Too many super admins in HubSpot

Why it matters

A mistake or a compromised account with super admin access can affect the whole portal: settings, integrations, data exports, and deletions.

Broad admin access also makes change history hard to trust, because anyone could have made a change.

How to find it in HubSpot

1. 1Open Settings > Users & Teams.
2. 2Filter or sort users by access to show who has Super Admin.
3. 3Compare the list with your org chart and note anyone whose role does not need full access.

How to fix it safely

1. 1Keep at least two named emergency super admins.
2. 2Create permission sets for each role (sales, marketing, service, operations) and assign them instead of super admin access.
3. 3Remove super admin access from everyone else, and confirm with each person that they can still do their job.
4. 4Review super admin access every quarter and whenever someone changes role.

How Ancil checks this

Rule

GOV-002

What it looks for

Runs on portals with at least 3 users. Flags portals where more than 2 users, or more than 25% of users, are super admins.

Severity

Info. Warning when 5 or more users, or half of all users, are super admins.

Evidence shown

The user IDs and email addresses of up to 50 super admins.

Governed fix

Not automated. Ancil never changes permissions automatically. It gives you the list and a least-privilege recommendation for a manual review.

Related checks