The Administration page exposes account-wide settings. Today it controls the personal access token expiry policy — whether tokens get an automatic expiry date when they’re created, and how many days they last.
Who can access this page
Only users with the admin role on the connector see the Administration item in the left navigation. Regular users won’t notice the page exists.
The token expiry policy #
Open Administration. The Token Expiry Policy panel has two controls:
- Automatic expiry — a switch. When On, every access token in the HubSpot account — both existing tokens and tokens created afterward — falls under the lifetime limit. When Off, tokens are No expiry and only stop working when explicitly revoked.
- Lifetime (days) — the number of days for the automatic expiry. Only shown when the switch is On.
Save changes #
Change either control and the Apply button enables. Select it to commit the new policy.
Turning the policy on applies to every token in the HubSpot account, not just future ones. Existing access tokens that fall outside the new lifetime stop working immediately; their owners will need to re-issue them in Power BI before their next refresh. Plan ahead: communicate the change to data-source owners before the cutover so they can rotate tokens in time — see Manage Access Tokens.
Choosing a policy #
A primary reason to enable the policy is compliance: many security certifications (SOC 2, ISO 27001, internal information-security policies) require a hard ceiling on credential lifetime, and the expiry policy is what provides one across the entire HubSpot account. Once you’re past that requirement, choose the shortest lifetime your users can tolerate operationally.
- A short lifetime (30-90 days) is safer if tokens might leak — but everyone has to rotate the credentials in Power BI before each expiry.
- A long lifetime (365+ days) reduces rotation friction but increases the blast radius of a leaked token. Pair it with disciplined use of token labels and prompt revocation when a laptop changes hands.
- Off (no expiry) is appropriate only for tightly controlled environments where the connector users are a small, audited set.
Related #
- Manage access tokens
- View activity history — every token issuance and revocation is logged.
