Concur Provisioning Integration With Okta
Last Updated:
Do not set up Concur Provisioning: Concur Provisioning was removed from the Okta Integration Network (OIN) due to persistent technical issues that prevent the integration from functioning reliably. New setups of the integration are not recommended for either the Early Access (EA) or Generally Available (GA) versions. The Concur SAML integration is unaffected and continues to function properly.
Why Was Concur Provisioning Removed from the OIN?
Two categories of issues affect the Concur Provisioning integration:
- The integration may or may not work depending on how the Concur tenant is set up, and no checklist exists to determine compatibility in advance.
- The integration is limited in the user profile attributes it can provision, so even when it works, it may not meet all requirements.
A timeline for resolution is not available. Resolution is not expected within weeks and may take many months. This article will be updated when more information is available.
Recommended Approach for Bulk User Creation in Concur
The standard solution for bulk-creating users in Concur is via flat-file upload. For additional questions or concerns, open a case.
Continuing an Existing Provisioning Integration
NOTE: This Provisioning Guide is provided as reference material for our customers whose Provisioning integration is already set up and working.
|
NOTE:
|
This guide contains the following topics:
- Conditions That Prevent Full Base User Record Provisioning
- Supported Provisioning Features
- What Should Be Determined Before Configuring Provisioning?
- Requirements for Setting Up the Concur Provisioning Application
- Configuration Steps for Concur Provisioning
- Attributes in the Base User Profile
- Schema Discovery and Linked Attribute Dependencies
- Common Provisioning Errors and How to Resolve Them
- Migrating from the Legacy Concur Application to Universal Directory
Conditions That Prevent Full Base User Record Provisioning
A base user record will not be fully provisioned in the following cases:
- The Concur tenant uses the Reimbursement Method field:
- Standard Edition: Customers with more than one reimbursement method (Expense Pay, Payroll, Co. Check) can provision users but must import reimbursement values via a file. If the customer uses ADP Payroll, the ADP Payroll fields must be populated manually or via an import file. If Expense Pay or AP Check is the single reimbursement method, Okta does not need to populate this data — a blank value populates the single default method.
- Standard-to-Professional Upgrade Edition: Customers using the corresponding Payment Manager batches can provision users, but must import these values via a file. Consult with Concur for possible solutions.
- Professional Edition: The Reimbursement Method field does not apply to Professional Edition.
- If the Concur tenant uses Cash Advance fields, the Cash Advance Account Code and Cash Advance Approver must be manually entered or imported via a file, as these fields are not supported in the Concur API.
- If the Concur tenant has more than one Travel Policy, this field must be set manually or via a file import. For Standard travel with only one travel policy, a blank value via Okta populates the default value.
- If the Concur tenant uses Multiple Employee Forms, provisioning a base record via Okta is not possible.
Supported Provisioning Features
The following provisioning features are supported:
- Schema Discovery
- Create Users
NOTE: Okta only creates a user's base profile in Concur.
- Update User Attributes
- Deactivate Users
- Sync Password
NOTE: Import of Users is currently supported only in CSV format.
What Should Be Determined Before Configuring Provisioning?
Determine which Edition of Concur is in use before configuring provisioning. The base user profile contains special attributes whose values vary depending on the Concur Edition. Refer to the Attributes in the Base User Profile section for details.
Support of Concur Editions
| Edition | Support |
|---|---|
| Small Business | The Okta-Concur integration does not support the Concur Small Business Edition. |
| Standard Edition | Okta supports provisioning functionality for Concur Standard Edition. Okta only creates a base user record in Concur. Standard Edition clients not using extended features can use the User Provisioning app to add records without importing additional data; however, some Standard Edition features require additional file imports or manually added information in Concur. |
| Professional | Okta supports provisioning functionality for Concur Professional Edition. Okta only creates a base user record in Concur; file imports may be required for attributes (such as employee banking data) not supported by the Concur API. Many Expense features require employee data that User Provisioning applications cannot populate. |
| Premium | Okta supports provisioning functionality for Concur Premium Edition. Okta only creates a base user record in Concur; file imports may be required for attributes (such as employee banking data) not supported by the Concur API. Many Expense features require employee data that User Provisioning applications cannot populate. |
Determining the Concur Edition Type
An administrator can determine the Concur Edition type by logging in to the Concur site. If a Setup menu with a sub-option for Expense appears within the Administration menu, the site is a Standard Edition site. If the Expense menu does not appear within the Setup menu, the site is a Concur Professional Edition site:
Requirements for Setting Up the Concur Provisioning Application
Review the Attributes in the Base User Profile section before beginning setup. Allowed values associated with special attributes in Concur, such as Ledger Key, must be obtained from the Concur Implementation team.
- Letter of Authorization (LOA): Concur requires a letter of authorization before Okta provisioning can be used. Download the Concur Letter of Authorization - Provisioning or Provisioning plus Single Sign-On (SSO) document, sign it, scan the signed copy into a PDF file, and submit a Provisioning Enablement Request email to Concur with the LOA attached.
- Universal Directory (UD) for Concur is an Early Access feature. Contact Okta Support to enable UD for Concur.
- Concur Expense service must be enabled. Concur Travel only is not supported.
