> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAP Concur Integration

Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we integrate your SAP Concur travel and expense platform into the Oleria platform. Follow these steps to integrate SAP Concur with your Oleria workspace.

<Note>SAP Concur exposes no admin/privileged-role or audit/activity API, so this integration is an access-inventory source (users and Spend Role Extension role assignments) rather than a posture or detection source.</Note>

## Prerequisites

1. Administrator permission on the Oleria workspace
2. Access to your SAP Concur company's **Authentication Admin** settings

## Create an OAuth 2.0 application in SAP Concur

<Steps>
  <Step title="Open OAuth 2.0 Application Management">
    Sign in to SAP Concur and go to **Administration** → **Company** → **Authentication Admin** → **OAuth 2.0 Application Management**.
  </Step>

  <Step title="Create a new application">
    Create a new OAuth 2.0 application. After it's created, note the **Client ID** and **Client Secret** shown - you'll need both to connect Oleria.
  </Step>

  <Step title="Note your Company UUID">
    On the same page, note your company's **Company UUID**. It's shown alongside the Company Request Token described in the next step.
  </Step>

  <Step title="Generate a Company Request Token">
    From the same OAuth 2.0 Application Management page, generate a **Company Request Token**.

    <Note>The Company Request Token is valid for 24 hours and is only needed for the very first connection. Oleria exchanges it for a refresh token during setup and doesn't need it again on later syncs.</Note>
  </Step>
</Steps>

## Connect SAP Concur to Oleria

<Steps>
  <Step title="Open the integration">
    Log in to your Oleria workspace, navigate to **Integrations**, and select **SAP Concur**.
  </Step>

  <Step title="Complete the connection form">
    A side panel opens. Enter the following details:

    * **Company UUID** - your SAP Concur company's UUID, from Authentication Admin → OAuth 2.0 Application Management
    * **Client ID** - the Client ID of the OAuth 2.0 application you created
    * **Client Secret** - the Client Secret issued when the OAuth 2.0 application was created
    * **Company Request Token** - the 24-hour token you generated in the previous section
    * **Starting Region** (optional) - leave as **United States** unless your SAP Concur contact told you otherwise, or you're connecting to a Test/Implementation environment

    <Note>Oleria automatically discovers and stores your company's actual API host from the first token exchange, so an incorrect Starting Region selection never misroutes later syncs.</Note>
  </Step>

  <Step title="Authenticate">
    Select **Authenticate** to complete the connection.
  </Step>

  <Step title="Verify the connection">
    Verify the SAP Concur integration status from the connected integrations page.
  </Step>
</Steps>

## What Oleria discovers

| Area              | Detail                                                                                                                                                                 |
| :---------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Users**         | Company users from the SCIM 2.0 Identity API.                                                                                                                          |
| **Roles**         | The company-wide Spend Role Extension role catalog, and each user's role assignments.                                                                                  |
| **Access grants** | Each user's Expense Report, Invoice, Purchase Request, and Travel Request access, plus Approver/Delegate relationships from the Spend Role Extension's Access profile. |

## Remediation actions

Beyond discovery, Oleria can act on SAP Concur user accounts to remediate risk. The following actions are supported:

| Action               | What it does                                    | Revert                               |
| :------------------- | :---------------------------------------------- | :----------------------------------- |
| Disable user account | Deactivates a SAP Concur user account.          | Supported - reactivates the account. |
| Enable user account  | Reactivates a disabled SAP Concur user account. | Supported - deactivates the account. |

<Warning>
  Remediation requires the OAuth application to have been granted the `user.provision.write` scope at registration time. SAP Concur has no API to confirm this scope was actually granted, so a read-only-scoped connection passes setup validation successfully and only fails when a disable or enable action is attempted. If a remediation action fails, check the OAuth application's granted scopes in Authentication Admin.
</Warning>

## Known limitations

* SAP Concur has no admin/privileged-role signal, so Oleria can't distinguish admin accounts for this integration.
* SAP Concur has no audit or activity log API for identity/access actions, so activity data isn't available for this integration.
* Role assignment and removal aren't supported as governance actions. Concur's Spend Role Extension roles are a business-process concept managed in Concur's own admin console.
* If the refresh token issued during setup expires or is revoked (SAP Concur's typical refresh token lifetime is about 6 months), sync starts failing. Recovering requires generating a new Company Request Token and reconnecting the integration from scratch.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).