×

HubSpot SCIM Setup with Okta

/ CRM, Hubspot / By

HubSpot SCIM Setup with Okta

Connecting Okta to HubSpot with SCIM lets you automate user provisioning, updates, and deactivation directly from your identity provider. This guide walks you through every step to configure SCIM in your account, sync users securely, and troubleshoot common issues so your team can access the tools they need with minimal admin effort.

What SCIM Does for HubSpot User Management

SCIM (System for Cross-domain Identity Management) enables centralized control of user accounts between Okta and your HubSpot account. Instead of adding or updating users manually, you manage them in Okta and the changes sync automatically to your portal.

With a correct configuration, you can:

  • Provision new users in your portal when they are assigned in Okta.
  • Update user names and email addresses when identity data changes.
  • Deactivate or reactivate users based on their Okta status.
  • Reduce manual work and access risk across your teams.

Requirements Before You Configure HubSpot SCIM

Before you connect SCIM, confirm you meet the key requirements in both systems. Completing these prerequisites prevents sync failures later.

HubSpot account requirements

  • You must be a Super Admin in your account.
  • Your subscription must support SCIM and SSO features.
  • Your email domain and user accounts should be fully verified and active.
  • Users should have unique primary email addresses across the portal.

Okta environment requirements

  • Admin access to your Okta organization.
  • The HubSpot app added from the Okta Integration Network.
  • SCIM 2.0 support enabled for the app in Okta.
  • Planned mapping between Okta user attributes and your portal user data.

For expert implementation help across identity, CRM, and automation, you can also work with a partner such as Consultevo.

Step 1: Enable SCIM in Your HubSpot Settings

Start by turning on SCIM in your account and generating the credentials Okta will use.

  1. Sign in as a Super Admin.
  2. Navigate to your security or user management settings area.
  3. Locate the section for SCIM or user provisioning.
  4. Enable SCIM provisioning for your portal.
  5. Generate a SCIM base URL and an access token or API key to authenticate the sync.
  6. Store these details in a secure location. You will paste them into Okta in the next step.

Once SCIM is enabled, your account is ready to accept provisioned users from Okta according to your configuration.

Step 2: Configure HubSpot SCIM in Okta

Next, you link the Okta app to the SCIM endpoint for your portal so both systems can communicate.

  1. Log in to your Okta Admin Console.
  2. Open the HubSpot application you previously added.
  3. Go to the Provisioning tab.
  4. Click to enable provisioning to the app.
  5. Enter the SCIM base URL from your account settings.
  6. Paste the access token or API key you generated earlier.
  7. Test the connection to confirm Okta can reach the SCIM endpoint.
  8. Save your provisioning settings.

After this step, Okta can start pushing user data into your portal using SCIM whenever you assign users to the app.

Step 3: Map HubSpot User Attributes from Okta

Attribute mapping controls which identity fields are sent from Okta and how they populate user profiles in your portal. Accurate mapping reduces profile discrepancies and login problems.

Core attribute mappings for HubSpot users

In the provisioning settings for the app, confirm or edit the mappings for:

  • UserName / Primary email — maps to the primary email for the portal user.
  • Given name — maps to first name in user profiles.
  • Family name — maps to last name.
  • Display name — maps to the preferred full name shown in your account.

Only attributes enabled for provisioning will sync during create and update operations. Make sure you review which fields are required in your account so user creation does not fail.

Optional role or team attributes in HubSpot

If your plan supports advanced user settings, you may be able to map additional fields, such as:

  • Team or department identifiers.
  • Job title or role descriptions.
  • Localization preferences, such as language or region.

These can help keep access aligned with internal structures, though many permissions are still managed within the app after provisioning.

Step 4: Assign Users in Okta to Provision into HubSpot

With SCIM enabled and attributes mapped, assigning a user in Okta triggers account creation or updates in your portal.

  1. In the Okta Admin Console, open the app for your CRM.
  2. Go to the Assignments tab.
  3. Click to assign individual people or groups.
  4. Search for the user or group you want to sync.
  5. Confirm the assignment and review the attribute values.
  6. Save the assignment to start provisioning.

Okta will then send a SCIM request to create or update the user in your portal. You can check the provisioning logs in Okta to confirm the operation succeeded.

How SCIM Updates and Deactivation Work in HubSpot

Once configured, ongoing lifecycle actions happen automatically based on user state changes in Okta.

User updates from Okta to HubSpot

When you modify supported attributes for an assigned user in Okta, SCIM attempts to sync the changes to your portal. Common updates include:

  • Change of primary email address.
  • Updated first or last name.
  • Modifications to display name or profile details.

Only attributes set as writeable in the Okta mapping will be updated in your account.

User deactivation behavior

If you deactivate or unassign a user in Okta, SCIM will attempt to deactivate the corresponding user in your portal. Typical outcomes include:

  • The user loses access to sign in through SSO.
  • The account remains in your portal but marked as deactivated.
  • Data owned by the user is preserved for reporting and history.

If you later reassign or reactivate the user in Okta, SCIM can reactivate the account in your portal, depending on your settings.

Monitoring and Troubleshooting HubSpot SCIM with Okta

Even with a correct setup, you should monitor provisioning flows and know where to look when something breaks.

Where to review provisioning activity

  • Use Okta provisioning logs to see detailed SCIM requests and responses.
  • Review user management sections in your portal for newly created or updated users.
  • Check for error messages about duplicate email addresses or invalid attributes.

Common SCIM issues for HubSpot admins

  • Provisioning fails on create — usually caused by duplicate emails, missing required attributes, or disabled SCIM settings.
  • Updates do not appear — the attribute might not be mapped correctly or set to write in Okta.
  • Deactivation does not sync — the user may still be assigned to the app in Okta or changes have not yet propagated.

If issues persist, compare your configuration step-by-step with the official setup details in the product documentation. For the latest instructions and screenshots, reference the source guide at this HubSpot knowledge base article.

Keeping Your HubSpot and Okta Integration Healthy

After your initial rollout, plan periodic reviews of your SCIM and SSO configuration so your integration continues to match your organizational structure.

  • Audit user and group assignments in Okta for accuracy.
  • Verify that new employees are provisioned correctly into your portal.
  • Remove access promptly for departing staff by deactivating or unassigning them in Okta.
  • Update attribute mappings if your internal naming conventions or departments change.

A well-maintained SCIM integration helps ensure the right people have the right level of access to your CRM while minimizing manual administration work and improving security.

Need Help With Hubspot?

If you want expert help building, automating, or scaling your Hubspot , work with ConsultEvo, a team who has a decade of Hubspot experience.

Scale Hubspot

“`

Verified by MonsterInsights