What This Update Actually Is
HubSpot has always supported single sign-on. What it didn't support was more than one identity provider at a time. One account, one IDP. Full stop.
That changes on August 5, 2026. Super admins can now add multiple SSO configurations to a single HubSpot account, give each one a name, and let users choose the right one at login. The feature lives at Settings, then Security, then Single Sign-On.
This is a security and access management update, not a UI cosmetic change. It touches how every human in your HubSpot account authenticates from day one. That matters.
Why HubSpot Shipped This
The external problem is real: larger organizations and merged companies often run more than one identity provider. Think Okta for the marketing team and Azure AD for the legacy division that came in through an acquisition. Before this update, those two groups couldn't both authenticate through SSO in the same HubSpot account.
The internal frustration was worse. Admins had to choose: set up SSO for one group and leave the other logging in manually, or build workarounds that created more complexity and more risk. Neither option felt acceptable for a security-conscious team.
HubSpot's answer is to match how organizations actually manage identity instead of forcing them to reorganize identity management around HubSpot's previous limits.
How to Use It Step by Step
- Log in as a super admin in your HubSpot account.
- Navigate to Settings, then Security, then Single Sign-On.
- Select "Add SSO configuration" to begin setting up a new identity provider.
- Give the IDP a clear, recognizable name. Humans logging in will see this name at the selection screen, so make it obvious: "Okta (Marketing)" or "Azure AD (Legacy Division)" beats "SSO Config 2."
- Complete the IDP setup using your provider's SAML or OIDC credentials, just as you would for a single IDP.
- Repeat for each additional identity provider. There's no published cap on the number of IDPs you can add.
- Test the login flow with a user from each IDP before announcing the change broadly. Confirm the selection screen appears and routes correctly.
One important caveat: this is a super admin task. Your IT security team needs to be in the room, or at least looped in before you start adding IDPs. This isn't a setting to configure solo on a Friday afternoon.
What It Touches in Your HubSpot Strategy
This update ripples into more than just a settings page. Here's where it connects to the bigger picture.
User access and seat management. If you've been managing manual login credentials for one subset of your team because they were on a different IDP, you can now bring them under SSO. That means fewer passwords to manage, fewer support tickets for forgotten credentials, and stronger authentication coverage across the board.
Security posture and audit readiness. For companies with SOC 2 or ISO 27001 obligations, having some humans inside HubSpot on SSO and others on manual login creates an inconsistency that auditors notice. This update closes that gap.
Post-merger and acquisition scenarios. This is the big one. When two companies merge and both teams need access to a shared HubSpot account before IT consolidates identity providers, multi-IDP support removes a blocker that could delay go-to-market work by weeks.
Connected app governance. SSO changes often affect how third-party apps authenticate on behalf of users. If you've recently reviewed how your connected apps and app owners are managed, this is a good moment to do that audit again in light of your new IDP structure.
HubSpot Salesforce sync implications. If your team uses a Salesforce integration alongside HubSpot and different user groups authenticate through different IDPs, confirm that your sync credentials and service accounts aren't affected. Identity changes at the top of your stack can produce quiet failures downstream.
Key Takeaway
Multi-IDP SSO is most impactful when your organization has recently merged, runs separate IT domains for different departments, or needs to pass a security audit that flags mixed authentication methods.
Key Takeaway
Clear naming at the IDP configuration level is not optional. If humans see two identical or cryptic labels at the login screen, they'll pick the wrong one. Name your IDPs like you'd name a conference room: obvious, specific, and tied to the group that uses it.
Who Should Care Most
Not every HubSpot admin needs to act on this right away. Here's who it's most urgent for.
- IT and security admins at mid-market and enterprise companies who manage HubSpot alongside a larger identity infrastructure. This update directly removes a constraint you've been working around.
- RevOps leaders at companies that have gone through an acquisition in the last 12 to 24 months and still have two identity environments running side by side.
- HubSpot super admins at organizations with compliance requirements (SOC 2, ISO 27001, HIPAA-adjacent) who need consistent, auditable authentication across all humans in the portal.
- Agencies managing HubSpot portals for enterprise clients who often bump into this limit when a client has a complex identity setup and asks why some of their team can't use SSO.
If your entire company is on a single IDP already and nobody's ever raised an SSO access issue, this update probably doesn't require action today. File it and move on.
George's Take
I've sat in enough portal audits to know that SSO gaps are one of those things that live quietly in the "we'll fix it later" pile until something forces the issue, usually a security review or an angry user who can't log in. HubSpot's one-IDP limit wasn't a theoretical problem; it was a concrete blocker for real organizations running real complexity. The fix here is clean. It doesn't overcomplicate the admin experience. It just makes the tool match the real world. My advice: if you're on Professional or Enterprise and you have any suspicion that your team isn't fully on SSO because of an IDP mismatch, audit that list before August 5 so you're ready to move fast when this drops.
“SSO gaps live quietly in the 'we'll fix it later' pile until a security review forces the issue. This update removes the excuse to keep waiting.”
For teams thinking through the broader picture of how your HubSpot account is governed and connected, the way this SSO update intersects with your integration stack is worth a dedicated look. If you want a second set of eyes on your portal's security and access setup, or you're not sure how multi-IDP SSO fits into your current architecture, let's talk. Book a strategy call with the Sidekick team and we'll walk through it with you.
Frequently Asked Questions
What is the HubSpot multiple identity provider SSO update?
HubSpot now lets super admins configure more than one SSO identity provider inside a single account. Before this update, only one IDP was supported per account. The feature ships August 5, 2026, and is available on all Professional and Enterprise hubs. Users see an IDP selection screen when they log in.
Which HubSpot plans support multiple SSO identity providers?
Multiple SSO identity providers are available on Professional and Enterprise tiers across all major hubs: Marketing Hub, Sales Hub, Service Hub, Content Hub, Data Hub, Commerce Hub, and Smart CRM. Free and Starter plans are not included.
How do I add a second SSO identity provider in HubSpot?
Go to Settings, then Security, then Single Sign-On. Select "Add SSO configuration," enter the IDP credentials, and give it a clear name. Repeat for each additional provider. Users will see a selection screen at login and choose the IDP that matches their account.
Does adding multiple IDPs affect existing SSO configurations in HubSpot?
No. Your existing SSO configuration stays in place. Adding a second IDP doesn't disrupt current users who authenticate through the first. The new IDP appears alongside the existing one, and each user selects the correct option at login. Test with a pilot user before rolling out broadly.
Who is this HubSpot SSO update most useful for?
This update is most valuable for mid-market and enterprise companies that run multiple identity providers, such as organizations that have merged or been acquired, teams with separate IT domains by department, and any company with compliance requirements that mandate SSO for all users across the entire portal.
When does HubSpot's multiple SSO identity provider feature release?
The feature is scheduled for release on August 5, 2026. It was announced July 15, 2026. No action is required before the release date, but admins should review their current IDP setup and prepare naming conventions so configuration goes smoothly on launch day.
