> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-platform/authentication/single-sign-on-for-harness-mcp.md).

# Single Sign-On (SSO) for Harness MCP

Harness MCP supports authentication through your existing Single Sign-On (SSO) provider. To enable SSO for MCP, add an Assertion Consumer Service (ACS) URL (for SAML) or redirect URI (for OIDC) to your Identity Provider (IdP).

An ACS URL or redirect URI specifies where your IdP sends authentication responses after a user signs in. Harness MCP requires its own ACS URL or redirect URI because it authenticates through a separate endpoint from the standard Harness platform.

Adding the MCP-specific URL does not affect your existing Harness platform login. You can continue to access both Harness and Harness MCP through the same SSO provider.

***

### What you will learn in this topic <a href="#what-you-will-learn-in-this-topic" id="what-you-will-learn-in-this-topic"></a>

By the end of this topic, you will be able to:

* [Retrieve the MCP-specific ACS URL](#configure-saml-for-harness-mcp) or [redirect URI from Harness](#configure-oidc-for-harness-mcp).
* Add the MCP URL to your [Identity Provider](#configure-saml-for-harness-mcp).
* [Configure SAML](#configure-saml-for-harness-mcp) or [OIDC authentication](#configure-oidc-for-harness-mcp) for Harness MCP.

***

### Before you begin <a href="#before-you-begin" id="before-you-begin"></a>

Before you configure SSO for Harness MCP, ensure you have the following:

* **Account Admin** or **Authentication Settings** permissions in Harness.
* Identity Provider configured for SAML or OIDC authentication with Harness. Go to [Single Sign-On (SSO) with SAML](/harness-platform/use-harness-platform/authentication/single-sign-on-saml.md) to set this up if needed.
* Administrative access to your Identity Provider.

***

### Configure SAML for Harness MCP <a href="#configure-saml-for-harness-mcp" id="configure-saml-for-harness-mcp"></a>

Before you update your Identity Provider, retrieve the MCP ACS URL from your Harness SAML configuration.

{% tabs %}
{% tab title="Manual" %}

1. Sign in to Harness.
2. Go to **Account Settings** > **Security and Governance** > **Authentication**.
3. Locate your SAML provider.
4. Select **⋮** > **Edit**.
5. Copy the value from **Additional Reply URL for MCP (Optional)**.
   {% endtab %}

{% tab title="Interactive" %}
{% embed url="<https://app.tango.us/app/embed/95bbba7a-0744-4f0a-b47f-d483464aab72>" %}
{% endtab %}
{% endtabs %}

Based on your Identity Provider, go to [Microsoft Entra ID](#microsoft-entra-id-azure-ad), [Okta](#okta), or [Ping Identity](#ping-identity-pingone) and add the MCP ACS URL.

#### Microsoft Entra ID (Azure AD) <a href="#microsoft-entra-id-azure-ad" id="microsoft-entra-id-azure-ad"></a>

{% tabs %}
{% tab title="Manual" %}

1. Sign in to the Azure portal.
2. Go to **Microsoft Entra ID** > **Manage** > **Enterprise Applications**.
3. Select your Harness application.
4. Select **Manage** > **Single sign-on**.
5. In **Basic SAML Configuration**, click **Edit**.
6. Under **Reply URL (Assertion Consumer Service URL)**, click **Add reply URL**.
7. Enter the MCP ACS URL copied from Harness.
8. Click **Save**.
   {% endtab %}

{% tab title="Interactive" %}
{% embed url="<https://app.tango.us/app/embed/0077839f-e0dd-4d99-b605-cffe8eecdb85>" %}
{% endtab %}
{% endtabs %}

**Troubleshooting**

If you receive the following error:

```bash
AADSTS50011: The reply URL specified in the request does not match the reply URLs configured for the application.
```

Verify that the MCP ACS URL has been added and exactly matches the value displayed in Harness.

***

#### Okta <a href="#okta" id="okta"></a>

Okta handles multiple ACS URLs differently from other Identity Providers. Instead of a list of Reply URLs, Okta requires you to enable **Requestable SSO URLs** and add each additional endpoint with an index value.

{% tabs %}
{% tab title="Manual" %}

1. Sign in to the **Okta Admin Console**.
2. Go to **Applications** > **Applications**.
3. Select your Harness application.
4. On the **General** tab, select **Edit** in the **SAML Settings** section.
5. Select **Next**.
6. Leave the existing **Single sign-on URL** unchanged.
7. Enable **Allow this app to request other SSO URLs**.
8. Under **Other Requestable SSO URLs**, select **Add Another**.
9. Select **Next**, then click **Finish**.

After configuration, your Okta application will have three URLs:

| URL                                        | Source                        | Purpose                              |
| ------------------------------------------ | ----------------------------- | ------------------------------------ |
| **SAML Endpoint URL** (index 0)            | Copy from Harness SAML config | Harness platform login via HarnessID |
| **Additional Reply URL for MCP** (index 1) | Copy from Harness SAML config | Harness MCP login                    |

Both URLs are required. Removing the SAML Endpoint URL disables Harness platform login. Removing the MCP URL disables MCP login.
{% endtab %}

{% tab title="Interactive" %}
{% embed url="<https://app.tango.us/app/embed/8dfc15f0-f5dd-49db-941b-95071e17fdf6>" %}
{% endtab %}
{% endtabs %}

***

#### Ping Identity (PingOne) <a href="#ping-identity-pingone" id="ping-identity-pingone"></a>

PingOne supports multiple ACS URLs for a single SAML application and automatically selects the appropriate URL during authentication.

