A Pipedrive account holds the pipeline, contact list and email history of a sales team, and every user's personal API token can read everything that user can see. CRM data is commercially sensitive and full of personal data, so access to it deserves the same care as any other business system. This guide explains how to secure Pipedrive from the customer side: SAML single sign-on, security rules, visibility groups and permission sets, API tokens, Marketplace app OAuth scopes, and the Security center dashboard, audit log and alerts. It is written for Pipedrive administrators, sales operations leads and SaaS security teams. For the general SaaS control model, see the SaaS Security Guide; this page stays specific to Pipedrive.
This is an independent guide from NHI Mgmt Group, based on Pipedrive's public documentation as of November 2026. It is not sponsored or reviewed by Pipedrive. Product features change, so confirm settings against Pipedrive's current documentation.
Key takeaways
- Enforce SSO or enforce 2FA, never neither. SAML SSO is available on all Pipedrive plans and "Enforce SSO login" turns off password access; where SSO is not used, enforce two-factor authentication in Security center rules.
- Separate seeing from doing. Visibility groups decide what users can see and permission sets decide what they can do, and both need designing before you grant admin-level sets.
- Treat API tokens as user passwords. A Pipedrive API token is tied to one user and one company, carries all of that user's data access, and is controlled by the "Access their own API token" permission.
- Review Marketplace scopes, especially admin. OAuth scopes such as
mail:full,contacts:fullandadmindefine what an app can reach, and each app's page shows its granted permissions. - Use the Security center. The dashboard, active devices list, two-month audit log and security alerts for exports and deletions are the detection layer, on the plans that include them.
How identity and access work in Pipedrive
Pipedrive users sign in either with a Pipedrive email and password or through your identity provider using SAML single sign-on. Pipedrive documents SSO as available on all plans, configured by a user with account settings access under Company settings > Single sign-on, with setup guides for Microsoft Entra ID and Okta. After entering the SAML details you test the connection, select Enable for users, and then select Enforce SSO login to turn off password access.
Without enforced SSO, sign-in strength comes from Pipedrive's own security rules (Settings > Security center > Rules). When SSO is enforced, authentication and MFA come from your identity provider; confirm in Pipedrive's current documentation which password and 2FA rules still apply. The Advanced rules stay available either way.
| Control | Where it is set | Options in Pipedrive docs | Recommended use |
|---|---|---|---|
| SAML SSO | Company settings > Single sign-on | Enable for users; Enforce SSO login | Enforce, so MFA and conditional access come from the identity provider |
| Two-factor authentication | Security center > Rules | Enforcement available on all plans; also applies in the mobile app | Enforce for every account when SSO is not enforced |
| Password strength | Security center > Rules | Upper and lower case, number, special character, minimum 8 characters | Turn on all four; non-compliant users change password at next login |
| Password expiration and reuse | Security center > Rules | Expire every 365, 180, 90, 60 or 30 days, or never; block current or current plus one previous | Our view: prefer MFA and breached-password checks over short expiry; block reuse |
| IP restriction | Advanced rules | Allow access only for specific IP addresses | Office and VPN egress addresses for teams that work from known networks |
| Time restriction | Advanced rules | Allow access only at specific times, by day, time and time zone | Optional, for teams with fixed hours and higher-risk data |
Advanced rules apply immediately to all users who do not have account settings access. Rule changes are applied through Preview and enforce and then Enforce now, which lets you choose how users are told about the change. Test IP rules with a pilot first, because a missing egress range locks out remote staff.
Leavers: Pipedrive notes that a user deactivated in the identity provider can keep access for up to thirty days if they stay logged in. Deactivate the user in both Pipedrive and the identity provider, and end their sessions from the active devices list. See the SaaS deprovisioning guide.
Admin roles and privileged access
Privilege in Pipedrive comes from two places: account settings access, which lets a user configure SSO, security rules, visibility groups, permission sets and the Security center, and the admin-level permission sets per app area. Admin-level sets are predefined and locked: each includes every permission in its category, so a Deals admin has all deal permissions. Regular-level sets can be edited, and custom sets can be created under Manage Users > Permission sets.
| Permission or role | Effect | Least-privilege guidance |
|---|---|---|
| Account settings access | Configures SSO, security rules, alerts, visibility groups and permission sets; exempt from Advanced rules | Two or three named administrators with SSO and MFA; review quarterly |
| Global admin | Sees all people, organisation and product data regardless of visibility groups; can add apps for other users | Limit to sales operations owners |
| Deals admin | Sees all deals and leads and all pipelines regardless of visibility groups | Sales leadership only |
| Export data from list views | Bulk export of records (Global > Data management) | Turn off in regular sets; grant to a small reporting group |
| Access their own API token | Lets a user view and use their personal API token (Global > Tools and setup) | Turn off for most users; grant to integration owners |
| Delete permissions | Delete deals, people, organisations, custom fields, activities and more | Restrict deletion of people, organisations and custom fields |
| Edit items owned by other users | Change deals, leads, people and organisations owned by others | Grant to team leads, not every seller |
Custom permission sets are available on Premium (15 sets), Ultimate (25) and Enterprise (150) plans, and extra sets can be bought under usage limits; confirm limits for your plan in Pipedrive's docs. Design sets by job role: seller, team lead, sales operations, finance reader and integration owner.
