BetaSet up enterprise-managed authentication in Claude

Enterprise-managed authentication (EMA) lets admins set up the HubSpot connector for their Claude organization. Eligible members then see HubSpot already connected in Claude, without installing the connector or approving a separate connection themselves.

With Claude-issued managed authorization, admins choose who receives automatic access in Claude and manage the connector's access in HubSpot. Each member connects as their own HubSpot user, with their existing HubSpot permissions. 

Before you get started

Before you set up authentication, confirm the following roles and prerequisite steps:

• A Claude Team or Enterprise organization with Claude-issued managed authorization available for the HubSpot connector.
• An admin who can manage connectors in Claude and a HubSpot Super Admin who can manage approved apps. One person can perform both these roles if needed.
• The HubSpot connector is available in your Claude organization's Connector settings.
• The HubSpot connector has been installed by an admin in the HubSpot account you want to connect. You can start with this existing connection before configuring EMA for other team members.
• An active HubSpot user account for each team member who will use the connector. Each member’s Claude email address must match their verified HubSpot email address.

If an admin hasn't installed the connector in the target HubSpot account, follow these instructions to set up the HubSpot connector for Claude to complete the initial connection. Then, review the app's approval and access settings before proceeding.

Verify that each team member has the correct permission set in HubSpot. For currently supported tools, team members use the same HubSpot permissions and entitlements in Claude, subject to the connector's allowed scopes and data permissions.

Learn more about Claude's managed authorization settings and role controls.

Access settings in Claude and HubSpot

The table below outlines the different access settings in Claude and HubSpot:

Giving someone access to the connector in Claude doesn't create a HubSpot user or expand their HubSpot permissions. Review access in both services before enabling the connection for your team.

Claude confirms that admins and users of the connector are current members of your Claude organization with email address they've configured. It doesn't confirm a separate identity-provider sign-in or check that provider's multi-factor authentication (MFA) requirements or HubSpot's sign-in rules. Anthropic recommends enforcing single sign-on (SSO) in Claude.

Set up managed authentication

The steps below walk you through how to confirm your current connector permissions, find your organization's issuer URL in your Claude settings, enable EMA, then test out the resulting connection.

1. Review the connector's access in HubSpot

First, confirm the current permissions for the HubSpot connector for Claude:

1. In your HubSpot account, click the settings icon in the top navigation bar.
2. In the left sidebar menu, navigate to Integrations > Connected Apps.
3. Click the Approved apps tab.
4. Find the HubSpot Connector for Claude, then click Manage access.
5. Click the Installed Permissions tab, review who can connect to the app. Include the HubSpot users who should receive automatic access in Claude. Members must also have access to the connector in Claude and belong to a role selected for managed authorization.
6. Click the Data permissions tab, review the data and APIs the connector can access. Add the permissions that your team needs, then save your changes.

HubSpot's app data permissions apply to all users, including admins. Required permissions can't be turned off. Learn more about managing access to apps.

Keep this HubSpot page open while you access your Claude account in a separate tab.

2. Get your Claude organization's issuer URL

Next, you'll find and copy the issuer URL from your Claude settings, which identifies the Claude organization that HubSpot will trust when connecting members.

1. In Claude, navigate to Organization settings > Connectors and select HubSpot.
2. In the connector's settings, find Managed authorization and open its setup.
3. Under Identity source, select Claude-issued.
4. Copy the full Issuer URL shown in the setup screen. If Claude shows Set up manually, expand it to view the URL.

Keep this setup page open in a separate browser window or tab. You'll return to it after enabling EMA in HubSpot.

3. Enable EMA in HubSpot

Use the issuer URL you copied to configure EMA in HubSpot:

1. Return to the connector's Manage access panel in HubSpot.
2. Click the Advanced tab.
3. Click the Enterprise managed authentication (EMA) switch to open setup.
4. Copy the Account ID shown in the panel. This is the HubSpot account you are connecting, and you'll use it as the tenant ID in Claude.
5. Paste the full URL from Claude into Issuer URL field.
6. Click Turn on EMA.
7. Confirm that the status is On and that the saved issuer URL is correct.

If the EMA setting is missing, check out the troubleshooting section below.

4. Test and enable the connection in Claude

Now that EMA is configured, test out the connection in Claude:

1. Return to the managed authorization setup in Claude.
2. For the Tenant ID field, enter the HubSpot Account ID you copied. Although Claude labels this field optional, you should still enter it for the HubSpot connection.
3. Click Run test and check that every stage succeeds.
   
