- Understanding the Integration User
- Creating the Integration User in Salesforce
- Configure your Salesforce Sharing Settings
- Considerations when implementing Selective Sync from Salesforce
Understanding the Integration User
The Salesforce User whose credentials are used to sign in to Salesforce from the HubSpot Settings screen facilitates the connection between HubSpot and Salesforce -- we'll refer to this user as the integration user. The basic principle to achieve a selective sync from Salesforce to HubSpot is to intentionally hide or expose records in your Salesforce Org to the integration user to either prevent or allow those records to sync with HubSpot. If the integration user has read/write permission to a Salesforce record, the record is eligible to sync with HubSpot; stated differently, any Salesforce records that the integration user cannot read/write will not be eligible to sync with HubSpot.
Creating the Integration User in Salesforce
1. Create a new Salesforce Profile
To ensure that you have all of the necessary permissions, we recommend that you clone the System Administrator profile and modify the cloned profile. After cloning the profile, edit the Profile's Standard Object Permissions to remove the Data Administration permissions from any object that you would like to sync selectively with HubSpot. In this example, we are going to limit Leads and Contacts. Remember to save your changes when you are finished. Learn more about creating and editing Salesforce Profiles
2. Create a new Role
Next create a new Role to be used by the integration user. In this example, we create the new Role at the highest level of the Role Hierarchy, so the new Role will be outside of any existing hierarchical Permissions schemes. Creating the Role at the outside of any existing hierarchies is typically the simplest implementation, but the specific needs of your Salesforce organization may vary. Learn more about Salesforce Role Hierarchies
When creating the Role, don't worry about the Contact Access settings; this setting will be overridden by the Sharing Rules we create later in this guide.
If you don't want to create the new role outside of the existing hierarchy, please keep in mind two possible issues:
- If the integration user’s Role is below other roles in the Role Hierarchy, you may unintentionally expose records to users who have a Role higher than the integration user.
- If the integration user’s Role is above other roles in the Role Hierarchy, the integration user may have access to records that do not meet the Sharing Rule. This may cause records to unexpectedly sync with HubSpot.
3. Create a new Salesforce User with the new Profile and Role
Now that we've created the Profile and Role for the integration user, we can create the new User with the Profile and Role. Learn more about creating a Salesforce User
4. Assign the HubSpot Integration Permissions to the Integration User
Last, make sure the integration user is assigned the HubSpot Integration Permission Set. Navigate to the HubSpot Integration Permissions in your Salesforce Org's Permission Sets (note: this Permission Set is only available after installing the HubSpot Managed Package in your Salesforce Org). Learn more about assigning a Permission Set to a Salesforce User
Configure your Salesforce Sharing Settings
Now that we've created the integration user with its own role and profile, we can configure your Salesforce Organization's Sharing Settings to hide or expose the desired records to HubSpot. The following steps demonstrate the process on the Lead object, but this process can be repeated on the Contact object or any other object for the same effect. Learn more about Salesforce Sharing Settings
1. Set the Organization-Wide Default Sharing Settings to Private
First we need to set the Organization-Wide Default Sharing Setting for the object to private. In this example, we are editing the settings of the Lead object. If your Organization-Wide Default setting was 'Public', you may need to edit individual Profiles to give View or Modify All access to this Object. Any profile with View/Modify All permissions to an object will override the Organzation-Wide Default. Learn more about editing Organization-Wide Sharing Defaults
2. Define Sharing Rules based on criteria
Create a new Sharing Rule to choose which records sync with HubSpot. In this example, we are syncing leads if they have both a 'True' value in a custom field named, Sync to HubSpot, and an '@' symbol in the email field to verify that the lead has an email address. (Records without a valid email address will not sync to HubSpot, so this adds additional safeguards against sync errors.) This is only an example -- any criteria can be used in a Sharing Rule, so Rule criteria can vary to meet your business needs. Make sure the Sharing Rule is set to 'Read/Write' Access so that the HubSpot integration can continue to update records. Learn more about Salesforce Sharing Rules
Considerations when implementing Selective Sync from Salesforce
This method will allow you to sync a subset of Salesforce records with HubSpot based on the criteria you define in your Salesforce Sharing Settings, but you should be aware of the following:
- For selective sync to work most effectively, these two settings should be enabled within Salesforce Integration settings:
This configuration makes it so that, leads and contacts sync to HubSpot whenever they meet the criteria for your selective sync --- whether upon creation or at a later date. - The HubSpot-Salesforce integration initiates a sync from Salesforce to HubSpot every 10-15 minutes. This means that a record may take 15 minutes to sync to HubSpot after it first meets the Sharing Rule criteria.
- Make sure that records created in Salesforce by the HubSpot Integration meet your sharing rule criteria. For example if a person fills out a HubSpot form on your website and is synced to Salesforce, they will stop syncing unless the new record meets the criteria of the Sharing Rules that you have created. This may require automation (a HubSpot or Salesforce Workflow), or you may want to add a Sharing Rule criteria for records created by the integration user.
- Records owned by the integration user are always visible to that user, and therefore records owned by the integration user will always sync to HubSpot.
- To test or troubleshoot whether a record will be eligible to sync with HubSpot, log in to Salesforce as the integration user and attempt to view that record. If you can view the record while logged in as the integration user, it will sync to HubSpot. If you see an error for insufficient privileges, the record will not sync to HubSpot.