Release Notes
SCIM Guest Provisioning
Create and manage Guest accounts for collaborators through SCIM, using groups in Okta or Microsoft Entra ID.
What's New
Harvey's SCIM integration now supports the Guest role. When a workspace admin maps an Okta or Microsoft Entra ID group to Guest, Harvey creates each group member as a Guest account. Guests sign in through your organization's SSO and don't use a paid seat. With Guest Provisioning, admins can:
- Create Guest accounts automatically from a dedicated identity provider group
- Deactivate Guest accounts by removing users from the group
- Upgrade a Guest to a licensed user by adding them to a group mapped to a licensed role, with a preview of affected Guests before the mapping is saved
- Connect existing Guests to SCIM by email match while keeping their current Space access
- Review mapping conflicts in the Command Center
- Track Guest creation, upgrades, workspace moves, and Space-access changes in audit logs
Why It Matters
Guests previously joined Harvey through Space invitations, outside your organization's directory. Guest Provisioning brings Guests under the same SCIM lifecycle as licensed users. IT admins decide who is eligible through group membership before a Space owner sends an invitation, each account follows your SSO policy from the start, and leaving the group deactivates the account. For in-house legal teams with SSO-only policies, outside counsel and co-counsel can join Spaces without an exception to that policy.
How to Use
Refer to SCIM Guest Provisioning for setup steps, role-change guidance, and how to resolve warnings in the Command Center.
FAQs
Q: Who is SCIM Guest Provisioning available for?
It is available for enterprise and in-house workspaces with SSO and SCIM already configured. It is not available for law-firm workspaces.
Q: What happens when a user is removed from the Guest group in the identity provider?
Their Guest account is deactivated in Harvey automatically. Audit Logs records both the creation and deactivation events for a complete access lifecycle trail.
Q: Will Harvey downgrade a licensed user to Guest automatically?
No. A licensed role always wins over Guest. If a licensed user appears in a Guest group, they show up under Needs attention so an admin can review and decide — Harvey never downgrades them automatically.
Q: How do you get started if SCIM is already configured?
Create a dedicated Guest group in Okta or Entra ID, push it to Harvey, and map it to the Guest role in Command Center. Guests appear in Provisioned users after the next sync. Space owners then invite them as usual.