Removal of Concur Provisioning

Do not set up Concur Provisioning: Concur Provisioning was removed from the OIN. Due to persistent technical issues that prevent the Concur Provisioning integration from working properly, please refrain from setting up and rolling out the integration in the org. This applies to both the Early Access (EA) and Generally Available (GA) versions. The Concur SAML integration continues to function properly and is unaffected.

If provisioning integration is already set up, live, and working successfully, it is possible to continue to use it as-is and resolve questions through standard support channels. If the provisioning integration is working successfully and it is necessary to refer to configuration information, please refer to the Provisioning Guide later in this document.

The situation is being actively looked into with Concur. This article will be updated once more information is available.

Frequently Asked Questions

Question: What are the issues?

Answer: There is not just one issue, but several issues. They fall into two buckets:

• The integration may or may not work based on how the Concur tenant is set up, and there is no checklist available to determine this.
• The integration is limited in the user profile attributes it can provision, so even if it works, it may not be sufficient.

Question: Is there a timeline for resolution?

Answer: Unfortunately, it is not possible to provide a timeline for when these issues will be fixed and when the integration will be available again. It is definitely not a quick fix (in the next few weeks) and may take many months. We will update customers when we have a clearer idea.

Question: Are there workarounds?

Answer: We are not Concur experts, but we understand that the standard solution for bulk-creating users into Concur is via flat-file upload.

If there are any additional questions or concerns, please open a case.
 

Configuring Provisioning for Concur

NOTE: We are providing this Provisioning Guide as reference material for our customers whose Provisioning integration is already set up and working.

This guide contains the following topics:

• Conditions
• Features
• Before You Begin
• Requirements
• Configuration Steps
• Attributes in Base Profilea
• Schema Discovery
• Troubleshooting Tips
• Migration from Legacy Concur Application to Universal Directory

Conditions

A base user record will not be fully provisioned in the following cases:

• The Concur tenant uses the Reimbursement Method field. See below for details:

  Standard Edition - customers who have more than one reimbursement method (Expense Pay, Payroll, Co. Check) can provision users but must import the reimbursement values via a file. Possible values are:

  • If the customer uses ADP Payroll, then the ADP Payroll fields must be populated manually or via an import file.

  • If Expense Pay or AP Check is the customer's single reimbursement method, Okta does not need to populate this data (a blank value will populate the single, default method).

  Standard-to-Professional Upgrade Edition - customers using the corresponding Payment Manager batches (that are populated by the values in this field) can provision users, but must import these values via a file. Consult with Concur for possible solutions. For example, if choosing to use one Accounting file, the individual batches that these field values populate will not be needed.

  Professional Edition – this field does not apply to Professional Edition at this time.

• If the Concur tenant uses Cash Advance fields, the Cash Advance Account Code and Cash Advance Approver need to be manually entered or imported via a file, as these fields are not supported in the Concur API.

• If the Concur tenant has more than one Travel Policy, then this field needs to be set manually or via a file import. Generally, for Standard travel, there is only one travel policy. In this case, a blank value via Okta will populate the default value.

• If the Concur tenant uses Multiple Employee Forms, provisioning a base record via Okta is not possible.

Features

The following provisioning features are supported:

• Schema Discovery

• Create Users

  NOTE: Okta only creates a user’s base profile in Concur.

• Update User Attributes

• Deactivate Users

• Sync Password

NOTE: Import of Users is currently supported only in CSV format.

Before You Begin

It is important to determine which Edition of Concur is used before configuring provisioning. Here we describe our support for each edition, and how to determine what edition you are using.

NOTE: The base user profile contains a few special attributes whose values vary depending on your Concur Edition. These are described in the Attributes in Base Profile section.

Support of Concur Editions

Determining Edition Type

A client can determine the Concur Edition type by having their administrator log in to their Concur site. If they see a Setup menu with a sub-option for Expense within the Administration menu (as shown below), then this is a Standard Edition site. If the client administrator does not see the Expense menu within the Setup menu, then they have a Concur Professional Edition site:

Requirements

Before you begin setting up the application, go through the Attributes in Base Profile section. You will need to obtain allowed values from the Concur Implementation team, which are associated with special attributes in Concur, such as Ledger Key.

• Letter of Authorization (LOA): Concur requires a letter of authorization before you can start using Okta for provisioning. If you are implementing Provisioning, or for Provisioning plus Single Sign On (SSO):

  Download the following document, sign it, and scan the signed copy into a pdf file.

  Concur Letter of Authorization - Provisioning or Provisioning plus SSO

  Click the link below to generate a Provisioning Enablement Request email to Concur. Fill in the fields and attach the LOA.