4. Click Continue to open the Roles setup. Select which roles should connect through managed authorization. Review the selection before enabling it for your organization.
5. Click Enable.
   
6. On the Connector details panel, confirm that Managed authorization is on and Applied roles lists the roles you selected.
7. Under Managed authorization, click Edit next to Scopes to review and update the permissions Claude can request.
8. Review Roles with access to confirm that the intended members can find and connect the connector. Click Edit if you need to change this access.

Both Claude role settings matter: members need access to the connector, and their role must be included in managed authorization to connect automatically. Members must also meet the HubSpot account, email, and install-permission requirements described above. For more about Claude's role settings, check out this Claude Support article.

Check the member experience

Before announcing the change to your organization, ask a few team members to check the connection:

1. Open Claude in the organization where managed authorization is enabled.
2. Confirm that HubSpot appears connected. Enable the connector for the conversation if needed.
3. Start with a request that doesn't change data, such as: Which HubSpot account and user am I connected as? Don't change any data.
4. Confirm that the response identifies the expected HubSpot account and, if available, the team member's user details.
5. Try a request to read a record the team member can access in HubSpot.

Some user details require additional permissions. If those details aren't available, you can still check the connected account and a permitted record read. Missing optional details alone don't mean authentication failed; don't grant extra access just to complete this check.

Team members who meet the access requirements don't need to complete an individual HubSpot sign-in or connection consent screen. EMA doesn't remove approval prompts you configure for individual tool actions, such as updates to CRM records.

Manage access after setup

To update a team member's access after setup:

1. In your Claude account, open the Claude Connector details panel.
2. Under Managed authentication, click Edit next to Applied roles to change which roles use managed authorization.
3. To change who can find and connect the connector, click Edit next to Roles with access. 
4. Click Edit next to Scopes to manage which permissions Claude can request.

In HubSpot, review the Install Permissions tab to change who is allowed to connect to the app and Data Permissions tab to manage the data and APIs it can access. Each member continues to use their own HubSpot permissions.

Remove a member's access

Follow your organization's offboarding process in both Claude and HubSpot. Removing a person from the Claude organization stops Claude from issuing new identity assertions for them. An access token that was already issued can remain usable until it expires or is revoked, so don't rely on a membership change alone for immediate removal of access.

Before assigning a former member's email address to someone else, remove the former member as a HubSpot user through your organization's offboarding process. Removing only their connector access doesn't remove the old HubSpot user associated with that email address.

Turn off EMA

To turn off EMA:

1. In Claude, open the HubSpot connector's Managed authorization settings and click Disable.
2. In your HubSpot account, click the settings icon in the top navigation bar.
3. In the left sidebar menu, navigate to Integrations > Connected apps > Approved apps.
4. Find the connector, click Manage access, then select Advanced.
5. Click to toggle the Enterprise managed authentication (EMA) switch off, then click Turn off to confirm.

Disabling managed authorization ends automatic connection. Members who still need the connector must connect individually, subject to your organization's settings and HubSpot install permissions. Existing access tokens may remain valid until they expire or are revoked.

Troubleshooting

The sections below provide guidance on common errors you may encounter during the setup process.

The EMA setting isn't available

Confirm that you're a HubSpot Super Admin, you're in the correct HubSpot account, and you're managing the approved HubSpot connector for Claude. If Enterprise managed authentication (EMA) still doesn't appear under Advanced, contact HubSpot support to check availability for your account and connector.

Claude's connection test fails

Consult the table below for details on what to check based on the stage when the connection failed:

An invalid_grant error alone doesn't identify the root cause. Check the account, issuer URL, email match, and access settings before repeating the test.

A team member can't find HubSpot or still sees a Connect prompt

First, check that the member is in the intended Claude organization. In your Claude settings, on Connector details page, review Roles with access if they can't find the connector and Applied roles if they aren't connecting through managed authorization.

In HubSpot, confirm that they have an active user account, their verified email matches their Claude email, and install permissions allow them to connect.

A team member connects but can't access expected data

Review the connector's scopes in your Claude account, the app's Data Permissions in HubSpot, and the team member's HubSpot permissions. Automatic connection doesn't grant access to records or actions the member can't use in HubSpot.

If the issue continues, contact support with the operation that failed and the time it occurred. Don't include access tokens or signed identity assertions in a support request.