Skip to main content
Connect SAP Concur to Oleria to see who can access expense reports, invoices, purchase requests, and travel requests in your travel and expense platform, which Spend roles each user holds, and when expense reports and invoices are created and submitted.

​
What Oleria discovers

  • Users - company users from the Identity API, with name, email, title, employee number, department, cost center, and whether the account is active.
  • Roles - the company’s Spend role catalog (Expense, Request, Invoice, and Reporting roles) and each user’s role assignments, including the hierarchy groups a role is scoped to.
  • Access - for each employee’s expense reports, invoices, purchase requests, and travel requests: the employee as owner, their approvers (primary and backup), and their delegates with the permissions each delegate holds.
  • Delegation - delegates who can act in another employee’s account (approve, prepare, submit, or view receipts), shown as the ability to act on that employee’s behalf.
  • Activity - expense reports created, submitted, approved for payment, paid, and modified; invoices created, modified, paid, and extracted. Each event is attributed to the document’s owner.

​
Prerequisites

  • An SAP Concur administrator with the Web Services Administrator role (Professional Edition) or the Can Administer permission (Standard Edition), to create the OAuth 2.0 application and generate a Company Request Token
  • The OAuth 2.0 Application Management tool enabled for your company. Contact SAP Concur Client Web Services to request it. The tool is available in the US2, EU2, and APJ1 data centers.
  • The scopes below selected on that application. You select scopes when you create the application. Contact SAP Concur to request a scope the tool doesn’t list.
  • For expense report activity, SAP Concur requires the Web Services Admin role to list expense reports for all users
Create a dedicated OAuth 2.0 application for Oleria rather than reusing one shared with another integration, so its scopes and tokens can be managed on their own.

​
Scopes

Read-only (discovery and activity): Remediation (only if you use remediation actions):

​
Create an OAuth 2.0 application in SAP Concur

1

Open OAuth 2.0 Application Management

Sign in to SAP Concur and go to Administration > Company > Authentication Admin, then select OAuth 2.0 Application Management. The Application List page opens.
2

Create a new application

Select Create New App and fill in the required fields. In Allowed Grants, select the password and refresh_token grants. In Allowed Scopes, select the read-only scopes, plus the remediation scopes if you plan to use remediation actions. Select Submit.The App Credentials page shows the Client ID and Client Secret. Note both - you’ll need them to connect Oleria.
SAP Concur only applies scopes granted to the application.
3

Generate a Company Request Token

Go back to Administration > Company > Authentication Admin and select Company Request Token. In the App ID field, enter the application’s Client ID, then select Submit.The Company Request Token Successfully Created dialog shows your Company UUID and Company Request Token. Note both before you select OK.
The Company Request Token is valid for 24 hours and is only needed for the very first connection. Oleria exchanges it for a refresh token during setup and doesn’t need it again on later syncs. If it expires before you connect, generate a new one by entering the Client ID and selecting Submit again.

​
Connect SAP Concur to Oleria

1

Open the integration

Sign in to your Oleria workspace, navigate to Integrations, and select SAP Concur.
2

Complete the connection form

A side panel opens. Enter the following details:
  • Company UUID - your SAP Concur company’s UUID, from the Company Request Token Successfully Created dialog
  • Client ID - the Client ID of the OAuth 2.0 application you created
  • Client Secret - the Client Secret issued when the OAuth 2.0 application was created
  • Company Request Token - the 24-hour token you generated in the previous section
  • Starting Region (optional) - leave as United States unless SAP Concur told you your company is in Europe, or you’re connecting to a Test/Implementation environment
Oleria sends the first token exchange to the Starting Region, then uses the API host SAP Concur returns for every later sync.
3

Authenticate

Select Authenticate to complete the connection. Oleria checks that the application can read users and Spend user data before it saves the connection, so a missing read scope fails here.

​
Verify the integration

Confirm the SAP Concur instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered users, roles, access, and activity in your Oleria workspace.

​
Remediation actions

Beyond discovery, Oleria can act on SAP Concur user accounts to remediate risk. The following actions are supported:
Before an action runs, Oleria checks that the application’s token lists the remediation scope the action needs. Disable and enable leave a user who is already in the requested state unchanged, and their revert only undoes a change the action made. If SAP Concur doesn’t list the granted scopes, a missing scope only surfaces when the action runs. Role changes are processed by SAP Concur in the background; Oleria waits for SAP Concur to confirm each change.

​
Known limitations

  • SAP Concur’s user API has no admin flag, so Oleria doesn’t mark accounts as admins for this integration. Admin Spend roles appear as roles.
  • SAP Concur’s API doesn’t expose MFA, single sign-on, sign-in methods, last sign-in, or password-change dates, so these are shown as unavailable.
  • SAP Concur’s API doesn’t list OAuth applications, connected apps, or other non-human identities.
  • SAP Concur has no audit or sign-in log API. Activity is limited to expense report and invoice events, and each event is attributed to the document’s owner, even when a delegate acted for them.
  • Employee groups are part of SAP Concur’s group hierarchy, which the API doesn’t expose as groups. They appear as the groups a Spend role is scoped to.
  • Approver and delegate access can’t be revoked through Oleria. Oleria doesn’t offer actions to remove an approver or delegate.
  • Deleting users depends on the identity.user.delete scope. Contact your SAP Concur account manager for it. Without it, the delete action fails.
  • Invoice submission isn’t recorded as activity: SAP Concur’s invoice list can filter on the submit date but doesn’t return it.
  • This integration hasn’t been tested against a live SAP Concur tenant. In particular, role changes, user deletion, the batched user lookups, the time zone of SAP Concur’s activity dates, and invoice activity with a company-level token are built from SAP Concur’s documentation only.
  • If the refresh token issued during setup expires or is revoked (SAP Concur refresh tokens last six months, and SAP Concur returns a new one each time Oleria refreshes its access token), sync starts failing. Recovering requires generating a new Company Request Token and reconnecting the integration.

​
Contact us

For questions about this integration, contact us at support@oleria.com.