Workspace setup (IT & platform admins)

Configure your Hightouch workspace to ensure secure access, clear permissions, and consistent governance across teams.

Setup steps

1. Invite your team

Set up user access and authentication for your organization.

1. Add users manually or configure SSO/SCIM for centralized identity management.
2. Map IdP groups (e.g., Okta, Microsoft Entra ID) to Hightouch user groups to automate access control.
3. Review and test login and group mapping before provisioning at scale.

→ SSO setup

2. Configure workspaces

Workspaces define where data, syncs, and users live within your organization.

• Organization: The top-level entity representing your company, used for user and role management.
• Workspaces: Independent environments under an organization. Use these to separate configurations or compliance zones.
• Environments: Create staging and production environments within a workspace to safely test changes before deployment.

Best practice:
Keep the number of workspaces minimal. Use environments instead of multiple workspaces unless you must separate brands, regions, or legal entities.

→ Workspace management
→ Environments

3. Manage users, groups, and roles

Define who can access what, and at what level.

1. User groups: Collections of users that share the same permissions across one or more workspaces.

   • Organization admins — full access
   • Organization viewers — read-only access
     → User groups overview

2. Roles: Sets of permissions that determine which actions user groups can perform within a workspace.

   • Admin — full control (typical for IT and data teams)
   • Editor — can modify syncs and models
   • Viewer — read-only
   • Draft editor — can propose changes pending approval
   • Create custom roles for granular control as your setup grows.
     → Roles overview

4. Secure your setup

Protect your workspace and data using Hightouch’s enterprise-grade security features.

1. Review the Security overview for encryption, compliance, and hosting details.
2. Configure network access via tunnel, PrivateLink, or IP allowlisting.
   → Network access
3. Set up self-hosted storage to write query results to your own cloud bucket (AWS, GCP, Azure).
   → Self-hosted storage
4. (Optional) Integrate consent management to enforce opt-in policies for marketing use cases.
   → Consent management (OneTrust)
5. Monitor with sync logs and alerting for visibility into data flows.

5. Change management

Establish governance controls for reviewing, approving, and tracking changes across your workspace.

1. Approval flows: Require admin or peer review before syncs or models go live.

   • Assign the Workspace Draft Contributor role to users who can submit changes for approval.
     → Approval flows

2. Audit logs: Capture all in-app user actions for 90 days to support compliance and troubleshooting.
   → Audit logs

3. Environments: Use staging environments to validate syncs and models before production deployment.
   → Environments

4. Alerting: Notify admins of sync failures or anomalies via Slack, email, PagerDuty, or Datadog.
   → Alerting

6. Organize resources (optional)

Keep large workspaces manageable and transparent.

• Folders: Group syncs, models, and audiences for easier navigation.
• Filters: Refine views by status, ownership, or query type.
• Labels: Tag resources with key-value pairs (e.g., brand, region, campaign type) to track usage or ownership.

→ Folders, filters, and labels