Skip to main content
Connect SAP Concur to Oleria to see who can access expense reports, invoices, purchase requests, and travel requests in your travel and expense platform, and which Spend Role Extension roles each user holds.
SAP Concur exposes no admin/privileged-role or audit/activity API, so this integration is an access-inventory source (users and Spend Role Extension role assignments) rather than a posture or detection source.

​
What Oleria discovers

​
Prerequisites

  1. Administrator permission on the Oleria workspace
  2. Access to your SAP Concur company’s Authentication Admin settings

​
Create an OAuth 2.0 application in SAP Concur

1

Open OAuth 2.0 Application Management

Sign in to SAP Concur and go to Administration -> Company -> Authentication Admin -> OAuth 2.0 Application Management.
2

Create a new application

Create a new OAuth 2.0 application. After it’s created, note the Client ID and Client Secret shown - you’ll need both to connect Oleria.
If you plan to use remediation actions, grant the user.provision.write scope when you create the application. SAP Concur only applies scopes granted at registration time.
3

Note your Company UUID

On the same page, note your company’s Company UUID. It’s shown alongside the Company Request Token described in the next step.
4

Generate a Company Request Token

From the same OAuth 2.0 Application Management page, generate a Company Request Token.
The Company Request Token is valid for 24 hours and is only needed for the very first connection. Oleria exchanges it for a refresh token during setup and doesn’t need it again on later syncs.

​
Connect SAP Concur to Oleria

1

Open the integration

Sign in to your Oleria workspace, navigate to Integrations, and select SAP Concur.
2

Complete the connection form

A side panel opens. Enter the following details:
  • Company UUID - your SAP Concur company’s UUID, from Authentication Admin -> OAuth 2.0 Application Management
  • Client ID - the Client ID of the OAuth 2.0 application you created
  • Client Secret - the Client Secret issued when the OAuth 2.0 application was created
  • Company Request Token - the 24-hour token you generated in the previous section
  • Starting Region (optional) - leave as United States unless your SAP Concur contact told you otherwise, or you’re connecting to a Test/Implementation environment
Oleria automatically discovers and stores your company’s actual API host from the first token exchange, so an incorrect Starting Region selection never misroutes later syncs.
3

Authenticate

Select Authenticate to complete the connection.

​
Verify the integration

Confirm the SAP Concur instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered users, roles, and access grants in your Oleria workspace.

​
Remediation actions

Beyond discovery, Oleria can act on SAP Concur user accounts to remediate risk. The following actions are supported:
Remediation requires the OAuth application to have been granted the user.provision.write scope at registration time. SAP Concur has no API to confirm this scope was actually granted, so a read-only-scoped connection passes setup validation successfully and only fails when a disable or enable action is attempted. If a remediation action fails, check the OAuth application’s granted scopes in Authentication Admin.

​
Known limitations

  • SAP Concur has no admin/privileged-role signal, so Oleria can’t distinguish admin accounts for this integration.
  • SAP Concur has no audit or activity log API for identity/access actions, so activity data isn’t available for this integration.
  • Role assignment and removal aren’t supported as remediation actions. Concur’s Spend Role Extension roles are a business-process concept managed in Concur’s own admin console.
  • If the refresh token issued during setup expires or is revoked (SAP Concur’s typical refresh token lifetime is about 6 months), sync starts failing. Recovering requires generating a new Company Request Token and reconnecting the integration from scratch.

​
Contact us

For questions about this integration, contact us at support@oleria.com.