:Harvey:Support

Troubleshooting SSO Connection Issues

Identify and Resolve Common SAML SSO Errors

For Admins

Last updated: Sep 25, 2026

Overview

This guide will help you troubleshoot the most common problems encountered when setting up or using SAML-based Single Sign-On (SSO) with Harvey.

Please follow the outlined steps to resolve your issue. If you continue to experience difficulties, contact your IT team or Harvey Support for further assistance.

Common Issues and Solutions

User Logging Into Incorrect Version of the App

Harvey has three versions of the application: one for US data processing, one for EU data processing, and one for AU data processing. Using the incorrect version may result in login issues.

Below is a common error message users may see when attempting to log into Harvey through the wrong URL:

Common access errors.

How to Resolve the Issue

Confirm users are logging in with the correct version of Harvey based on your workspace’s data processing location:

If you’re unsure which version applies to your workspace, please contact your Harvey workspace admin for clarification.

IDP-Initiated Connections Not Supported

Users may encounter login failures when attempting to log in through an Identity Provider (IDP)-initiated connection.

An IDP-initiated connection occurs when users start the login process from your identity provider, such as your company’s login portal, instead of directly from the Harvey application.

Example: If a user logs in through your company’s portal and then tries to access Harvey, the login process might fail. This is because Harvey requires the login process to start directly from its own login page to trigger the SAML authentication correctly.

Below is a common error message users may see when attempting an IDP-initiated connection:

Common errors.

How to Resolve the Issue

  • Ensure these attributes are set in your SSO configuration for Harvey (typically via Entra or Okta):
    • Name ID: Primary Email / Preferred Email
    • Email: Primary Email / Preferred Email
  • Ensure users are logging in from the correct Harvey application URL:

Firewalls, VPNs, or Security Appliances Blocking URLs

Some firewall or VPN configurations may block essential URLs, causing the SAML SSO connection to fail or certain functionality to break.

For the full list of URLs and domains to allowlist, and for guidance on SSL inspection and secure web gateways such as Zscaler, see **Configure Network and Security Appliances for Harvey.**

User Not Assigned to the Correct AD Group

Users may experience access issues if they are not part of the Active Directory (AD) group configured for the Harvey application.

Below is a common error message users may see when not added to the AD group:

Common errors.

How to Resolve the Issue

Verify with your IT administrator that the user has been assigned to the appropriate AD group for Harvey access.

Email Address Mismatch in Identity Provider

The email address associated with the user’s profile in the Identity Provider (IDP) may differ from the one being used during login. This often occurs if the user has transitioned from a different firm or company.

Example: A user may have initially used the email susan@acme.com and later switched to susan@firm.com, but the IDP may still recognize the original email (susan@acme.com).

How to Resolve the Issue

  • An IT administrator should verify the user’s email address in the IDP, ensuring the domain matches the one the user is entering during login. If there is a mismatch, confirm that the user is using the correct email domain.
    • If necessary, Harvey Support can assist in adding additional email domains to your workspace.

Still Having Trouble?

If the previous troubleshooting steps do not resolve your issue, please reach out to Harvey Support with the following information to assist in diagnosing the problem:

  • Any error messages or screenshots from your SSO login attempt.
  • Logs from your Identity Provider (IDP), if available.
  • Configuration details for your SAML setup, including the Assertion Consumer Service (ACS) URL and Entity ID.

Providing this information will help our team resolve your issue more quickly.

Was this article helpful?

Manage Vault Data Retention Settings

Learn how to manage vault data retention settings in Vault, including triggers and deletion timelines.

Enable the Harvey for Outlook Add-In for Your Workspace

Learn how to enable Harvey for Outlook for your organization, from centralized deployment to on-premise sideloading and managing user permissions.

SCIM (System for Cross-domain Identity Management) Integration

Set up SCIM in Harvey to automate user provisioning, deprovisioning, and group-based access management through your organization’s identity provider.

SCIM Guest Provisioning

Use SCIM to create Guest accounts in Harvey from groups in your identity provider.

Managing Agents

Learn how workspace admins can assign agent permissions, manage all workspace agents, and review requests to share agents.