Visibility groups
Visibility groups are the data boundary. On Premium and higher plans there are four levels: Item owner, Item owner's visibility group, Item owner's visibility group and sub-groups and All users. Each user belongs to one group, groups can have parents for hierarchy, and a user removed from a custom group returns to the default group. Admins can hide whole pipelines from a group, which makes those deals invisible to it.
- Default level: set new items to the owner's visibility group rather than All users, so a single compromised seller account exposes one team's records.
- Item-level overrides: the visible-to setting on an individual item can differ from the group rule; review items set to All users that contain sensitive contacts.
- Pipelines: hide partner, M&A or HR pipelines from groups that do not need them.
For the general approach, see the SaaS Admin Account Protection guide and the Least Privilege Techniques Guide.
Integrations, API tokens and service accounts
Pipedrive offers two ways for software to reach company data: a personal API token and OAuth 2.0 for Marketplace and private apps. They behave very differently, and choosing the right one is the main non-human identity decision in Pipedrive.
| Credential | How it is used | Scope and lifetime (Pipedrive docs) | Security handling |
|---|---|---|---|
| Personal API token | Sent in the x-api-token header; found under Settings > Personal preferences > API | Tied to one user and one company; access to all of that user's data; one active token per user; changing it breaks integrations using the old one | Issue from a dedicated integration user with a narrow permission set and visibility group; store in a secrets manager; rotate on owner change |
| OAuth access token | Bearer token for {company_domain}.pipedrive.com/api/v1 | Limited to the scopes approved at install; expires after 60 minutes | Approve only the scopes the app needs |
| OAuth refresh token | Used by the app to get new access tokens | Expires if unused for 60 days; each use resets the window | Uninstall unused apps rather than relying on expiry |
| App client secret | Basic authentication on token exchange and refresh | Held by the app developer | For private apps, keep in a secrets manager and limit who can read it |
Because the API token inherits the user's own access, the safest pattern is an integration user: a named, owned Pipedrive seat used only for one integration, placed in a visibility group that holds only the records the integration needs, with a permission set that allows the API token and nothing else it does not use. Record the owner, purpose and rotation date in your inventory. See the SaaS API Token Security Guide and the Service Account Security Guide.
Marketplace app OAuth scopes
Marketplace apps request scopes at install. The scopes worth questioning most are below.
admin: "Administer account": manages pipelines, stages, fields, activity types, users and permissions. Pipedrive states that installing an app with this scope needs a user with admin rights. Approve only for apps whose function is administration.mail:readandmail:full: read, and in the full scope update and delete, mail threads. Email often holds contracts and personal data.contacts:fullanddeals:full: create, update and delete people, organisations and deals.users:read: reads user data, permissions and roles, useful to an attacker mapping the account.webhooks:full: creates webhooks that stream data changes to an external URL.
Installed apps are listed under Tools and apps > Installed apps (or Marketplace apps). Each app page shows granted permissions, user management and uninstall options. Global admins can install an app for all users or specific users, and each user still authorises it individually. Our recommendation: keep an approved app list, have one owner per app, and uninstall apps with no owner. See the SaaS and OAuth App Governance Guide.
Logging and detection
Pipedrive's Security center (Company settings > Security center) gives administrators with account settings access a dashboard, device views, an audit log and alerts. Some sections are limited to higher plans; check Pipedrive's plan pages for your account.
| Source | What it shows | Detection use |
|---|---|---|
| Dashboard: right now | Users logged in and their locations; unique locations by device count | Spot sessions from unexpected countries |
| Dashboard: last 7 days | New devices, new locations, security events, force logouts | Weekly review of new access patterns |
| Security assessment | Measures rated high-risk, low-risk or non-issue with suggested actions such as Enable 2FA and Review permissions | Track posture improvements over time |
| Active devices | User, device, location, IP, login time and method; (30d) for "Remember me", (12h) otherwise | Force logout a device or a filtered set during an investigation |
| Device history | Two months of logins and logouts, manual or expired; exportable | Investigation timeline |
| Audit log | Two months of security-related changes by user, event and type; exportable | Export regularly to your SIEM to keep longer history |
| Security alerts | New device or location login, new user invited, repeated failed logins (more than three), password reset request, export downloads, pipeline or stage deletion, custom field deletion, deletion thresholds | Email alerting for account takeover and data loss |
Set alerts under Settings > Security center > Alerts. Each admin configures their own alerts, delivered instantly or as a daily or weekly digest, while deletion thresholds apply company wide. Send alerts to a monitored mailbox, not to one person. Because the audit log covers two months, export it on a schedule; see the SaaS Audit Log Retention and Licensing Guide.
Metrics that show it is working:
- Percentage of users signing in through enforced SSO or with enforced 2FA (target 100%).
