HubSpot Okta and SSO integration.
Access and consent, governed. Single sign-on through Okta, Auth0 or Entra ID, two-factor enforced, and consent captured by OneTrust or Cookiebot flowing into the CRM as a property somebody can act on. The unglamorous half of a security review.
Someone left in March. The seat is still active.
Access sprawls, offboarding is manual, and the cookie banner tracks consent that never reaches the system doing the marketing. Each is minor on its own. Together they are the first three findings of every security review and the reason a deal stalls in procurement.
Consented on the banner. Ignored by the workflow.
Governance — the gapThe part procurement asks about.
Single sign-on properly configured
SAML against Okta, Auth0 or Entra ID, so access follows the directory. Joiners and leavers are handled where they are already handled rather than in a monthly spreadsheet.
Two-factor without exceptions
Enforced at the portal, with the handful of service accounts that cannot use it documented, justified and reviewed rather than quietly exempted.
Permission sets by role
Teams and permission sets built from what people actually need. Broad admin access is the most common finding in a HubSpot security review and the easiest to fix.
Consent that reaches the workflow
OneTrust or Cookiebot consent state as a HubSpot property, so sending logic and tracking obey it. A banner that records consent nothing else reads is decorative.
Regional consent models
GDPR opt-in, CAN-SPAM opt-out and the rest handled per region rather than with one global setting that is wrong somewhere.
Deletion and retention that work
A subject deletion request must reach HubSpot, the warehouse and the backups. A documented process beats an ad hoc scramble on a thirty-day clock.
Built to a contract, not to a connector.
Draw the boundary
Which system owns which field, in writing, before a line of code. Most broken integrations are two systems both believing they are the source of truth.
Model the join
The key that matches a record on one side to a record on the other, and the rule for what happens when it does not match — because it will not match.
Build and instrument
Sync built with retries, idempotency and a dead letter path, plus logging you can read without opening a console.
Reconcile
Counts compared on both sides on a schedule, with a report that names the drift rather than a green tick that hides it.
Hand over
A runbook covering the three failures that actually happen, so the next person does not have to reverse-engineer the design from the logs.
Consent is captured and never read.
The cookie banner is installed, consent is logged, and marketing automation carries on regardless because nothing connects the two. It is the most common compliance gap we find and among the cheapest to close, and it is the one that turns into a real problem under scrutiny.
What people ask before they commit.
Does HubSpot support SAML single sign-on?
Yes, on the appropriate tiers, against Okta, Auth0, Entra ID and any standards-compliant provider. Configuration is straightforward; the work is agreeing the permission model behind it.
Can we enforce two-factor for everyone?
Yes, at the portal level. The useful part of the exercise is the exception list, because service accounts and integration users are where the real risk sits.
How does consent reach HubSpot?
Through the consent platform API or its HubSpot integration, landing as properties. Then workflows and sending logic can respect it, which is the only reason to capture it.
Can you help with a security questionnaire?
Yes. We regularly answer the HubSpot-specific sections of vendor security reviews for clients, and we can point at HubSpot certifications and at what your own configuration does.
How long does it take?
One to three weeks for SSO and permissions. Consent plumbing depends on which platform you run and how many regions you operate in.
Where people go from here.
Pass the review.
Tell us what you are running
What the system does today, where it breaks, and when it has to work. An engineer reads it — you get an answer inside one business day, not a sequence.