Concur Provisioning Integration Skip to main content
https://support.okta.com/help/oktaarticledetailpage?childcateg=&id=ka02a000000xa90sac&source=documentation&refurl=http%3a%2f%2fsupport.okta.com%2fhelp%2fdocumentation%2fknowledge_article%2fconcur-provisioning-integration
How satisfied are you with the Okta Help Center?
Thank you for your feedback!
How satisfied are you with the Okta Help Center?
1
2
3
4
5
Very Dissatisfied
Very satisfied
Enter content less than 200 characters.
Average Rating:
Concur Provisioning Integration
Published: Nov 4, 2016   -   Updated: Nov 21, 2016

Removal of Concur Provisioning

Do not setup Concur Provisioning: We have removed Concur provisioning from the OAN. Due to persistent technical issues that prevent the Concur Provisioning integration from working properly, we ask that you refrain from setting up and rolling out the integration in your org. This applies to both the Early Access (EA) and Generally Available (GA) versions. The Concur SAML integration continues to function properly and is unaffected.

In the case where provisioning integration is already setup, live, and working successfully, you can continue to use it as-is and resolve questions through standard support channels. If your provisioning integration is working successfully, and you need to refer to configuration information, please refer to the Provisioning Guide later in this document.

We are actively working with Concur to resolve this situation and will update this article when more information is available.

Frequently Asked Questions

Question: What are the issues?

Answer: There isn't just one issue, but several issues. They fall into two buckets:

  • The integration may or may not work based on how your Concur tenant is setup, and there is no checklist available to know.

  • The integration is limited in the user profile attributes it can provision, so even if it works, it may not be sufficient for your needs.

Question: Is there a timeline for resolution?

Answer: Unfortunately, we cannot provide a timeline for when these issues will be fixed and when the integration will be available again. It is definitely not a quick fix (in the next few weeks) and may take many months. We will update customers when we have a clearer idea.

Question: Are there workarounds?

Answer: We’re not Concur experts, but our understanding is that the standard solution for bulk creating users into Concur is via flat-file upload.

If you have any additional questions or concerns please open a case.
 



Configuring Provisioning for Concur

Note: We are providing this Provisioning Guide as reference material for our customers whose Provisioning integration is already set up and working.

 

Notes

  • In order to enable UD support for Concur, contact the Okta support team and request the following Early Access feature flag be enabled for your Okta org:

    PROV_CONCUR_CLOUD_DIRECTORY_ENABLE

    You will have to create a new instance of the Concur application.

  • To reconfigure any of the General Settings or Sign-On Options, uncheck the Enable provisioning features box, and use the Previous and Next buttons to navigate through the configuration screens.

  • Conditions section below for more details.

    Additionally, your tenant may have Expense features that require employee data this is not capable of being populated by the current Concur User API, and therefore is not supported by the Okta User Provisioning application. If this is the case, you will be required to populate the additional data using Concur specified import files.

    The fields that can be populated by the User Provisioning app are specified: here.

This guide contains the following topics:


Conditions

A base user record will not be fully provisioned in the following cases:

  • Your Concur tenant uses the Reimbursement Method field. See below for details:

    Standard Edition - customers who have more than one reimbursement method (Expense Pay, Payroll, Co. Check) can provision users but must import the reimbursement values via a file. Possible values are:

    • If the customer uses ADP Payroll, then the ADP payroll fields must be populated manually or via an import file.

    • If Expense Pay or AP Check is the single reimbursement method used by customer, then Okta does not need to populate this data (a blank value will populate the single, default method).

    Standard-to-Professional Upgrade Edition - customers using the corresponding Payment Manager batches (that are populated by the values in this field) can provision users, but must import these values via a file. Consult with Concur for possible solutions. For example, if you choose to use one Accounting file, you would not need the individual batches that these field values populate.

    Professional Edition – this field does not apply to Professional Edition at this time.

  • If your Concur tenant uses Cash Advance fields, the Cash Advance Account Code and Cash Advance Approver need to be manually entered or imported via a file, as these fields are not supported in the Concur API.

  • If your Concur tenant has more than one Travel Policy, then this field needs to be set manually or via a file import. Generally, for Standard travel there is only one travel policy. In this case, a blank value via Okta will populate the default value.

