Security
Most security in Harmony is set by your organization: who is invited, which role they hold, and which workstreams and connectors they can use. Your own account still needs care, especially if you sign in with an email and password. The Security tab gives you those controls.
Step-by-step: turn on two-factor authentication
- Open the menu under your avatar and choose Profile.
- Choose the Security tab, then Two-factor authentication.
- Under Authenticator app, choose Set up authenticator app.
- Scan the QR code with an authenticator app such as Google Authenticator or 1Password. If you can't scan it, use the setup key under Can't scan? Enter this setup key.
- Enter the Verification code from the app to finish.
From then on, Harmony asks for a code from your authenticator app when you sign in with email and password.
The Security tab
| Section | What you can do |
|---|---|
| Two-factor authentication | Require a code from an authenticator app when you sign in with email and password |
| Password | Change your password. Shown only if you sign in with a password. |
| Active sessions | See each device where you are signed in and when it was last active. The device you are using is marked This device. |
Organization security elsewhere
| Need | Where |
|---|---|
| Who can access Harmony | Inviting people and organization roles |
| Who can approve writes | Approval cards and each workstream's approval policy. See Approvals. |
| Who can change the plan and pay | Global Admins, on Billing |
| Programmatic access | API keys on the Developers page, for admins. See API keys. |
| Connector sign-in | Each connector's own sign-in, under Connectors |
| Single sign-on (SAML and SCIM) | Part of the Enterprise plan. Talk to your account team. |
Example scenario
An analyst shares a laptop in a board-prep room. Before she leaves for the day she opens Profile → Security → Active sessions and sees the shared laptop listed beside her own. She signs out on the shared laptop, then turns on two-factor authentication so a saved password alone can't open her account again.
What you'll see
What you'll see: The Security tab on the Profile page, with the sections Two-factor authentication, Password (for password accounts) and Active sessions.
FAQs
Do I need two-factor authentication if I sign in with Google or Microsoft? The two-factor setting in Harmony applies to email and password sign-in. If you sign in with Google or Microsoft, use the two-step verification of that account.
Why don't I see a Password section? It shows only for accounts that sign in with a password.
Where are API keys? On the Developers page, which admins can open. See API keys.
Can we use single sign-on? Single sign-on with SAML and SCIM is part of the Enterprise plan.
Where do I rotate connector secrets? In Connectors, on the connection itself. See Connector settings.
How is this different from governance? Governance decides what agents may release and change. Security settings protect how you sign in to Harmony.