Synchronizing HubSpot Roles with Microsoft Entra ID via SCIM Without Group Synchronization

Developer Support APIs & Integrations
1

Hello Community,

We are currently working on a custom SCIM integration between Microsoft Entra ID and HubSpot, and we would like to clarify a limitation we are facing regarding the management of HubSpot roles (permission sets).

Our target setup would be:

  • to manage roles on the Microsoft Entra ID side, ideally using groups;
  • to disable group synchronization to HubSpot in order to avoid technical limitations and quarantine issues on the Entra ID side;
  • while still allowing HubSpot to automatically receive user role assignments via SCIM.

Based on our current understanding, disabling group synchronization prevents any information from being sent to HubSpot that would allow automatic role assignment, which seems to block this scenario.

However, HubSpot’s documentation for custom SCIM applications explicitly mentions the ability to synchronize roles using the roleSyncEnabled parameter, allowing identity provider roles to be mapped to HubSpot permission sets, provided that the role names match exactly.

In this context, we would like to know:

  • Is it possible to use role synchronization (roleSyncEnabled) with Microsoft Entra ID without enabling group synchronization?
  • Or is this approach currently not supported, with no officially supported solution outside of HubSpot’s dedicated SCIM connectors?

If anyone in the community has already faced this situation or implemented an alternative solution, your feedback would be greatly appreciated.

Thank you in advance for your clarification.

Capture d’écran 2025-12-16 à 10.39.23.png
Capture d’écran 2025-12-16 à 10.39.23.png1388×230 64.9 KB

2

Hi @RayanDigi :waving_hand: Happy Wednesday!
Great question! When reviewing the documentation for “Set up SCIM for your app”, it looks like the roleSyncEnabled parameter in the scim-hsmeta.json configuration determines whether roles from your identity provider sync to HubSpot permission sets. It’s important to note that role names have to match exactly, including capitalization and spaces, between your IdP and HubSpot.

For Microsoft Entra ID specifically, the documentation mentions that:

“If you’re setting up SCIM with Microsoft Entra, you should disable group synchronization in the provisioning settings of your Entra account. Otherwise, the Entra ID service will enter a quarantine state after you finish configuring SCIM in your HubSpot account.”

It doesn’t go into detail about whether roleSyncEnabled can function independently from group synchronization settings in Entra ID. The feature depends on how your IdP passes role information and whether Entra ID supports this outside group sync isn’t outlined in the documentation.

Since this looks like a nuanced technical scenario between Entra ID and HubSpot’s SCIM setup, I’d recommend reaching out directly to HubSpot Support.

Thanks so much for raising the question, and I hope you have a wonderful day!
Bérangère
This post was created with the assistance of AI tools

3

Working on setting up the SCIM app with Entra ID now. The guide from HubSpot is a bit thin, and wish they’d include the Entra ID setup also in their guide.

4

Hi @AGjertsen and welcome, we are delighted to have you here! :orange_heart:
Thanks for the valuable feedback! I’d recommend to submit it via the HubSpot Developer Feedback Form. If you’d prefer, I can submit it on your behalf, just let me know.
Now, let’s consult with our Top Experts: Hi @Anton, @HubDoPete and @FrancoQ do you have any insights to share with @AGjertsen, please?
Thanks so much and have a wonderful day!
Bérangère