1. Sign in to the **PingOne Admin Console**.
2. Go to **Applications** > **Applications**.
3. Select your Harness application.
4. Open the **Configuration** tab.
5. Select **Edit**.
6. Under **ACS URLs**, select **Add**.
7. Enter the MCP ACS URL copied from Harness.
8. Click **Save**.

   <figure><img src="/files/Li5AShgTn7EccL7tljYz" alt="PingOne ACS URL configuration"><figcaption><p>Click to view full size image</p></figcaption></figure>

Keep your existing ACS URL and add the MCP ACS URL as an additional entry. Both URLs are required to support authentication for the Harness platform and Harness MCP.

Do not modify any other SAML settings, including certificates, Entity IDs, signing configuration, or NameID settings.

***

### Configure OIDC for Harness MCP <a href="#configure-oidc-for-harness-mcp" id="configure-oidc-for-harness-mcp"></a>

This section explains how to add the MCP redirect URI to your Identity Provider for OIDC authentication.

If your Harness account uses OpenID Connect (OIDC), add the MCP redirect URI to your Identity Provider.

{% tabs %}
{% tab title="Manual" %}

1. Sign in to Harness.
2. Go to **Account Settings** > **Authentication**.
3. Locate your OIDC provider under **Login via OIDC**.
4. Select **⋮** > **Edit**.
5. Copy the value from **Additional Reply URL for MCP (Optional)**.
   {% endtab %}

{% tab title="Interactive" %}
{% embed url="<https://app.tango.us/app/embed/ca437b6d-42d1-44ff-bf9a-1d583a518a34>" %}
{% endtab %}
{% endtabs %}

#### Microsoft Entra ID (Azure AD) <a href="#microsoft-entra-id-azure-ad" id="microsoft-entra-id-azure-ad"></a>

{% tabs %}
{% tab title="Manual" %}

1. Sign in to the Azure portal.
2. Go to **Microsoft Entra ID** > **App registrations**.
3. Select your Harness application.
4. Go to **Authentication** in the left navigation.
5. Under **Redirect URIs**, click **Add URI**.
6. Enter the MCP redirect URL and click **Save**.
   {% endtab %}

{% tab title="Interactive" %}
{% embed url="<https://app.tango.us/app/embed/b73a9125-82c7-4622-8eff-353fc5dbf9b1>" %}
{% endtab %}
{% endtabs %}

***

#### Okta <a href="#okta" id="okta"></a>

1. Sign in to the **Okta Admin Console**.
2. Go to **Applications** > **Applications**.
3. Select your Harness application.
4. On the **General** tab, select **Edit** in the **Login** section.
5. Under **Sign-in redirect URIs**, select **Add URI**.
6. Enter the MCP redirect URL and click **Save**.

***

#### Ping Identity (PingOne) <a href="#ping-identity-pingone" id="ping-identity-pingone"></a>

1. Sign in to the **PingOne Admin Console**.
2. Go to **Applications** > **Applications**.
3. Select your Harness application.
4. Open the **Configuration** tab.
5. Select **Edit**.
6. Under **Redirect URIs**, select **+ Add**.
7. Enter the MCP redirect URL and click **Save**.

Keep your existing redirect URI and add the MCP redirect URI as an additional entry. Both redirect URIs are required to support authentication for the Harness platform and Harness MCP.

***

### Verify the configuration <a href="#verify-the-configuration" id="verify-the-configuration"></a>

After you configure SSO for Harness MCP, verify that users can authenticate successfully by signing in to Harness MCP using your Identity Provider.

***

### Frequently asked questions <a href="#frequently-asked-questions" id="frequently-asked-questions"></a>

<details>

<summary>Will adding the MCP URL affect my existing Harness login?</summary>

No. Adding the MCP ACS URL or redirect URI does not affect your existing SSO configuration. Users can continue to access both Harness and Harness MCP through the same Identity Provider.

</details>

<details>

<summary>Do I need to update certificates, Entity IDs, or other SSO settings?</summary>

No. You only need to add the MCP ACS URL (SAML) or redirect URI (OIDC). No other changes are required.

</details>

<details>

<summary>What happens if I do not add the MCP URL?</summary>

Users will not be able to sign in to Harness MCP through SSO. Standard Harness platform login will continue to work.

</details>

<details>

<summary>Can my Identity Provider support multiple ACS URLs or redirect URIs?</summary>

Most enterprise Identity Providers, including Microsoft Entra ID, Okta, and PingOne, support multiple ACS URLs or redirect URIs for a single application.

</details>

<details>

<summary>Do I need to make this change if I do not use Harness MCP?</summary>

No. This update is only required if you use Harness MCP with SSO authentication. If you only use the standard Harness platform login, no action is required.

</details>

<details>

<summary>Do I need to create a separate application in my Identity Provider for Harness MCP?</summary>

No. Add the MCP ACS URL or redirect URI to your existing Harness application. You do not need to create a separate application for Harness MCP.

</details>

***

### Next steps <a href="#next-steps" id="next-steps"></a>

* [Single Sign-On (SSO) with SAML](/harness-platform/use-harness-platform/authentication/single-sign-on-saml.md): Configure SAML-based SSO with your Identity Provider.
* [RBAC in Harness](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md): Understand role-based access control and permissions.
* [Manage service accounts](/harness-platform/use-harness-platform/platform-access-control/add-and-manage-service-account.md): Configure programmatic access to Harness.