Skip to main content

​
After this article

You’ll be able to connect SAP Concur to Lumos to sync users, spend groups, spend roles, and product entitlements. The integration supports both syncing and provisioning, and you can connect it read-only or write-enabled.

​
Capabilities

Update Account. Update Account writes the same fields as Create Account: the core identity fields (email, given name, family name, active) plus the enterprise and spend fields, and custom attributes. Every field is optional, so Lumos patches only the fields you map. Assigning a spend role a user already holds, or removing one they do not hold, completes as a no-op rather than failing, so re-running a task is safe. When Create Account finds the user already exists in Concur, Lumos reads the account’s real status and runs activation if it is inactive. Deprovisioning supports two actions on users. Delete removes a user in SAP Concur. Deactivate sets a user inactive. Assign Approver. The connector can set a user’s Expense approver. You identify the approver by employee number and Lumos resolves it to the matching Concur user before writing. Concur supports one primary and one secondary Expense approver per user, and the assignment names the slot it writes to (Primary or Secondary) rather than filling whichever slot is free, so the same request always does the same thing and you can replace the approver in a slot that is already taken. Assigning an approver who is already in that slot is a safe no-op. The lookup requires the identity.user.enterprise.read scope, and the approver must hold the EXP_APPROVER spend role. Lumos syncs each user’s current approvers as the attributes primaryExpenseApprover and secondaryExpenseApprover. The primary Expense approver is also writable: Primary Expense Approver is a standard field on Update Account, so you can map it in Attribute Sync (for example to keep the approver in step with a manager change). The field accepts the approver’s Concur user ID or their employee number. The secondary approver is set through Assign Approver.

​
Required plan and roles

SAP Concur authenticates with an OAuth 2.0 application. Before you start, reach out to SAP Concur Support to get a Client ID, Client Secret, Company UUID (Organization ID), and Refresh Token. Support also tells you the geolocation of your instance. The application behind your Client ID must be configured with the right scopes. Which scopes you need depends on whether you want read-only visibility or full provisioning. Read-only scopes
  • identity.user.ids.read
  • spend.listitem.read
  • identity.user.core.read, retrieves user information like name and active status
  • identity.user.coresensitive.read, retrieves user information like email
  • spend.user.general.read, retrieves users’ spend roles
Write scopes (add these for provisioning)
  • user.provision.write
  • identity.user.coreenterprise.writeonly
  • identity.user.delete
  • spend.user.general.writeonly
  • identity.user.enterprise.read, required by the Assign Approver capability to look up approvers by employee number
The SAP Concur connector card also lists these scopes as required: EXPRPT, spend.listitem.read, identity.user.ids.read, identity.user.sap.read, and travel.user.general.read. Confirm the full set with SAP Concur Support when they provision your application.

​
Read-only access vs provisioning

Is read-only possible? Yes. Ask SAP Concur Support to configure your OAuth application with only the read-only scopes (identity.user.ids.read, spend.listitem.read, identity.user.core.read, identity.user.coresensitive.read, spend.user.general.read) and the connection syncs without write access. What read-only requires. The same OAuth application credentials (Client ID, Client Secret, Company UUID, Refresh Token) configured with the read-only scope set above. Follow the steps below to request them from SAP Concur Support. What full provisioning requires. The same application configured with the write scopes added on top of the read set, user.provision.write, identity.user.coreenterprise.writeonly, identity.user.delete, and spend.user.general.writeonly. Watch out for. SAP Concur Support, not you, configures the scopes on your application, so switching modes means going back to Support to add the write scopes rather than making a self-service change. The connector card also lists EXPRPT, spend.listitem.read, identity.user.ids.read, identity.user.sap.read, and travel.user.general.read as required, so confirm the full scope set with Support rather than relying on the read and write lists alone.

​
Instructions

Phase 1: Get your credentials from SAP Concur
  1. Contact SAP Concur Support and request a Client ID, Client Secret, Organization ID (Company UUID), and Refresh Token.
  2. Ask Support to configure the application with the read-only scopes above, plus the write scopes if you plan to provision.
  3. Ask Support for the geolocation of your instance. You’ll enter it as a full URL with no trailing slash, for example https://us2.api.concursolutions.com. The full list of API servers is in SAP Concur’s Base URIs documentation.
Phase 2: Connect in Lumos
  1. Find the SAP Concur card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Enter the Client ID, Client Secret, Company UUID, Refresh Token, and Geolocation.
  3. Click Connect.

​
API Endpoints Used

​
Troubleshooting

Connection fails with an authentication error. Confirm the Client ID, Client Secret, Company UUID, and Refresh Token are the exact values SAP Concur Support gave you. The refresh token is issued by Support, not generated in the console. Connection succeeds but no data syncs. Check that the application behind your Client ID has the read-only scopes configured. Ask SAP Concur Support to verify the scope set on the application. Provisioning actions fail. Read-only scopes let Lumos sync but not write. To provision, the application also needs the write scopes (user.provision.write, identity.user.coreenterprise.writeonly, identity.user.delete, spend.user.general.writeonly). Assign Approver fails. Four things to check. The OAuth application needs the identity.user.enterprise.read scope. Without it, Lumos can’t resolve the approver’s employee number. The approver must have a spend profile and the EXP_APPROVER spend role. And Concur allows only one primary and one secondary Expense approver per user, so choose the slot you want to write to; assigning to an occupied slot replaces the approver in it. The employee number must also match exactly one Concur user. Requests go to the wrong region. The Geolocation value routes every API call. Enter the full base URL for your instance with no trailing slash, for example https://us2.api.concursolutions.com. If Support gave you an EMEA or China instance, use that host instead of the US default.