HubSpot cloud application - Google Workspace Admin Help (2024)

1. Sign in to your HubSpot account as administrator.
2. Click your account name at top right.

   Your Hub ID is shown in the dropdown menu.

3. Copy and save the Hub ID.

Leave HubSpot open, you'll continue with HubSpot SSO setup in step 4 below after performing steps 2 and 3 in the Google Admin console.

1. Open a new browser window.

2. Sign in to your GoogleAdminconsole.

   Sign in using an account with super administrator privileges(does not end in @gmail.com).

   See Also

   Single Sign On Login ScreenSet up single sign-on (SSO)Set up single sign-on (SSO) to access private contentSet up single sign-on (SSO) using Active Directory Federation Services (AD FS)

3. In the Admin console, go to MenuAppsWeb and mobile apps.

4. Click Add appSearch for apps.

5. Enter HubSpot in the search field.
6. In the search results, hover over the HubSpot SAML app and click Select.
7. On the Google Identity Provider details page:
   1. Copy and save the SSO URL and Entity ID.
   2. Download the Certificate.
8. Click Continue.
9. On the Service provider details page, edit theACS URLand Entity ID, replacing {uniqueid-provided-by-sp} with the Hub ID you copied from HubSpot in Step 1 above.
10. Click Continue.

11. (Optional) To map Google directory attributes to the corresponding app attributes, in the Attribute Mapping window:

    1. Click Add Mapping.
    2. Click Select fieldselect a Google directory attribute.
    3. ForApp attributes, enter the corresponding app attribute.

12. (Optional) To enter group names that are relevant for this app:

    1. For Group membership (optional), click Search for a group, enter one or more letters of the group name, and select the group name.
    2. Add additional groups as needed (maximum of 75 groups).
    3. For App attribute, enter the service provider’s corresponding groups attribute name.

    Regardless of how many group names you enter, the SAML response will include only groups that a user is a member of (directly or indirectly). For more information, go toAbout group membership mapping.

13. On the Attribute mapping page, clickFinish.

1. ClickUser access.

   See Also

   Set up a customer portal

2. To turn a service on or off for everyone in your organization, clickOn for everyone orOff for everyone, and then clickSave.

3. (Optional) To turn a service on or offforan organizational unit:

   1. At the left, select the organizational unit.
   2. To change the Service status, selectOn orOff.
   3. Choose one:
      • If the Service status is set toInheritedand you want to keep the updated setting, even if the parent setting changes, click Override.
      • If the Service status is set toOverridden, either click Inherit to revert to the same setting as its parent, or clickSave to keep the new setting, even if the parent setting changes.
        Note: Learn more about organizational structure.

4. To turn on a service for a set of users across or within organizational units, select an access group. For details, go to Use groups to customize service access.

5. To turn on a service for a set of users across or within organizational units, select an access group. For details, go to Use groups to customize service access.

6. Ensure that your HubSpotuser account email IDs match those in your Google domain.

1. Return to the browser window where HubSpot is open.
2. Click the Settings icon in the top navigation bar.
3. In Security >Single Sign-on (SSO)click Set up.
4. Enter the information copied from Google in Step 2above into the following fields:
   • Identity Provider Identifier or Issuer URL: Entity ID.
   • Identity Provider Single Sign-on URL: SSO URL.
   • X.509 Certificate: Paste the certificate downloaded in Step 2.
5. Click Verify.

After verification, SSO is enabled in HubSpot.

HubSpot supports both Identity Provider (IdP) initiated and Service Provider (SP) initiated SSO. Follow these steps to verify SSO in either mode:

IdP-initiated

1. Sign in to your GoogleAdminconsole.

   Sign in using an account with super administrator privileges(does not end in @gmail.com).

2. In the Admin console, go to MenuAppsWeb and mobile apps.

3. SelectHubSpot.
4. At the top left, click Test SAML login.

   HubSpot should open in a separate tab. If it doesn’t, use the information in the resulting SAML error messages to update your IdP and SP settings as needed, then retest SAML login.

SP-initiated

1. Open https://app.hubspot.com/login,and click Sign in with Google.You should be redirected to the Google sign-in page
2. Enter your email address and password and click Next.

After your credentials are authenticated, you're automatically redirected back to HubSpot.

As a super administrator, you can automatically provision users in the app. For details, go to Configure HubSpot user provisioning.