  Provisioning Enablement Email

  Note: If the above link does not generate an email message on your system, open this Email Text and copy and paste the information into a new email message.

• Universal Directory for Concur is an Early Access feature. If you would like to turn on UD for Concur, contact Okta Support.

• You must have Concur Expense service enabled. That is, Concur Travel only is not supported.

• Before setting up provisioning, ensure that a Web Services subscription is enabled for your Concur tenant. Contact Concur to get the Web Services Administrator Profile set up; this is a one-time required setup. Once the subscription is enabled, you will be able to use the provisioning application in your Concur Production tenant. The Okta application is listed globally in the Concur Production environment, and no further steps need to be taken to enable the Okta application in your Concur Web Services App center.

  Enable the Okta Connect app in the Concur App Center by following these steps:

  1. Login to Concur (commonly, https://www.concursolutions.com) with your Concur Admin account.

  2. Navigate to Administration > Company > Web Services.

     

      

  3. Navigate to Enable Partner Application, then find Okta Connect in the list and make sure it is Enabled.

     Note: Contact Concur to enable the Okta application for your Concur tenant if the application does not appear in the Web Services section.

     

      

Configuration Steps

Important: Before you start configuring provisioning, make sure you have determined what Concur Edition you have, and have also met all the requirements we provided.

1. Configure your Provisioning settings for Concur as follows:

   • Check the Enable provisioning features box.

   • In the API Authentication section, click Authenticate with Concur:

     

      

   • A new window will appear displaying the Concur login page. Enter your Concur Admin credentials and log in.

   • A message will appear with the option to allow Okta to connect to your tenant. Choose Allow for provisioning to work.

     

      

   • Now your app is authenticated, scroll down the Provisioning page and select those provisioning features you want to enable:

     

      

   • Click Next.

2. You can now assign people to the app (if needed) and finish the application setup.

3. The required attributes in Concur depend on your Concur tenant settings. Follow the steps below to add all required user attributes to the user profile:

   • In Okta, from the Admin dashboard, select Directory > Profile Editor.

   • Select the APPS section in the left navigation bar, then find your app in the list.

     

      

   • Select Add Attribute, then Refresh Attribute List to see the latest list of Concur attributes.

     Remember to add all attributes associated to linked lists in your Concur tenant. For example, if you are using Concur Standard Edition and have policy groups enabled, you will have to add the Expense Policy Group attribute (OrgUnit1) though it will not show as a required attribute. This is because the Expense Policy Group (OrgUnit1) attribute is part of a linked list with Employee Administration Country (custom21).

     

      

   • Required Concur attributes are pre-selected for you on this page. Additionally, you can add more attributes of your choice.

     Note: If you are using Standard Edition with Groups enabled, be sure to add the Expense Policy Group (orgUnit1) attribute.*

   • Save the profile.

   • The setup is now complete.

Attributes in Base Profile

There are a few special attributes in the Base user profile, whose values vary depending on your Concur Edition. Pay special attention to these attributes:

For these attributes, Concur has a pre-defined list of allowed values per tenant, and you will experience errors if you use a wrong value. So make sure you know what to enter here.

Schema Discovery

This application supports the Schema Discovery feature, which allows the extension of the list of attributes to sync with Concur.

Concur may have dependencies between certain attributes, for example, in Standard Edition with Groups support, Expense Policy Group values depend on the Employee Administration Country value.

These are identified as linked lists in your Concur tenant. Other examples of linked lists are Division, Department, and Cost Center.

If you are adding one of the dependent attributes, make sure you add all the attributes it depends on. In other cases, you will not be able to set a value for it without providing values for its parent attributes.

Troubleshooting Tips

The most common errors are:

• If you see an error that states user e-mail is already taken, contact Concur support and ask to make it available for your tenant.
  
   

   

• Concur's required field was not added to the User profile or had an empty value:
  
   

  To fix this, make sure you added the required field to your Application User profile and provide it with a valid value.

• Set a wrong value to a field, for which valid values are strictly defined:
  
   

  To fix this, provide a field with a valid value. For instructions on how to get valid values, see the Schema Discovery section.

Migration from Legacy Concur Application to Universal Directory

In order to enable UD support for Concur:

1. Contact the Okta support team and request that the following feature flag be enabled for the Okta org: PROV_CONCUR_CLOUD_DIRECTORY_ENABLE.

2. Once the feature is enabled, add a new instance of the Concur App.

   NOTE: We do not recommend reusing your existing instance of the Concur app for UD features.

3. Follow the steps above to configure the new application powered with UD features.