I do want to jump back into the slides because I have a couple of slides on our roadmap that I want to share and then I want to save as much time as I can for Q and A here. Cool. Folks. See my slides.
Yep.
Yep. Okay, so I will share this deck with the group afterwards so that you guys can have access to these links. But I did want to call out a couple of new resources we have. So we have some new feature pages, stuff on our website and blog related to this topic. Feel free to take a look if you're interested. We have something called the Trust center, which dives into sort of like deeper security concerns than we did today. Things beyond just what's available in the actual product, what we are compliant with, what our different, you know, SOC2 compliance is all of that good stuff in addition to the different features we have. So take a look both at the Trust center and our legal documentation if you're interested. And then anybody who wants really Granular information on how to set up approvals or what's included in the audit logs or where's the full list of every permission available in HubSpot. I link the relevant knowledge base articles here as well, so I will again share that out for folks to get access to and then what's next. So I will try to see if I can zoom in a little bit. I'll try to get through all of this, but like I said, there's a ton on the roadmap coming in this space. So across centralized audit logs we have both a public API coming so that you can extract that data and then a reporting dashboard. So not only a single place for the audit log itself, but a single source of truth to track the key metrics across your different portal. Not your different portal, your portal. And then moving into the user record. We've already sort of foreshadowed this because we and many thanks to Jennifer being here, but there's a ton coming to the user record so an updated user table so that you don't have to scroll through all of that information as painfully as you might do today. A more holistic view of all of your user information. An overview tab being brought to the user record which includes insights into the activities your users are taking, any security activity associations, whether they've connected their email, things of that nature, and then additional properties including things like job title, phone numbers, profile, image editing and more. We talked about out of office and working office hours included in that list, so just generally speaking expect to see more on the user record and permissions. We have CRM email permissions coming, so this has been a long awaited permission. Expect to see it in a beta state before the end of the year. The ability to control what emails a user sees on an individual CRM record timeline rather than seeing every, let's say sales email that's logged on a contact. Maybe you have access to the contact but you can only see the emails that you logged. So that is coming soon. Approvals we already talked about this but a history log for approval requests that'll be coming shortly and then in the Security center we are going to have recommendations for over provisioned super admins. So this is not the same as having too many super admins, it's having individual users where based on the activity they're taking we think they don't need to be a super admin. So just an additional note or recommendation in the Security center that you can revise if need be. I think if my memory serves me right that's all I had. So I'm going to stop hopefully with enough time for any questions or conversation that is relevant. And I'll go ahead and put these slides in the chat too so people have it.
Amazing. Thanks so much. So everyone, Deanna just dropped a survey in. We would love to get your feedback on this session and the admin hug generally. Anyways, we can make it better for you. We'd appreciate hearing. Also for those of you who missed all the confusion at the beginning, Bevy, our webinar platform has changed everything. Everything's moved around. So typically at this point I would say hey, let's all move over to the Q and A tab which you can now get to pushing a button in the bottom and upvote the things that you want to hear about. But I believe we can't find the upvoting functionality. We don't think it exists anymore. So we're just, I don't, I don't know exactly how we're going to organize this Q A top and work your way down. Okay. Yeah. John mentions Amy, that a governance page, just like a single place for governance things would be nice. That's more feedback than a question. Are there resources that really detail what you get from paid seats? Oh, you just answered that. That was the if you scroll through the chat, look for the legal.HubSpot.com link that will get there will HubSpot Academy provide a governance certification course? That feels like the question for me. That's a great question. That, that would be an excellent thing. HubSpot has grown up a lot in the last couple years in terms of what's available from a governance and just a general administration viewpoint. I'm always advocating for us to create some education here. We've hired a couple new people that I think will be thinking about that a lot, but we don't have anything currently planned or in production. Oh, this answered live little thing is handy. All right. Are we going to begin seeing updates to the audit log that include changes to properties as well? So I think this is also over in the chat people mentioned changes to like the they would like to see who has been adding and removing options from a drop down select property or or or that sort. So like the structure of the properties themselves, not the values on individual records. Is that something you've heard anything about?
Yeah, totally. That's a really nuanced question. No, I haven't heard that being explained explicitly on the roadmap. I can definitely let the product team know we've heard. We want to See, when people create or delete properties, right? And we know that we can audit changes to a property, but we haven't seen the nuances of somebody changed some setting of a given property. And that's actually super relevant because there's more and more day and day that you can do with properties across property rules and conditional logic. So that's a really good question. I'll pass the feedback along to the team and see if we can get it on the roadmap.
At Inbound last week someone was asking me the same question, but about email subscriptions. Someone in their account had changed the name of an email subscription and they didn't know the change had been made until they have no idea how long it had been changed or who made it. And so yeah, I mean, in general, I think this crowd you've got here is always going to want more granular governance, so you should get along great with them. Can you run a report on the audit logs for the admin dashboard or changes to reports? I'm not sure.
Well, I don't. A great question. I'm assuming that question is asking can I see in the audit log if there have been changes to reports or dashboards and who made those changes? Right now, no. But while I'm creating a list of things we want in the audit log, I will add it. I totally get the request.
Cool. It's also a question. This came up in the chat earlier too. Super admins not having access to seated features unless they have a seat assigned to themselves for troubleshooting purposes. That can be tricky if you can't access certain aspects. So the question if you are a super admin, will you automatically have a paid seat in the future?
If you are a super admin, will you automatically have a paid seat in the future?
I can posit an opinion here. On the one hand, we don't want to create a loophole where people can just not pay for seats and then make everyone a super admin. And now you can use all the seated features. That is the thing we have to be sensitive to. I will say, though my understanding is just in general, HubSpot leadership and product teams are putting a lot of careful thought into how seats function. We have heard a lot of feedback from a lot of customers that it's not perfectly meeting their needs and so I would expect to see some adaptation here in the coming year or so. I don't know, but I don't know specifically if admins will get more access to paid features or not. I don't know Amy, if you have anything, you could share on that.
Yeah, I don't know that. All I can tell you is that generally speaking, the way that the tides shift and the motion we are going towards always is we will never take away anything you have access to currently. So if there's any change and you have access to something, we're not going to remove access. In terms of adding additional access, I kind of agree with what Kyle noted. I can't imagine a world in which that would make a ton of sense. But I will say the way we think about seats and what you have access to in a seat is we are imagining something that a user in a given front office role would need access to. So. So something like sequences or something like that. Though that being said, we are very aware and we are recently getting feedback that sometimes admins need access to those things, not to perform them. So for example, not to send a sequence to make changes or to build them. So all that to be said, I don't know. I can tell you this. I don't think it's like ironed out at this point. So the feedback is still really helpful. We're really in the weeds of making sure that everybody has what they need. So I can pass the feedback along to the seats team. But I think you're right, Kyle, in terms of the way our leadership team is thinking about it.
Yeah. And just to reiterate what Amy just said, we understand that admins, you may not want to enroll someone in a sequence or do some of those seated kinds of things, but you do need access to create and edit the sequences themselves. And that is something we're. We hope to address. So there's that. We are just about a time here, Amy.
