Commercial and project applications

CRM users and licences in Salesforce and HubSpot from HR or Entra ID

A CRM integration gives every new employee in a sales, marketing or service role a user in Salesforce or HubSpot automatically, with the profile or permission set for their job, and disables it on departure. KoppelHet builds this from AFAS, Workday, HiBob and other HR systems, or from Microsoft Entra ID.

Last updated: 9 November 2026

Discuss your integration All about Accounts in applications

What it is

In a CRM every user costs a licence or seat, and the profile decides what someone sees of customers. Who belongs in it is in HR: the job says whether someone does sales, the department which team they belong to.

Without an integration an administrator creates and removes users by hand. Licences keep running for people who have left, and customers stay in a leaver's name.

How the integration handles it

The job in HR decides the Salesforce profile and any permission sets. A job without Salesforce work produces no user, so licences are not used up by colleagues who do not work in it.
Which units and jobs get a HubSpot user is recorded in a table. Sales regions from AFAS become sub-teams under the sales team in HubSpot.
Salesforce can only refer to an existing user as manager. If the manager has no licence, KoppelHet looks further up the chain for the first one who is in Salesforce.
Someone with two contracts or with two employers in one AFAS environment becomes one user, based on the job of the main contract.
On departure the manager gets a list of customers and deals still in the leaver's name before the termination date.
The integration reads HR with only the employee fields the CRM needs. Salary, citizen service number and bank details stay away from the CRM.

Edge cases we handle

Salesforce refuses to deactivate a user who is still default owner of leads or cases. KoppelHet then freezes the account immediately, so sign-in is no longer possible, and reports what still needs to be handed over.
The Salesforce username must be unique across all Salesforce environments worldwide. If the address already exists in an old trial environment, creation fails; KoppelHet then uses an agreed variant.
HubSpot only supports SCIM with a Professional or Enterprise subscription and single sign-on. On a Starter account KoppelHet creates users through HubSpot's user API.
Through SCIM a user cannot be put in a HubSpot team, nor get a seat with seat-based pricing. KoppelHet handles team and seat as well.

What KoppelHet does

KoppelHet builds the integration so profiles, permission sets, teams and seats can differ per job, also when the job is only right in HR. If deactivation gets stuck, KoppelHet reports what still needs to be handed over. You maintain the table from job to profile yourselves. Expect two to four weeks to go-live.

Common integrations

AFAS Profit → Salesforce

AFAS to Salesforce integration: sales and service staff from AFAS as Salesforce users

Microsoft Entra ID → Salesforce

Entra ID to Salesforce integration: Salesforce users from Microsoft Entra ID, with profile and permissions

Workday → Salesforce

Workday to Salesforce integration: Salesforce users with the right language, time zone and role from Workday

AFAS Profit → HubSpot

AFAS to HubSpot integration: HubSpot users based on function and department in AFAS

Microsoft Entra ID → HubSpot

Entra ID to HubSpot integration: HubSpot users with permission set, team and seat from Entra ID

HiBob → HubSpot

HiBob to HubSpot integration: HubSpot users that follow the lifecycle in Bob

Visma Raet YouForce → HubSpot

YouForce to HubSpot integration: HubSpot users with permission set and team from Visma Raet

SAP SuccessFactors → HubSpot

SuccessFactors to HubSpot integration: commercial employees from Employee Central as HubSpot users

Frequently asked questions

What happens to a leaver's customers and opportunities?

In Salesforce they stay in the name of the deactivated user; the sales manager or administrator hands them over. In HubSpot the manager gets a list in advance, because records not handed over get a deleted owner after removal.

Can we assign permission sets per job too?

Yes. The translation table has a profile and zero or more permission sets per job. A new job without a rule goes on a list for the administrator.

Why HR as the source and not Entra ID?

If IT already keeps accounts and groups in Entra ID up to date, Entra ID is the shortest route. If job and department are only right in the HR system, that can be the source.

What if someone moves from sales to a job without CRM?

Then the integration treats it as leaving HubSpot: the manager gets the handover list and the seat is released on the effective date of the new job.