HubSpot Integration
Connect HubSpot to Iden to govern seats, permission sets and teams — installation, setup, what syncs, and troubleshooting.
This guide is for IT and security administrators connecting HubSpot to Iden.
Overview
Iden is an identity governance platform. Connecting HubSpot brings every HubSpot seat under the same access registry as the rest of your applications, so you can see who holds a seat, at what permission level, and remove access when it is no longer needed.
| Reads | Your HubSpot users, the teams they belong to, and the permission sets assigned to them |
| Writes | Creates users, updates their name, permission set and teams, and removes users from your HubSpot account |
| Runs | Automatically, every 4 hours by default |
What it does not do
- It does not read or write CRM data. No contacts, companies, deals, tickets, marketing emails or any other record in your CRM is touched.
- It does not change your subscription or buy seats. The billing permission is requested only because HubSpot gates permission sets with paid seats behind it; Iden reads no invoices, payment methods or billing history.
- It does not create, rename or delete teams or permission sets. Those are read from HubSpot as they are; Iden only assigns users to them.
- It does not suspend users. Revoking access removes the user from your HubSpot account and frees the seat.
Permissions requested
| Scope | Why |
|---|---|
oauth | Required by HubSpot for any OAuth app |
settings.users.read | Read the user list, and each user's permission set and team assignments |
settings.users.write | Create users, update their details and assignments, and remove them |
settings.users.teams.read | Read the list of teams so Iden can show and assign them by name |
settings.users.teams.write | Write team assignments when provisioning or updating a user |
settings.billing.write | Assign a permission set that carries a paid seat. HubSpot only allows an app to modify those permission sets if it holds this scope, so provisioning fails without it |
Before you begin
- A HubSpot user who can add and edit users. Installation grants Iden access to your user settings, so HubSpot only lets an administrator authorise it.
- An Iden account with the Super Admin role, or another role permitted to connect an application.
- Check whether your HubSpot plan includes teams and permission sets. Without them, Iden still syncs users; see Troubleshooting.
Installation
Start the installation from Iden, not from the HubSpot App Marketplace.
-
Sign in to Iden and go to Applications » Add application.
-
Search for HubSpot, select it, and click Connect to Hubspot. A HubSpot window opens.
If you are not already signed in to HubSpot, sign in now — the window shows HubSpot's login screen rather than the consent screen until you do.
-
If you have access to more than one HubSpot account, choose the account to connect. Iden governs the account you pick here; connect each account separately if you run several.
-
HubSpot lists the permissions Iden is asking for. Review them and click Connect app.
-
The window closes and returns to Iden. The button now reads Connected and the application moves out of its unconfigured state. The first sync starts automatically.
Setup in Iden
There is nothing to configure. HubSpot needs no API keys, portal IDs or subdomains — the OAuth authorisation is the whole setup.
Data sync flows
What Iden pulls from HubSpot
Iden syncs three resource types. Teams and permission sets sync first, so users can be linked to them.
Teams — every HubSpot team becomes a group in Iden. A user has one primary team and any number of secondary teams, matching how HubSpot models them, and both are shown as group memberships so you can review access by team.
Permission sets — every HubSpot permission set becomes a group in Iden. A user holds at most one.
Users
| Field in HubSpot | Shown in Iden as |
|---|---|
| User ID | Account identifier |
| First name / Last name | Name |
| Permission set | Group membership |
| Primary team | Group membership |
| Secondary teams | Group memberships |
| Created date | Provisioned date |
Every user returned by HubSpot is shown as active in Iden. A user either holds a seat or has been removed from the account.
What Iden writes to HubSpot
These run when you approve a request in Iden, not on a schedule.
| Action in Iden | Effect in HubSpot |
|---|---|
| Create user | Adds a user with the approved permission set, primary team and secondary teams already applied. HubSpot sends them a welcome email |
| Update user | Updates the name, permission set, primary team and secondary teams |
| Remove user | Deletes the user from your HubSpot account and frees the seat |
A user holds one permission set and one primary team.
If a create request names an email address that already has a HubSpot seat, Iden adopts the existing user rather than failing, and starts tracking it from the next sync.
Troubleshooting
Permission sets are missing from Iden — your HubSpot plan does not include custom permission sets. HubSpot returns "Account doesn't have access to roles", and Iden skips the permission-set sync and continues with users and teams.
The teams sync fails — teams depend on your HubSpot plan. If your plan does not include them, HubSpot rejects the request and the team sync reports a failed task. Users still sync; the failure is limited to teams.
The button still says "Connect to Hubspot" after authorising — the authorisation did not complete. Try again; if it persists, contact support with the approximate time of the attempt.
Access was removed in HubSpot but Iden still shows the app connected — uninstalling the app in HubSpot does not notify Iden. Iden detects it on the next sync, which then prompts you to reconnect.
Support
Email support@idenhq.com.