- Number of users with account settings access, global admin or deals admin (trend down).
- Number of users with the API token permission, and tokens with no recorded owner (target zero unowned).
- Installed apps holding the
adminormail:fullscope, each with an owner. - Export download alerts per month, each explained.
- Security assessment high-risk findings open (target zero).
Hardening baseline
An ordered rollout that most teams can complete in a few weeks. Each step is reversible, and the rollback for each is to change the setting back in the same Security center or Company settings page.
- Inventory: export the user list, note who has account settings access and admin-level sets, list installed apps with their granted permissions, and list users who can see their API token.
- Turn on alerts: configure account access and data leakage alerts to a shared security mailbox before changing anything else.
- Configure SAML SSO: set up Pipedrive in your identity provider, test with a pilot group, then select Enable for users. Keep one administrator able to sign in during the pilot.
- Enforce SSO login: once everyone signs in through the identity provider, enforce SSO. If SSO is not an option, enforce 2FA and the password strength rules instead.
- Design visibility groups: create groups by team, set default visibility to the owner's group, and hide sensitive pipelines.
- Tighten permission sets: remove export, API token and bulk delete rights from regular sets; reduce admin-level sets to named owners.
- Move integrations to integration users or OAuth apps: replace personal tokens of real staff with owned integration users, and store tokens in a secrets manager.
- Review apps: uninstall unowned apps and question any app with the admin scope.
- Apply Advanced rules where they fit: pilot IP restrictions with one team before company-wide enforcement.
- Schedule reviews: our recommended cadence is a monthly export of the audit log and a quarterly access and app review.
| Organisation size | Priority choices |
|---|---|
| Small team (under 20 users) | Enforce 2FA or SSO, keep one or two admins, review apps and API token permission twice a year |
| Mid-size | Enforced SSO, visibility groups by team, custom permission sets, alerts to a shared mailbox |
| Large or regulated | All of the above plus IP rules, integration users for every token, audit log export to SIEM and documented access reviews |
Common misconfigurations
- SSO enabled but not enforced: users can still sign in with a password, so turn on Enforce SSO login once the pilot succeeds.
- Everything visible to All users: the default item visibility left at All users means any seller account can read the whole CRM. Set the owner's visibility group as default.
- Integrations on a salesperson's token: a token from a real user carries that user's full access and breaks when they leave. Use an owned integration user.
- Too many admin-level sets: Deals admin and Global admin bypass visibility groups. Keep them to named owners.
- Apps nobody owns: apps installed for a trial keep their scopes. Review Installed apps and uninstall what has no owner.
- Leavers still signed in: deactivation in the identity provider alone can leave a session running. Log the user out from Active devices and deactivate them in Pipedrive too.
Apply Pipedrive's updates and security notices as they are published, and follow the Employee Offboarding Security Guide for joiner and leaver process.
Framework mapping
| Pipedrive control | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK technique it helps address |
|---|---|---|---|
| Enforced SSO, 2FA, password rules | IA-2, IA-5 | PR.AA-01 | T1078.004 Cloud Accounts |
| Visibility groups and permission sets | AC-2, AC-6 | PR.AA-05 | T1213 Data from Information Repositories |
| API token permission and integration users | IA-5, AC-6 | PR.AA-01 | T1528 Steal Application Access Token |
| Marketplace app scope review | SA-9, CM-7 | GV.SC-07 | T1550.001 Application Access Token |
| Active devices and force logout | AC-12 | PR.AA-05 | T1078.004 Cloud Accounts |
| Audit log and security alerts | AU-6 | DE.CM-03, PR.PS-04 | T1098 Account Manipulation |
Practitioner checklist
- SAML SSO configured, tested and set to Enforce SSO login, or 2FA enforced in Security center rules.
- Password strength rules on and password reuse blocked for any account that still uses a password.
- Account settings access, Global admin and Deals admin limited to named owners and reviewed quarterly.
- Default item visibility set to the owner's visibility group; sensitive pipelines hidden from groups that do not need them.
- "Export data from list views" and "Access their own API token" turned off in regular permission sets.
- Every API token belongs to an owned integration user and is stored in a secrets manager.
- Installed apps reviewed; each has an owner and only the scopes it needs, with the
adminscope questioned. - Security alerts for new devices, failed logins, exports and deletions sent to a monitored mailbox.
- Audit log and device history exported on a schedule to keep history beyond two months.
- Leaver process includes forced logout from Active devices and deactivation in both Pipedrive and the identity provider.
Standards and references
- Pipedrive: Security rules
- Pipedrive: Single sign-on (SSO)
- Pipedrive: Permission sets
- Pipedrive: Visibility groups
- Pipedrive: Security dashboard
- Pipedrive: Security alerts
- Pipedrive Developers: Scopes and permissions explanations
- Pipedrive Developers: Authentication
Related NHI Mgmt Group resources: SaaS Security Guide, SaaS API Token Security Guide, SaaS and OAuth App Governance Guide, Identity Provider and SSO Security Guide, SaaS deprovisioning.