  • If your Concur tenant uses Multiple Employee Forms, provisioning a base record via Okta is not possible.


Features

The following provisioning features are supported:

  • Schema Discovery

  • Create Users

    Note that Okta only creates a user’s base profile in Concur.

  • Update User Attributes

  • Deactivate Users

  • Sync Password

Note: Import of Users is currently supported only in CSV format.


Before You Begin

It is important that you determine what Edition of Concur you are using before you start configuring provisioning. Here we describe our support for each edition, and how to determine what edition you are using.

Note that there are few special attributes in Base user profile, whose values vary depending on your Concur Edition, these are described in the Attributes in Base Profile section.

Support of Concur Editions

EDITIONSUPPORT
SMALL BUSINESS

The Okta-Concur integration does not support the Concur Small Business Edition.

STANDARD EDITION

Okta supports provisioning functionality for Concur Standard Edition. Note that Okta only creates a base user record in Concur. Standard Edition clients that are not using extended features can use the User Provisioning app to add records without having to import additional data. However, even some Standard Edition features require additional file imports or manually added information in Concur by the client.

PROFESSIONAL

Okta supports provisioning functionality for Concur Professional Edition. Note that Okta only creates a base user record in Concur; you may require file imports for attributes (such as employee banking data) not supported by the Concur API. Many Expense features require employee data that User Provisioning applications cannot populate since the current User API does not currently include those features.

PREMIUM

Okta supports provisioning functionality for Concur Premium Edition. Note that Okta only creates a base user record in Concur; you may require file imports for attributes (such as employee banking data) not supported by the Concur API. Many Expense features require employee data that User Provisioning applications cannot populate since the current User API does not currently include those features.

Determining Edition Type

A client can determine the Concur Edition type by having their administrator login to their Concur site. If they see a Setup menu with a sub option for Expense within the Administration menu (as shown below), then this is a Standard Edition site. If the client administrator does not see the Expense menu within the Setup menu, then they have a Concur Professional Edition site:

User-added image

 


Requirements

Before you begin setting up the application, go through the Attributes in Base Profile section as you will need to obtain allowed values from the Concur Implementation team, which are associated with special attributes in Concur, such as Ledger Key.

  • Letter of Authorization (LOA): Concur requires a letter of authorization before you can start using Okta for provisioning. If you are implementing Provisioning, or for Provisioning plus Single Sign On (SSO):

    Download the following document, sign it, and scan the signed copy into a pdf file.

    Concur Letter of Authorization - Provisioning or Provisioning plus SSO

    Click the link below to generate a Provisioning Enablement Request email to Concur. Fill in the fields and attach the LOA.

    Provisioning Enablement Email

    Note: If the above link does not generate an email message on your system, open this Email Text and copy and paste the information into a new email message.

  • Universal Directory for Concur is an Early Access feature. If you would like to turn on UD for Concur, contact Okta Support to enable the following feature flag: PROV_CONCUR_CLOUD_DIRECTORY_ENABLE.

  • You must have Concur Expense service enabled. That is, Concur Travel only is not supported.

  • Before setting up provisioning, ensure that Web Services subscription is enabled for your Concur tenant. Contact Concur to get the Web Services Administrator Profile set up; this is a one-time required set up. Once the subscription is enabled, you will be able to use the provisioning application in your Concur Production tenant. The Okta application is listed globally in Concur Production environment, and no further steps need to be taken to enable the Okta application in you Concur Web Services App center.

    Enable the Okta Connect app in the Concur App center by following these steps:

    1. Login to Concur (commonly, https://www.concursolutions.com) with your Concur Admin account.

    2. Navigate to Administration > Company > Web Services.

      User-added image

       

    3. Navigate to Enable Partner Application, then find Okta Connect in the list and make sure it is Enabled.

      Note: Contact Concur to enable the Okta application for your Concur tenant if the application does not appear in the Web Services section.

      User-added image

       


Configuration Steps

Important: Before you start configuring provisioning, make sure you have determined what Concur Edition you have, and have also met all the requirements we provided.

  1. Configure your Provisioning settings for Concur as follows:

    • Check the Enable provisioning features box.

    • In the API Authentication section, click Authenticate with Concur:

      User-added image

       

    • A new window will appear displaying the Concur login page. Enter your Concur Admin credentials and log in.

