Configuring SSO (SAML) HubSpot-Microsoft Entra ID (Office 365 Business Basic)

🔐 Prerequisites

-Global Administrator access in Microsoft Entra ID

-Super Admin access in HubSpot

-User email addresses must match exactly in both platforms

🟦 PART 1: Initial configuration in HubSpot

Step 1 – Go to security settings

In HubSpot:

Settings → Security → Single sign-on (SSO)

Step 2 – Select the Identity Provider
Choose:

• All Other Identity Providers

• (Microsoft Entra ID falls under this option)

HubSpot will automatically display the values Microsoft needs.

Step 3 – Copy the values provided by HubSpot

From HubSpot, copy these two key values:

• Audience URI (Entity ID)

• ACS / Reply URL

Example:

📌 These values must be shared with the Microsoft administrator

🟩 PART 2: Configuration in Microsoft Entra ID

Step 4 – Log in to Microsoft Entra

https://entra.microsoft.com

Navigate to:

Microsoft Entra ID → Enterprise applications

Step 5 – Create or open the HubSpot application

• If it does not exist:

  • New application

  • Create your own application

  • Type: SAML

• If it already exists:

  • Open HubSpot

Step 6 – Configure Single Sign-On (SAML)

Path:

Single sign-on → SAML

In Basic SAML Configuration, paste:

• Identifier (Entity ID) → Audience URI from HubSpot

• Reply URL (ACS URL) → ACS URL from HubSpot

Step 7 – Obtain the values generated by Microsoft

On the same screen, Microsoft automatically provides:

Key values:

• Login URL

• Microsoft Entra Identifier (Issuer)

• SAML Signing Certificate

• Federation Metadata XML

🟨 PART 3: Final steps in HubSpot

Step 8 – Import the Federation Metadata XML

In HubSpot, under the SSO section:

👉 Upload federation metadata file

Select the XML file downloaded from Microsoft

✅ HubSpot will automatically populate:

• Issuer URL

• Login URL

• X.509 Certificate

📌 This is the key step that completes the configuration

Step 9 – Verify the configuration

Click:

👉 Verify

If everything is correct, HubSpot will confirm the SAML connection.

Step 10 – Test the login

• Log out of HubSpot

• Log back in

• You should be redirected to Microsoft

• Access should be granted successfully

🧠 Best practices

✔ Test first with an admin test user
✔ Emails must be identical in Microsoft and HubSpot
✔ Document who the Global Admin is
✔ Do not enforce SSO until testing is complete
✔ Save the XML file as a backup

🗂️ Quick checklist (for future implementations)

• SSO enabled in HubSpot

• Audience URI copied from HubSpot

• ACS URL copied from HubSpot

• Application created in Microsoft Entra

• Federation Metadata XML downloaded

• XML imported into HubSpot

• Verification successful

• Login tested

🎯 Final note

What you implemented is clean identity architecture:
HubSpot defines the SAML contract, Microsoft validates the identity, and the XML ties everything together.