A HubSpot–Salesforce connection can fail before records begin syncing. A Salesforce login-IP rule, the target organization, or the connected user’s access can block the OAuth connection. Start by identifying where the failure occurs; the remedy for a connection problem differs from a record-level sync error or an API-limit suspension.
HubSpot’s connection guide says its integration uses dynamic IP addresses, so there is no fixed HubSpot IP list to add to a Salesforce allowlist. The guide also identifies Salesforce’s “Enforce IP Restrictions on Every Request” setting as a possible connection blocker. Review the relevant control with your Salesforce security owner before changing it.
Locate the failing stage first
Record the exact error, when it appeared, and whether HubSpot ever showed Salesforce as connected. That separates authentication and network-policy failures from later object or record sync issues.
| Observed symptom | Likely layer | Next check |
|---|---|---|
| Salesforce login or authorization does not complete | OAuth, org access or login-IP policy | Confirm production vs. sandbox and review Salesforce login-IP enforcement |
| HubSpot shows Salesforce connected, but one object does not sync | Connected-user object access or object sync rules | Check the user’s permission on that object and the object’s sync configuration |
| Only certain records are skipped or fail | Record eligibility, field mapping or validation | Inspect the record’s sync error and inclusion/selective-sync criteria |
Use the status shown in the Salesforce integration settings together with the affected record or object. “Connected” confirms the authentication path is active; it does not confirm that every record meets sync rules.
Review Salesforce login-IP controls
HubSpot documents that Salesforce login-IP restrictions can prevent its integration from connecting because HubSpot uses dynamic IP addresses. A fixed list of HubSpot addresses is not available for an allowlist. HubSpot’s guide names Salesforce’s “Enforce IP Restrictions on Every Request” setting as a possible blocker and recommends configuring a network IP range when the organization needs to restrict access while permitting the integration. Salesforce’s session-security documentation separately explains how enforcing profile login-IP ranges on every request affects client applications.
Have a Salesforce administrator review the login IP ranges applied to the connected user’s profile and the organization’s session-security settings. Salesforce explains that enforcing login ranges on every request extends the rule to client-application requests. OAuth connected-app IP policies can add another layer, and their behavior depends on the organization’s continuous-enforcement policy and authentication flow.
Keep the review scoped to the HubSpot connection. Do not turn off a broad IP restriction or relax an application policy as a generic troubleshooting step. Ask the security owner to compare the current policy with HubSpot’s documented connection guidance and approve any network or app-policy change.
For the product details, see HubSpot’s connection requirements and Salesforce’s guidance on session security settings and connected-app IP enforcement.
Verify the connected user and Salesforce organization
Confirm that HubSpot is being authorized into the intended Salesforce production organization or sandbox. If the integration was recently reconnected, compare the Salesforce organization shown in the connection flow with the environment your team expects. HubSpot supports one Salesforce instance per HubSpot account.
Review the Salesforce user used for the connection. HubSpot’s setup requirements include Salesforce administrator access, API Enabled, View Setup and Configuration, and Modify All access for the objects the integration needs to sync. Use the least access that satisfies the documented requirement and your organization’s security policy; do not add broad permissions to an unrelated user just to clear an error.
If the connected user changed, confirm that the new user belongs to the same production organization and has permissions equal to or greater than those of the prior connected user. A successful login by itself does not prove that the new user can read and update every required object.
HubSpot’s implementation guide describes how the connected user’s permissions shape sync behavior. Check object access and the exact failed action before changing the user’s role or profile.
Separate connection failures from record-sync issues
When the connection is active, investigate missing records through the relevant object’s sync rules. HubSpot records do not all sync automatically as soon as the integration is installed: triggers, field mappings, inclusion segments and selective-sync filters determine which records are eligible and which values can move between systems.
- For one object that will not sync, review the connected user’s object-level access and the object’s sync direction.
- For one record, read its sync error, confirm its inclusion or selective-sync eligibility, and check the mapped field and Salesforce validation rules.
- For an integration that is connected but suspended because of API usage, use the separate API-limit diagnosis.
This distinction prevents a team from changing network controls to solve a field-validation problem, or from repeatedly reauthorizing the integration when only a record filter is excluding data.
Retest with a controlled change
Before changing production security settings, document the current value and the exact connection error. Where practical, validate the intended configuration in a Salesforce sandbox or another approved test environment. Make one authorized change at a time, reconnect once, and record whether HubSpot establishes the connection to the intended organization.
After authentication succeeds, verify one approved test record in each required object and review its sync state. If a test record fails, capture the object, record type, timestamp and error text; then return to the record-level checks above. Do not bulk-resync a large population until the connected user, object access and eligibility rules are understood.
Common questions
Can we allowlist HubSpot’s IP addresses?
HubSpot says its integration uses dynamic IP addresses, so a fixed HubSpot address list is not available for an allowlist. Follow the current HubSpot and Salesforce guidance for network access controls rather than relying on a guessed address range.
Should we disable Salesforce login-IP enforcement?
Not as a default fix. HubSpot recommends configuring a Salesforce network IP range when the organization must restrict access and still allow its integration. Have the Salesforce security owner review the affected control and approve the narrowest workable configuration.
What if HubSpot is connected but only some records are missing?
Check the object’s sync rules and the record’s eligibility, mapped fields and exact sync error. A stable OAuth connection does not guarantee that every record qualifies to sync.
Need a clearer CRM handoff?
If the connection works but marketing and sales still cannot trace a record from source through CRM ownership and pipeline, review the Revenue Operations scope or request a revenue diagnostic.
Sources
- Connect HubSpot and Salesforce — connection requirements, dynamic IP behavior and connected-user requirements.
- Plan your HubSpot–Salesforce implementation — sync scope, user access, triggers and filters.
- Salesforce: Modify Session Security Settings.
- Salesforce: Connected App IP Relaxation and Continuous IP Enforcement.
How did this article land?
Choose one reaction. You can change it anytime.