- A Web Services subscription must be enabled for the Concur tenant before setting up provisioning. Contact Concur to set up the Web Services Administrator Profile (a one-time required setup). Once the subscription is enabled, the provisioning application is available in the Concur Production tenant.
Enable the Okta Connect app in the Concur App Center by completing the following steps to sign in, navigate to Web Services, and enable the Okta Connect partner application:
- Sign in to Concur (commonly, https://www.concursolutions.com) with a Concur Admin account.
- Navigate to Administration > Company > Web Services.
- Navigate to Enable Partner Application, find Okta Connect in the list, and confirm it is Enabled.
NOTE: Contact Concur to enable the Okta application for the Concur tenant if the application does not appear in the Web Services section.
Configuration Steps for Concur Provisioning
Confirm the Concur Edition and all requirements are met before beginning. Configure Provisioning settings, authenticate with Concur, assign users, and add all required user profile attributes by following these steps:
- Configure Provisioning settings for Concur:
- Select the Enable provisioning features checkbox.
- In the API Authentication section, select Authenticate with Concur:
-
- A new window displays the Concur sign-in page. Enter Concur Admin credentials and sign in.
- A message appears with the option to allow Okta to connect to the tenant. Choose Allow for provisioning to work.
-
- Scroll down the Provisioning page and select the provisioning features to enable:
-
- Select Next.
- Assign people to the app if needed and complete the application setup.
- Add all required user attributes to the user profile based on the Concur tenant settings:
- In Okta, from the Admin dashboard, go to Directory > Profile Editor.
- Select the APPS section in the left navigation bar, then find the app in the list.
-
- Select Add Attribute, then Refresh Attribute List to see the latest list of Concur attributes. Add all attributes associated with linked lists in the Concur tenant. For example, when using Concur Standard Edition with policy groups enabled, add the Expense Policy Group attribute (OrgUnit1) even though it does not appear as a required attribute — this is because Expense Policy Group (OrgUnit1) is part of a linked list with Employee Administration Country (custom21).
-
-
- Required Concur attributes are pre-selected on this page. Additional attributes can also be added.
-
NOTE: When using Standard Edition with Groups enabled, add the Expense Policy Group (orgUnit1) attribute.
-
- Select Save to save the profile.
Attributes in the Base User Profile
The base user profile contains special attributes whose values vary depending on the Concur Edition. Pay special attention to the following:
| Attribute | Description |
|---|---|
| Locale Name | Select a value from the dropdown menu that is applicable to the Concur tenant. If a locale value is not enabled in the Concur tenant, this field is left blank on the user's Concur profile, or errors may occur. |
| Country Code | Select a value from the dropdown menu that is applicable to the Concur tenant. If a locale value is not enabled in the Concur tenant, this field is left blank on the user's Concur profile, or errors may occur. |
| Currency Key | Select a value from the dropdown menu that is applicable to the Concur tenant. If a locale value is not enabled in the Concur tenant, this field is left blank on the user's Concur profile, or errors may occur. |
| Ledger Key | For Concur Standard edition, the default value to pass is DEFAULT. This attribute does not appear in the Concur UI but is required for provisioning. For Concur Professional/Premium edition, the ledger code must be obtained from Concur, as it is not available in the API and is not exposed in the Concur UI (Accounting Administration menu). Maintain the list of ledger codes and enter them in Okta when assigning new users. Contact Concur at pdspe@concur.com to obtain valid Ledger Code(s) for the Concur tenant. |
Concur defines a pre-determined list of allowed values per tenant for these attributes. Using an incorrect value will cause errors.
Schema Discovery and Linked Attribute Dependencies
The Concur provisioning application supports the Schema Discovery feature, which allows extending the list of attributes to sync with Concur.
Concur may have dependencies between certain attributes. For example, in Standard Edition with Groups support, Expense Policy Group values depend on the Employee Administration Country value.
These are identified as linked lists in the Concur tenant. Other examples of linked lists include Division, Department, and Cost Center. When adding a dependent attribute, all attributes it depends on must also be added — without parent attribute values, a value cannot be set for the dependent attribute.
Common Provisioning Errors and How to Resolve Them
The most common provisioning errors are:
- User email is already taken: Contact Concur support and request that the email be made available for the tenant.
Automatic provisioning of user <user> to app Concur failed: Error while creating user <user>: User Create/Update Failed
- Required field was not added to the user profile or had an empty value: Add the required field to the application user profile and provide a valid value.
Error while deactivating <user> (Concur): Error while deactivating <user> (Concur): Missing Required Field: LocaleName
- A wrong value was set for a field with strictly defined valid values: Provide the field with a valid value. For instructions on obtaining valid values, see the Schema Discovery section above.
Automatic provisioning of user <user> to app Concur failed: Error while creating Concur user <user>: Invalid currency code (SEK)
Migrating from the Legacy Concur Application to Universal Directory
To enable Universal Directory (UD) support for Concur, contact Okta Support to enable the feature flag, add a new Concur app instance, and configure it with UD features by following these steps:
- Contact the Okta support team and request that the following feature flag be enabled for the Okta org:
PROV_CONCUR_CLOUD_DIRECTORY_ENABLE. - Once the feature is enabled, add a new instance of the Concur app.
NOTE: Reusing an existing instance of the Concur app for UD features is not recommended.
- Follow the configuration steps above to configure the new application with UD features.
