Skip to content
ancilAn INSIDEA company
HubSpot check library

HubSpot users not assigned to a permission set

Permission sets let you give everyone in the same job the same access and review it in one place. Users with individually configured permissions are not necessarily over-privileged, but their access is harder to explain and audit. Find users without a permission set, compare them with a simple job-role matrix, and move repeatable access into named sets.

GovernanceGOV-005GOV-006Updated 2026-10-28

Why it matters

When access is configured user by user, nobody can say quickly who can export data, delete records or change settings. Access reviews take longer, and mistakes in one person’s setup go unnoticed.

Users who reference a permission set that no longer appears in your inventory are a related sign of drift. It can mean a stale assignment, restricted visibility, or simply an API timing difference, so it needs confirmation rather than action.

How to find it in HubSpot

  1. Open Settings > Users & Teams.
  2. Review the permission sets list to see which sets exist and who is assigned to each.
  3. Open each user who is not a super admin and check whether a permission set is applied, or only individual permissions.
  4. Note any user whose assigned set you cannot find in the list.

How to fix it safely

  1. Write a simple job-role matrix: each role, the access it needs, and the paid seat it requires.
  2. Create or update a permission set for each role in the matrix.
  3. Assign users to the matching set, and confirm with each person that they can still do their job.
  4. Keep genuine exceptions, but document why each one exists and who approved it.

Before you change anything: Do not remove a permission set from a user only because Ancil could not see it. Confirm the assignment in HubSpot first.

How Ancil checks this

Rule
GOV-005, GOV-006
What it looks for
Runs when Ancil can read users and permission sets, with at least 3 users and at least one permission set. Flags users who are not super admins and have no permission set, when there are at least 2 such users and they make up at least 25% of all users. Separately notes users whose assigned permission set does not appear in the permission sets Ancil can read.
Severity
Info. Warning when half or more of all users have no permission set. The unavailable permission set note is always Info.
Evidence shown
The number of permission sets, user IDs and email addresses for up to 50 users without a set, and the unrecognised permission set IDs for up to 50 users.
Governed fix
Not automated. Ancil never changes users or permissions automatically. It reports the evidence, and your team or an INSIDEA expert makes any access change.

Related checks

HubSpot permission sets: duplicates, unused sets and drift Too many super admins in HubSpot HubSpot users not assigned to a team HubSpot users with no login in 90 days

Run this check and 149 more.

Ancil connects to HubSpot read-only in about 60 seconds. Nothing changes in your portal without your approval.

Install from HubSpotBrowse all checks