SCIM Guest Provisioning

Overview

SCIM Guest Provisioning lets you manage guest collaborators from the same directory you use for licensed Harvey users. When you map an identity provider group to the Guest role, Harvey creates each member as a Guest account. Guests sign in through your organization's SSO, do not use a paid seat, and see only the Spaces they are invited to.

With Guest Provisioning, admins can:

• Create Guest accounts automatically from an Okta or Microsoft Entra ID group
• Keep Guest access aligned with your directory: removing a user from the group deactivates the Guest
• Upgrade a Guest to a licensed user automatically by adding them to a group mapped to a licensed role
• See every Guest, upgrade, downgrade, and warning in Provisioned users and Audit Logs

Before You Start

Before you can map groups to the Guest role, make sure you meet the following prerequisites:

• SSO (SAML) and SCIM are configured for your workspace. Refer to SCIM Integration for more information.
• Spaces are enabled for your workspace.
• You have admin access to Command Center → Users & permissions → Identity & access.

How Guest Provisioning Works

Workspace and Role Assignment

Two settings decide what happens to each SCIM group:

• Territory mapping decides which workspace the group's members join. Groups without a territory mapping join the organization workspace.
• Role mapping decides the role members receive in that workspace. A role mapping applies only to users who joined that workspace.

If any of a user's groups maps to a licensed role in their workspace, Harvey upgrades the Guest to a licensed user, and the user starts using a paid seat. However, the reverse never happens automatically: Harvey doesn't change an existing licensed user to Guest. To make that change, see Change a Licensed User to Guest below.

Workspace Membership and Access

A Guest can belong to only one workspace. If a mapping moves a Guest to another workspace, they lose access to Spaces from the previous workspace, and Space owners must invite them again in the new workspace. Deactivating a Guest removes their access, and reactivating them in the same workspace restores their previous Space access.

Sign-In and MFA

Guests sign in through your organization's SAML SSO, so your identity provider's MFA policy applies to them.

Set Up Guest Provisioning

Setting up Guest Provisioning has four stages: preparing a Guest group, mapping it to the Guest role in Harvey, syncing, and verification.

Step One: Prepare a Guest Group in Your Identity Provider

Use a dedicated group that contains only Guest users. Don't mix Guest and licensed users in one group.

Okta

1. Create or select the group that will contain Harvey Guests.
2. Assign the Harvey application to the group so its members can sign in.
3. In the Harvey application, go to Push Groups and add the group.
4. Confirm the group and its members appear in Harvey before creating the role mapping.

Microsoft Entra ID

1. Create or select a security group for Harvey Guests.
2. Assign the group to the Harvey enterprise application.
3. In Provisioning, confirm that user and group provisioning are enabled.
4. Use Provision on demand for a test user, or wait for the next provisioning cycle.

Step Two: Map the Group to the Guest Role in Harvey

To map the group to the Guest role:

1. Go to Command Center → Users & permissions → Identity & access, and go to the Role mappings tab.
2. In the Workspace selector, choose the workspace the group's territory mapping points to. If the group has no territory mapping, choose the organization workspace.
3. Find the SCIM group you prepared.
4. In the Harvey role column, select Guest.
5. Save the mapping.

Mappings are evaluated top to bottom and the first match wins. Place more privileged or more specific groups above Guest groups. A new user who matches no mapping receives the workspace's default role, which is a licensed role.

Step Three: Sync Users From Your Identity Provider

Start a provisioning sync or wait for the next scheduled one.

• Okta: Assign the user to the Harvey application and to the Guest group. Use Push Now on the group to sync immediately.
• Entra ID: Use Provision on demand for a test user, or wait for the normal cycle.

Okta and Entra may create the user before sending their groups. The user can briefly appear as licensed. If their first matching groups are Guest-only, Harvey changes the new user to Guest once. This one-time correction applies to new users only, never to existing licensed users.

Step Four: Verify Guest Accounts

After the sync, confirm the following:

• The user appears in the Provisioned users tab with the Guest role and no paid seat.
• The user can sign in through SSO and sees an empty Spaces page.
• A Space owner invites the user and the Space appears for them.
• Audit Logs shows the provisioning and any role events.

Changing a User's Role

How a role change works depends on its direction:

Upgrading a Guest to a Licensed Role

Add the user to a group mapped to a licensed role in their workspace and sync. Harvey upgrades the user automatically. Before you save a mapping that will upgrade existing Guests, Harvey shows which Guests are affected. Every upgraded Guest uses a paid seat.

Change a Licensed User to Guest

Harvey doesn't downgrade an existing licensed user automatically. The user stays licensed and appears under Needs attention with a Role change skipped warning. This prevents accidental loss of workspace and Space access.

To change a licensed user to Guest:

1. In Okta or Entra, remove the user from every group mapped to a licensed Harvey role.
2. Add the user to a Guest-mapped group and run a sync.
3. In Harvey, open the Provisioned users tab and select Needs attention. On the user’s row, select View details, and confirm under Group membership that no licensed mapping remains.
4. Contact Harvey Support to change the user's role to Guest.
5. Run one more sync and confirm the user stays a Guest and the warning clears.

Resolving “Needs Attention” Warnings

Use the Needs attention filter to find users whose Okta or Entra mappings don't match their current Harvey role. Harvey checks for warnings after every SCIM sync and whenever an admin creates, changes, or deletes a role mapping. It checks every workspace the user joined, not only the workspace you're viewing. Select View details on a warning to see which groups and mappings caused it. Each warning clears on its own once you fix the cause.

Role Change Skipped

Harvey skips a role change when a licensed user now matches only Guest mappings, or when the licensed role a Guest matches isn't available in the user's environment. The user keeps their current role.

• If the group assignment is wrong, fix it in Okta or Entra and sync again.
• If the user should become a Guest, follow the steps in Change a Licensed User to Guest above.

Guest Mapping Ignored

This warning appears when a user matches both a Guest mapping and a licensed role mapping. The licensed role wins, so the user stays licensed. If the user shouldn't be licensed, remove the wrong group assignment in your identity provider or change the mapping.

Migrate an Existing Guest to SCIM

You can connect an existing Harvey Guest to SCIM without removing their Space access. Harvey matches by email.

To migrate an existing Guest:

1. In Okta or Entra, use an account with the exact same email as the existing Guest.
2. Assign the user to the Harvey application.
3. Add the user to a group mapped to Guest in their Harvey workspace.
4. Run a sync, then ask the user to sign in through SSO.
5. In Harvey, confirm the user is a Guest, the SCIM group appears, and their Space access remains.

Audit Logs

Audit Logs record Guest creation, upgrades, one-time role corrections, removed permissions, warnings, workspace moves, and Space-access changes. Go to Command Center → Reporting → Audit logs to view them, or use the Audit Log API.

Tips for Success

• Use a separate group for Guests, and never mix Guest and licensed users in one group.
• Test with one or two users before adding more.
• Review the upgrade confirmation carefully. Every upgraded Guest uses a paid seat.
• After a large group change, give Harvey time to finish, then review Provisioned users and Audit Logs.
• Re-invite a moved Guest to any Spaces they still need.

Notes & Limitations

• Guest can't be the default SCIM role. You must map a specific group to Guest.
• SCIM doesn't add Guests to Harvey user groups or give them direct permissions.
• Guest provisioning isn't available for law-firm workspaces.

FAQs