> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hightouch.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Workspace setup (IT & platform admins)

> Configure your Hightouch workspace to ensure secure access, clear permissions, and consistent governance across teams.

## Before you begin

* Admin or organization-owner access to your Hightouch account
* Your organization's SSO provider details (if using SSO)

## Setup steps

### 1. Learn the building blocks

Before configuring anything, familiarize yourself with how Hightouch is organized: organizations, workspaces, user groups, roles, environments, and Spaces.

[**Core concepts**](https://docs.hightouch.com/workspace-management/overview.md) — organizations, workspaces, user groups, roles, environments, and Spaces

![Workspace design diagram](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/get-started/workspace-diagram.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=66f23aa75361f6e6033b4f1ac3ccf68d)

Most teams use a single production workspace with Spaces, permissions, and [subsets](https://docs.hightouch.com/customer-studio/subsets.md) to separate teams. Use additional workspaces when you need strict data isolation or separate dev and prod environments. See [Workspaces](https://docs.hightouch.com/workspace-management/workspaces.md) for guidance on when to add a workspace.

### 2. Create your workspace

Set up your organization and first workspace. Choose a region, pick a workspace name and slug, and walk through the onboarding checklist.

[**Workspaces**](https://docs.hightouch.com/workspace-management/workspaces.md) — create, configure, switch, and delete workspaces

### 3. Set up access control

Configure how your team authenticates and what they can access. Set up SSO and SCIM to automate provisioning, map identity provider groups to Hightouch user groups, and assign roles.

[**SSO setup**](https://docs.hightouch.com/workspace-management/sso.md) — connect your identity provider for centralized authentication\
[**Manage users and groups**](https://docs.hightouch.com/workspace-management/user-management.md) — invite users, assign groups, manage membership\
[**Roles**](https://docs.hightouch.com/workspace-management/roles.md) — pre-built and custom permission sets\
[**Transfer org admin access**](https://docs.hightouch.com/workspace-management/user-management.md#transfer-organization-admin-access) — hand off admin privileges when team members change

![User groups diagram](https://mintcdn.com/hightouch-3c037897/L_vQfA0JQEpeGUUo/images/get-started/user-group-diagram.png?fit=max\&auto=format\&n=L_vQfA0JQEpeGUUo\&q=85\&s=13c1130d1fbaedf6eee26b52401a68e3)

*User groups manage access across workspaces, with roles assigned at the group level.*

> [!TIP]
>
> Start with pre-built roles during onboarding. Move to custom roles once your
> org structure or compliance needs require it.

### 4. Plan your governance

Decide how teams should collaborate within your workspace: who can publish changes, what data they can reach, and what requires approval. Hightouch offers several controls that layer on top of each other.

[**Governance best practices**](https://docs.hightouch.com/workspace-management/governance.md) — when to use each control and how they layer together\
[**Environments**](https://docs.hightouch.com/workspace-management/environments.md) — dev/staging/prod promotion within a workspace\
[**Approval flows**](https://docs.hightouch.com/workspace-management/approval-flows.md) — require review before changes go live\
**Spaces** — scope resource visibility across teams\
[**Subsets**](https://docs.hightouch.com/customer-studio/subsets.md) — limit which records marketers can query by region, brand, or compliance boundary\
[**Destination rules**](https://docs.hightouch.com/customer-studio/destination-rules.md) — control which records can be sent to specific destinations\
[**Templates**](https://docs.hightouch.com/customer-studio/templates.md) — standardize audience and sync setup so marketers start from approved patterns\
[**Audit logs**](https://docs.hightouch.com/workspace-management/audit-logs.md) — track all in-app user actions for 90 days

### 5. Secure your infrastructure

Configure storage, networking, and monitoring to meet your security and compliance requirements.

[**Security overview**](https://docs.hightouch.com/security/overview.md) — encryption, compliance, and hosting details\
[**Storage**](https://docs.hightouch.com/security/storage.md) — configure self-hosted storage for data-at-rest\
[**Networking**](https://docs.hightouch.com/security/networking) — tunnels, PrivateLink, IP allowlisting\
[**Alerting**](https://docs.hightouch.com/syncs/alerting.md) — sync failure notifications via Slack, email, PagerDuty, or Datadog\
[**Sync logs**](https://docs.hightouch.com/syncs/warehouse-sync-logs.md) — write sync history to your warehouse

### 6. Organize resources (optional)

As your workspace grows, use folders, labels, and filters to keep things navigable.

[**Folders, filters, and labels**](https://docs.hightouch.com/workspace-management/folders-filters.md)

## Readiness checklist

Before marketers can start building audiences, the workspace needs to be fully configured. Use this checklist to verify that all setup is complete across teams.

**Platform admin responsibilities:**

* [ ] Workspace created and region selected
* [ ] SSO and SCIM configured (if applicable)
* [ ] User groups created and roles assigned
* [ ] Governance configured: environments, approval flows, Spaces, subsets, destination rules, and templates
* [ ] Storage, networking, and alerting configured per security requirements
* [ ] Marketers have the right roles and Space access to see the data they need

**Confirm with your data team or whoever owns the technical setup:**

* [ ] At least one [source connected](https://docs.hightouch.com/sources/overview.md) with the [Lightning sync engine](https://docs.hightouch.com/syncs/lightning-sync-engine.md) (recommended)
* [ ] At least one [destination connected](https://docs.hightouch.com/destinations/overview.md)
* [ ] [Schema defined](https://docs.hightouch.com/customer-studio/schema.md) with parent model, related models, events, and traits

> [!NOTE]
>
> In smaller teams, one person may own both platform admin and data team responsibilities. The checklist above is organized by responsibility, not job title.

## Next steps

* **Data teams:** [Technical setup](https://docs.hightouch.com/getting-started/data.md) — connect sources, configure sync infrastructure, and define schema.
* **Marketers:** [Daily usage](https://docs.hightouch.com/getting-started/business.md) — build audiences, run campaigns, and measure results.