Granting a consultant access to HubSpot or Salesforce for an assessment matters for whoever owns CRM security — IT, operations, or a platform admin — because the wrong method creates real risk, and the right one is usually simple. HubSpot has a purpose-built Partner Admin mechanism for working with a Solutions Partner; Salesforce offers options from a temporary personal grant to a dedicated named user account with a scoped profile. This guide covers which method fits a one-time assessment versus an ongoing engagement, and how to revoke access cleanly afterward. Vantage Point requests exactly this least-privilege, read-only-first access for every assessment it runs.
Whether you're bringing in a partner for a one-time health check or an ongoing engagement, the consultant needs to see your Salesforce or HubSpot setup to do useful work. That means access — and most businesses have never had to think carefully about how to grant it. The default instinct is often the least secure one: share a personal login, or hand over a Super Admin account "just for now." Both platforms offer better, purpose-built alternatives.
Before choosing a mechanism, apply one rule consistently: grant the minimum access needed for the current stage of work, and start read-only wherever the platform allows it. An assessment needs to see configuration, automations, permissions, and data structure — not edit or delete anything. Save write access for after a scoped plan is agreed, and only for the areas that plan covers.
If you're working with a HubSpot Solutions Partner, HubSpot has a built-in mechanism for exactly this: Partner Admin access. Partner Admins can manage your HubSpot account and be assigned permissions without taking up one of your paid user seats, but they cannot add or remove Super Admins, change billing settings, or manage sensitive data — meaningful guardrails baked into the role itself.
There are three ways to set this up, and the most common for a new engagement is the access link:
| Method | How It Works | Best For |
|---|---|---|
| Approve a Partner Admin access link | The partner sends you an access link. You click it, click Approve, and select which HubSpot account they can access. | Starting a new engagement with a HubSpot Solutions Partner — the most common path |
| Migrate an existing Super Admin | If the partner is already a Super Admin in your account, you or they convert that access to the scoped Partner Admin role instead. | Cleaning up over-broad access granted before you knew about Partner Admin |
| Create the user directly | You create a new user in Users & Teams and select the Partner Admin template — it only appears for eligible partner employees. | When your admin team prefers to initiate access rather than approve a link |
If the person doing the work isn't affiliated with a formal HubSpot Solutions Partner, create a standard user account under their own name instead of sharing a Super Admin login, and scope its permissions as narrowly as the work allows — HubSpot's permission model lets you grant access by tool and object rather than all-or-nothing.
Salesforce offers more granular options, which is useful once you know which one fits the situation. Avoid the one option that isn't on this list: sharing your own personal login. It leaves no audit trail distinguishing your actions from the consultant's, it breaks the moment you change your password or enable stronger authentication, and it violates the accountability that Salesforce's per-user licensing is built around.
| Method | What It Is | Best For |
|---|---|---|
| Grant Login Access | An individual user grants an admin temporary login access to their own account for a set duration, from their personal settings. | A short, specific troubleshooting session — not a multi-week assessment |
| Dedicated named user account | A new Salesforce user created under the consultant's own name and email, assigned a profile and permission sets scoped to the engagement. | An assessment or ongoing engagement where a real person needs to log in and work directly — the option that best matches "access under their own name" |
| Delegated administration | A defined Delegated Group gives a user scoped admin rights — managing specific roles, profiles, and permission sets — without full System Administrator access. | An engagement where the consultant needs meaningful admin capability, but not unrestricted access to every setting |
| Dedicated integration user | A user created specifically for API-only, system-to-system access, with no interactive login. Many editions include several of these licenses at no extra cost. | Connecting an external tool or automation to Salesforce — not a human doing manual review work |
For a human consultant doing an assessment, the dedicated named user account is usually the right starting point: create the account under their real name, assign a read-only or narrowly scoped profile for the review phase, and expand permissions only if the engagement moves into implementation work.
The work is a single short session — for example, troubleshooting one specific issue alongside an existing user — and doesn't require standing access afterward.
You're starting an assessment or ongoing engagement where a specific person needs to review or work in the system over days or weeks. This is the right default for most consulting relationships.
The consultant needs to manage certain users, roles, or permission sets as part of the engagement, but full System Administrator access isn't warranted.
The access is for a system or automated process, not a person clicking through the interface.
How a partner responds to being granted access tells you a lot about how they'll run the engagement. A partner running a genuine assessment will:
Be cautious of a partner who asks for your personal login instead of their own account, asks for full System Administrator rights before explaining why an assessment requires it, or starts making changes during what was scoped as a review.
Access hygiene doesn't end when the project does. When an engagement wraps up or a partner relationship ends:
This is the same access-audit discipline worth applying any time a consulting relationship ends, planned or not.
Decide the access method before your next assessment rather than defaulting to whatever's fastest in the moment. For HubSpot, confirm Solutions Partner status and use Partner Admin access if so. For Salesforce, default to a dedicated named user account with a scoped profile for human work, and reserve integration users for system connections. Read-only first, expand only when justified, and revoke deliberately when the work concludes.
Vantage Point requests exactly the access described above for every complimentary CRM health check — Partner Admin access on HubSpot, or a dedicated named user account on Salesforce, scoped to a read-only review to start. Our compliance and security solutions team can also help formalize access policy beyond a single engagement, and our managed services and ongoing support model centers on a single point of accountability so access never defaults to guesswork. Whether your environment runs on Salesforce, HubSpot, or both, the principle is the same: Senior consultants only — no junior handoffs; the experts you meet are the experts who deliver.
Vantage Point's complimentary CRM health check starts with exactly the least-privilege, read-only access described in this guide. Contact Vantage Point to schedule an assessment on your terms.
If the consultant works for a HubSpot Solutions Partner, use HubSpot's built-in Partner Admin access — typically by approving an access link they send you, which lets you choose exactly which account they can access. Partner Admins can't add or remove Super Admins, touch billing, or manage sensitive data, which limits the blast radius even if something goes wrong.
No. Sharing a personal login removes any audit trail between your actions and the consultant's, breaks whenever you update your password or security settings, and undermines the per-user accountability Salesforce's licensing model is designed around. Create a dedicated named user account instead.
A dedicated integration user is built for system-to-system, API-only access with no interactive login — it's meant for connecting tools and automations, not for a person browsing the interface. A regular named user account, assigned an appropriately scoped profile, is what a human consultant should use to log in and review or work in the system directly.
Delegated administration lets you grant a user meaningful admin capability — such as managing specific roles, profiles, or permission sets — without giving them the full System Administrator profile. It's a useful middle ground when a consultant needs more than read-only access but shouldn't have unrestricted control over every setting.
Usually just read access to configuration, automations, integrations, permissions, and data structure. A genuine assessment is diagnostic, not corrective — a partner shouldn't need to change anything to tell you what they found and recommend next steps.
Deactivate the dedicated user account or Partner Admin access rather than leaving it inactive but present, remove any integration credentials tied to tools no longer in use, and review connected apps and OAuth grants on both platforms to confirm nothing else was left behind.
Partner Admins are explicitly restricted from managing HubSpot's designated Sensitive Data features, which adds a layer of protection beyond ordinary permission settings. That said, standard CRM records and configuration are visible depending on the permissions granted, so scope what the partner can see based on the specific engagement, not the default maximum.
It depends on the work. A brief initial assessment typically only needs read access, while implementation or configuration work legitimately requires broader permissions to make changes. A trustworthy partner explains why a given level of access is needed for the current phase rather than requesting maximum access by default.
Vantage Point is a boutique CRM consulting firm helping businesses transform with Salesforce, HubSpot, and AI. Learn more at vantagepoint.io.