Accounts in applications
Entra ID to HubSpot integration: HubSpot users with permission set, team and seat from Entra ID
With an integration between Microsoft Entra ID and HubSpot, every colleague in the right Entra group automatically gets a HubSpot user with permission set, team and seat, and loses that access as soon as the account is disabled in Entra ID. HubSpot itself offers SCIM for Entra ID for creating, permissions and deactivating; KoppelHet comes in for teams, seats under seat-based pricing and working hours, or when your HubSpot subscription has no SCIM.
What the integration does
Organisations with Microsoft 365 and HubSpot give new sales staff a Microsoft account on day one, but leave them waiting for an administrator for their HubSpot access. Teams in HubSpot lag behind the departments, so leads reach the wrong team, and a salesperson who has left sometimes keeps a paid seat for weeks.
- IT adds the new colleague in Entra ID to the group for their HubSpot role, for example inside sales.
- The colleague gets a HubSpot user with the permission set of that group and signs in with single sign-on.
- KoppelHet places the user in the team that matches the department in Entra ID and assigns the seat that fits the role.
- Job title, time zone and working hours from Microsoft 365 reach the HubSpot profile, so meeting pages show the right times.
- When IT disables the account or the colleague leaves the group, they lose access to HubSpot and the seat is freed.
What to watch for with Microsoft Entra ID and HubSpot
- HubSpot only supports SCIM provisioning on a Professional or Enterprise subscription and with single sign-on switched on. On a Starter account Entra ID therefore cannot create HubSpot users; KoppelHet then does it through HubSpot's user API.
- For Entra ID HubSpot has no ready-made app as it has for Okta and Google. You build your own private app with the SCIM feature in HubSpot and verify your domain with a DNS record. Each HubSpot account can only have one SCIM app.
- HubSpot warns that group sync must be off in Entra ID's provisioning settings. If it is on, provisioning in Entra ID goes into quarantine as soon as SCIM is set up in HubSpot.
- A role from Entra ID only becomes a HubSpot permission set if the names match exactly, with the same capitals and spaces. A role Inside sales and a permission set inside sales therefore do not match, and the user then gets minimal permissions.
- Through SCIM Entra ID cannot place a user in a HubSpot team, and with seat-based pricing it cannot assign a seat either. KoppelHet fills in those two from the department and groups in Entra ID, alongside the SCIM connection.
- Disabling in Entra ID deactivates the user through SCIM; contacts and deals then stay assigned. HubSpot's user API has no deactivate, only remove. Without SCIM KoppelHet therefore first has the manager hand over the contacts.
- Outlook often stores the time zone as a Windows name, such as W. Europe Standard Time, while HubSpot wants a time zone ID such as Europe/Amsterdam. KoppelHet converts the name and sets the time zone before the working hours, because HubSpot rejects working hours without a time zone.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Is SCIM from Entra ID not enough?
For creating, permissions and deactivating it often is. Teams and, under seat-based pricing, seats then remain manual work in HubSpot. That is where KoppelHet comes in.
Why Entra ID as the source and not the HR system?
If IT already creates accounts on time and the groups per role are right, Entra ID is the shortest route. If you want the job in HR to decide permissions, HubSpot can also be filled directly from, for example, AFAS or Workday.
What happens to the contacts and deals of someone who leaves?
With SCIM the deactivated user stays owner and you can hand over later. Without SCIM the manager gets a list to hand over before the last working day; the user is removed afterwards.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- HubSpot SCIM: Tenant URL https://api.hubspot.com/scim/v2 with the SCIM app token (scopes settings.users.read/write and crm.objects.users.read/write). roleSyncEnabled switches on the mapping from roles to permission sets.
- KoppelHet reads Entra ID through Microsoft Graph with a delta query on users and group membership, and mailboxSettings for time zone and working hours. HubSpot is written through the user provisioning API (/settings/users/2026-09: create, PUT with roleId, primaryTeamId, secondaryTeamIds and seatNames, DELETE) and the Users API (hs_job_title, hs_standard_time_zone, hs_working_hours).
- An app can only assign permission sets with a paid seat with the billing-write scope. Permission sets and teams are created in HubSpot first; teams can also be created through the Teams API with a parent team.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in HubSpot | Notes |
|---|---|---|
userPrincipalName | userName (SCIM) / email | Unique in HubSpot; the domain must be verified in HubSpot |
givenName | firstName | |
surname | lastName | |
App-rol of groep | Rechtenset (roleId) | With SCIM the name must exactly match the permission set |
department | primaryTeamId | Through a table from departments to HubSpot teams |
Groep per rol | seatNames | Only for roles entitled to a paid seat |
jobTitle | hs_job_title | |
mailboxSettings.timeZone | hs_standard_time_zone | Converted to a time zone ID such as Europe/Amsterdam |
mailboxSettings.workingHours | hs_working_hours | |
accountEnabled = false | Gebruiker gedeactiveerd (SCIM) of verwijderd (API) |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID