Configuring SSO Access to Harvey

Overview

Harvey employs Security Assertion Markup Language (SAML) to facilitate seamless Single Sign-On (SSO) integration.

SSO Setup Process

To initiate the configuration process, contact your Account Manager. The Harvey Solutions team will securely send you the necessary information you need to create the X509 Signing Certificate:

• Assertion Customer Service URL
• Entity ID

In addition, you will need to to configure the following:

• Name ID: Primary Email / Preferred Email
• Primary Email / Preferred Email → email

Roles

The following roles can be assigned to users:

• Workspace Admin: Has access to the Command Center, the home for all workspace administration settings in Harvey.
• User: Basic access to Harvey with access only to their specific history.

These roles can be customized to serve your needs. Refer to Access Control and Permission Management for more information on updating role assignments, custom roles, and access controls.

Feature Flags

You can decide which features of Harvey are available to each of your users. Please work with your Success team to understand the different features available and assign them to the correct users.

User Provisioning and De-Provisioning

Once SSO is configured, you can provision and de-provision user access to Harvey simply by adding or removing them from the relevant Security Group(s).

When de-provisioning a user, you will also need to manually delete the user from your Harvey workspace in order to remove their seat from your Harvey license:

1. Navigate to Command Center → Users & permissions → Users.
2. Find and select the user you’d like to remove.
3. Select the red Delete user button.

Authentication with SAML

In most cases, users authenticate through their firm’s Identity Provider (e.g. Microsoft Entra, Okta, Google Workspace, etc.), which connects via SAML to our Auth0 tenant.

The identity provider’s password policy and MFA requirements apply, as well as any other configured security policies apply. Many identity providers support the enforcement of context-aware access, meaning that you can restrict access to Harvey to your corporate network, corporate-managed devices, etc. It is the customer’s responsibility to manage the identity provider.

Application Level Controls

You can restrict access to Harvey so that only users added directly by an admin can log in. This method requires manual provisioning by Admins but allows for granular access control without needing an access group setup through your identity provider. This is an optional setting and is not enabled by default. Please discuss this solution with your Success team if you'd like to implement it.

Using SSO and Single-Use Passwords

By default, once your workspace uses SSO for authentication, we can no longer support sending single-use passwords over email. Due to this restriction, we highly recommend scheduling a short call with our Solutions team to test your newly configured SSO connection end-to-end. This will help identify and resolve any issues quickly, mitigating potential access loss for your users. To set up a call with the Solutions team, please contact your Success team.