Yes, HubSpot supports SSO. It offers SAML-based single sign-on for Professional and Enterprise subscriptions of its hubs. A Super Admin sets it up under Settings, Security, Login, usually with an IT admin working in your identity provider, such as Okta, OneLogin, Microsoft Entra ID or Google.
It does, and it's worth knowing two conditions up front: it's on Professional and Enterprise subscriptions, and switching on the requirement can lock people out if you skip one step.
Which subscriptions include it
HubSpot's SSO article lists Marketing, Sales, Service, Data, Content, Smart CRM and Revenue hubs on Professional or Enterprise as the subscriptions that include single sign-on. SSO uses SAML, an XML-based open standard that passes authentication data between your identity provider and HubSpot.
A separate HubSpot article covers SSO for visitors to private content on HubSpot-hosted pages. That's a different setup from staff logins, so don't mix them up; this page is about how your team signs in.
What to have ready before you start
- Confirm your subscription is Professional or Enterprise on one of the listed hubs.
- Find a user with Super Admin permissions in HubSpot.
- Book time with the person who manages your identity provider, such as Okta, OneLogin, Microsoft Entra ID or Google.
- List anyone who'll need an exemption, such as agency partners or contractors without an SSO login.
- Choose the Super Admin who'll stay exempt as your fallback.
With that list in hand, the setup itself is quick, and you won't be scrambling to let someone back in afterwards.
Who should do the setup
Super Admin permissions are required to set up or edit single sign-on. HubSpot says the setup should be done by an IT administrator experienced in creating applications in your identity provider. In a small business, that often means a Super Admin and whoever manages your Google or Microsoft accounts sitting together for half an hour.
Where the settings live, and how it connects
- Click the settings icon, then Security, then the Login tab.
- In the Single sign-on (SSO) section, click Configure.
- Upload XML metadata, which is available for all SSO set-ups, or copy HubSpot's values into your identity provider and paste its values back.
- Click Verify.
HubSpot gives specific instructions for Okta, OneLogin, Microsoft Entra ID and Google. A toggle supports Microsoft AD FS, the legacy on-premise option, and it must be off for Microsoft Entra ID (formerly Azure AD). Getting that toggle wrong is a common reason verification fails.
Requiring SSO for everyone
After setup, you can require all users to log in with SSO using the Require single sign-on checkbox, which is on by default. You can exclude people, such as partners or contractors without an SSO login, with Manage exempted users.
Requiring SSO can lock people out
The HubSpot Knowledge Base article on setting up SSO flags the risk. Turning on Require single sign-on locks out everyone who isn't exempted. The user who turns it on is excluded automatically, and HubSpot advises exempting at least one Super Admin, so someone can switch the requirement off if your identity provider goes down.
The workaround: a break-glass admin
Before you save, add at least one Super Admin to Manage exempted users and keep their HubSpot password somewhere safe. Add any agency partners or contractors who don't have accounts in your identity provider. Then tell the team which login to use from now on. If your identity provider ever has an outage, the exempted Super Admin can switch the requirement off and get everyone working again.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
SSO in other tools
Intercom enables SAML SSO under Settings, Workspace, Security, Authentication methods, and works with identity providers such as Okta and Microsoft Entra. Notion provides SAML SSO for workspaces on its Business or Enterprise plan. For wider login security, my piece on passwordless authentication and my guide on improving your business security are good next reads.
My verdict on HubSpot SSO
If you're on a Professional or Enterprise subscription and your team already signs in through Okta, Microsoft Entra ID or Google, turn it on: one login is simpler for staff and easier to control when someone leaves. Do it with your IT admin, check the AD FS toggle, and never require SSO without first exempting a Super Admin. For the rest of your account, my HubSpot setup checklist covers what else to tighten.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Which identity providers does HubSpot document?
Okta, OneLogin, Microsoft Entra ID and Google, plus AD FS.
Who can set up SSO?
A user with Super Admin permissions, ideally with an IT administrator.
Can I force everyone to use SSO?
Yes, with the Require single sign-on checkbox.
Can some people still log in with HubSpot accounts?
Yes, via Manage exempted users.
Is SSO for private content the same thing?
No. That's a separate setup for visitors to private pages.
