Workspace setup

​

Before you begin

• Admin or organization-owner access to your Hightouch account
• Your organization’s SSO provider details (if using SSO)
• Your marketing team’s first use cases. See the examples for lifecycle and paid media teams.

​

Setup steps

1

Learn the building blocks

Before configuring anything, learn how Hightouch is organized: organizations, workspaces, user groups, roles, environments, and Spaces.An organization represents your company and holds users, billing, and SSO. Workspaces sit inside it, each with its own sources, destinations, models, syncs, and users. Organization roles and workspace roles are separate: an organization admin isn’t automatically a workspace admin, and the reverse is also true.

2

Decide your workspace structure

Decide: whether teams share one workspace or work in separate ones.

Recommended starting point	Choose differently when
One production workspace for all teams. Separate teams inside it with groups, roles, Spaces, and subsets.	You need complete isolation: data residency in another region, separate infrastructure, or business units that must not share data or configuration.
Test changes to models and syncs in a linked staging workspace with environments.	You want review on audiences and other Customer Studio changes, or you only need review before changes go live. Use approval flows instead.

Then set up your organization and first workspace. Choose a region, pick a workspace name and slug, and work through the onboarding checklist. To compare workspaces and environments side by side, see Do you need another workspace?

3

Set up sign-in and access

Decide: how people sign in, how you group them, and what each group can do.

Control	Recommended starting point	Choose differently when
Sign-in	SAML SSO with SCIM, so accounts and group membership follow your identity provider	You’re evaluating Hightouch or have a small team. Invite users by email and add SSO later.
User groups	One group per team (for example, Admins, Data, Lifecycle marketing, Paid media), mapped from groups in your identity provider	Regions or brands need different access. Create a group for each.
Roles	Pre-built roles: Admin for the data or IT team, Editor for marketers, Viewer for stakeholders	A team should only use specific sources, destinations, or products. Create a custom role.
Admin access	Keep organization admins to your IT or data platform team, and delegate day-to-day management to workspace admins	You’re a small team where one person owns both.

Assign roles to groups, not individual users. A user in several groups gets the highest access any of their groups grants.When you roll out SSO:

• Copy the SSO URL and Audience URI exactly from Hightouch. Small typos cause login loops.
• Plan which identity provider groups map to which Hightouch groups before you turn SSO on.
• Test with two or three users before inviting everyone, and keep an admin signed in on a separate browser session in case you need to fix the setup.

For details, see SSO rollout best practices, Manage users and groups, and Roles. To hand off admin rights when someone leaves, see Transfer organization admin access.User groups manage access across workspaces, with roles assigned at the group level.

4

Choose governance for your team size

Decide: which controls your team needs now. Start with the tab that matches your organization, and add controls as you grow.

• Smaller teams
• Growing teams
• Larger or regulated teams

A few people share one workspace and trust each other’s changes.

• Your workspace structure, user groups, and pre-built roles from the previous steps are enough to start.
• Add audit logs to your routine so you can see who changed what. They cover 90 days of activity.

Several teams share a workspace but work on different regions, brands, or channels.

• Subsets: Limit the records each team can use, such as one region or brand.
• Spaces: Keep each team’s audiences and syncs separate while they share models and destinations. Spaces are enabled by Hightouch on request.
• Destination rules: Enforce consent for each channel, so opted-out customers are filtered out at sync time no matter who built the audience.

Many teams, regions, or business units, or formal review requirements.

• Custom roles scoped to the sources, destinations, and products each team uses
• Subsets and Spaces by region, brand, or business unit
• Destination rules for consent and regional policy
• Audience and sync templates so new work starts from approved logic, with templates required if needed
• Approval flows so changes are reviewed before they go live
• Environments for promoting models and syncs from staging to production
• Audit logs, written to your warehouse with Warehouse Sync Logs for retention beyond 90 days

Some common situations and the controls that handle them:

If…	Use
Teams share customer data but work independently	One workspace with Spaces and subsets
Regions or entities must be fully separate, such as EU data processed only in the EU	Separate regional workspaces, each tied to a regional warehouse
Consent rules differ by channel	Destination rules for each destination
Sensitive values should be hidden from everyone in the app	Redacted columns
Key segments and sync setups should be standardized	Audience and sync templates
Changes, such as new paid media syncs, need central approval	Approval flows, with custom roles so contributors draft and approvers publish. Turn on Prevent self-approval so no one approves their own changes.

5

Secure your infrastructure

Decide: where Hightouch stores customer data at rest, and how it reaches your systems.Set up self-hosted storage so customer data at rest stays in a bucket in your own cloud. It’s required on the Business tier, so set it up before your first sync. Adding it later means resyncing existing syncs. Your IT team usually provisions the bucket. Then configure the rest as your security requirements call for:

• Security overview: Encryption, compliance, and hosting details.
• Networking: Tunnels, PrivateLink, and IP allowlisting. Your data team needs this to connect a warehouse in a private network.
• Warehouse Sync Logs: Write sync history to your warehouse.

6

Set up agent access and Context Hub

Decide: who can use agents, who maintains the context they work from, and which context to add first. This step applies if your team uses Agents, Ad Studio, or Lifecycle Studio.

Decision	Recommended starting point
Who can use agents	Give the Access Agents grant to the marketers who use Agents, Ad Studio, or Lifecycle Studio. See Roles.
Who can change Context Hub	Give the Configure Agents grant only to the people who own context, not to everyone who uses agents. Without it, Context Hub is hidden. Configure Agents only works for people who also have Access Agents.
Who owns each area	Platform admins own permissions and workspace configuration. Data teams own business definitions, metrics, and data connections. Marketing and creative teams own brand profiles, assets, and content guidelines. See Manage Context Hub across your team.
What to add first	The context your first use case needs. For campaign analysis, connect your ad platforms and add a business context file with your metric definitions. For ads or emails, start with a brand profile.

You don’t need to configure all of Context Hub before teams start. Add context for one use case, review what agents produce, and expand from there.

7

Prepare Native Delivery (optional)

If your team sends email, SMS, or push from Hightouch with Native Delivery, work through Prepare for your first send with your Hightouch team and your data team before the first campaign.

8

Organize resources (optional)

Decide: how teams will find their work as the workspace grows.Set up a folder structure early, organized by team or region. Only workspace admins can change folders, so agree on the structure before teams start building. Use labels for things folders can’t capture, such as campaign type (type:email) or brand (brand:brand-a). Folders and labels help teams find resources. They don’t restrict access.

​

Troubleshoot common setup issues

​

Readiness checklist

• Workspace created in the right region
• SSO tested with a few users before rollout (if you use SSO), and at least one admin can still sign in if something breaks
• User groups created, with a role assigned to each
• Governance controls for your team size are in place (step 4)
• Self-hosted storage set up, so customer data at rest stays in your cloud
• Networking meets your security requirements (if your policy requires changes)
• If your team uses agents: Access Agents and Configure Agents granted where needed, and Context Hub owners assigned
• If you send with Native Delivery: Prepare for your first send is complete
• A marketer’s account can sign in and see the right workspace, Spaces, and data
• Your data team has finished the Data setup readiness checklist

​

Next steps

• Data setup for your data team to connect sources, configure sync infrastructure, and define the schema.
• Lifecycle marketing for lifecycle marketers to build audiences, run campaigns, and measure results in the workspace you set up.
• Paid media for paid media marketers to create, refine, and launch ads with Ad Studio.