    • A message will appear with option to allow Okta to connect to your tenant. Choose Allow for provisioning to work.

      User-added image

       

    • Now your app is authenticated, scroll down the Provisioning page and select those provisioning features you want to enable:

      User-added image

       

    • Click Next.

  2. You can now assign people to the app (if needed) and finish the application setup.

  3. The required attributes in Concur depend on your Concur tenant settings. Follow the steps bellow to add all required user attributes to the user profile:

    • In Okta, from the Admin dashboard, select Directory > Profile Editor.

    • Select the APPS section in the left navigation bar, then find your app in the list.

      User-added image

       

    • Select Add Attribute, then Refresh Attribute List to see the latest list of Concur attributes.

      Remember to add all attributes associated to linked-lists in your Concur tenant. For example, if you are using Concur Standard Edition and have policy groups enabled, you will have to add Expense Policy Group attribute (OrgUnit1) though it will not show as a required attribute. This is because Expense Policy Group (OrgUnit1) attribute is part of a linked-list with Employee Administration Country (custom21).

      User-added image

       

    • Required Concur attributes are pre-selected for you on this page. Additionally, you can add more attributes of your choice.

      Note: If you are using Standard Edition with Groups enabled, be sure to add the Expense Policy Group (orgUnit1) attribute.*

    • Save the profile.

    • Setup is now complete.


Attributes in Base Profile

There are few special attributes in Base user profile, whose values vary depending on your Concur Edition. Pay special attention to these attributes:

AttributeDescription
Locale Name

Select value from drop down menu. Be sure to select a value that is applicable to your Concur tenant. If a locale value is not enabled in your Concur tenant, this field is left blank on the user's Concur profile, or you may experience errors.

 

Country Code

Select value from drop down menu. Be sure to select a value that is applicable to your Concur tenant. If a locale value is not enabled in your Concur tenant, this field is left blank on the user's Concur profile, or you may experience errors.

Currency Key

Select value from drop down menu. Be sure to select a value that is applicable to your Concur tenant. If a locale value is not enabled in your Concur tenant, this field is left blank on the user's Concur profile, or you may experience errors.

Ledger Key
  • For Concur Standard edition, the value default to be passed is DEFAULT. Although this attribute does not appear in your Concur UI, but is required for provisioning.

  • For Concur Professional/Premium edition, the Ledger code(s) must be obtained from Concur since the Code is not available in the API and it is not exposed to the client administrator in the Concur UI (Accounting Administration menu). You will have to maintain the list of Ledger codes, and plug them in Okta when assigning new users. Contact Concur at pdspe@concur.com to obtain a list of valid Ledger Code(s) relevant to your Concur tenant.

For these attributes Concur has a pre-defined list of allowed values per tenant, and you will experience errors if you use a wrong value. So make sure you know what to enter here.

 

Schema Discovery

This application supports Schema Discovery feature, which allows to extend the list of attributes to sync with Concur.

User-added image
 

Concur may have dependency between certain attributes, for example in Standard Edition with Groups support, Expense Policy Group values depend on Employee Administration Country value.

User-added image

 

These are identified as linked-lists in your Concur tenant. Another example of linked lists are Division, Department, and Cost Center.

If you are adding one of dependent attributes, make sure you add all attributes it depends on. In other case you won't be able to set a value for it without providing values for it's parent attributes.


Troubleshooting Tips

Most common errors are:

  • If you see an error that states user e-mail is already taken, contact Concur support and ask to make it available for your tenant.

    User-added image

     

  • Concur's required field was not added to the User profile or had an empty value:

    User-added image

    To fix this, make sure you added the required field to your Application User profile and provide it with a valid value.

  • Set a wrong value to a field, for which valid values are strictly defined:

    User-added image

    To fix this, provide a field with a valid value. Check Schema Discovery section on how to get valid values.


Migration from Legacy Concur Application to Universal Directory

In order to enable UD support for Concur:

  1. Contact Okta support team and request the following feature flag be enabled for your Okta org: PROV_CONCUR_CLOUD_DIRECTORY_ENABLE.

  2. Once the feature is enabled, add a new instance of the Concur App.

    Note: We do not recommend reusing your existing instance of the Concur app for UD features.

  3. Follow the steps above to configure the new application powered with UD features.

Post a Comment