Stitchflow
SAP Concur logo

SAP Concur SCIM guide

Native SCIM

How to automate SAP Concur user provisioning, and what it actually costs

Native SCIM requires Enterprise plan

Summary and recommendation

SAP Concur supports SCIM 2.0 via its UPS v4 API, but only on Enterprise plans (averaging ~$110,000/year). The bigger problem: Microsoft's Azure AD connector for SAP Concur is deprecated and broken, forcing you to route provisioning through SAP Cloud Identity Services instead of direct integration. This creates a complex multi-hop provisioning chain where Entra provisions to SAP IPS, which then provisions to Concur—adding latency, failure points, and troubleshooting complexity.

For organizations below Enterprise tier or those seeking reliable Azure AD integration, this creates a significant gap. You're either locked out of automated provisioning entirely or forced into SAP's broader ecosystem architecture that may not align with your identity management strategy. Manual user lifecycle management in a travel and expense system used by all employees becomes a compliance and operational burden.

The strategic alternative

SAP Concur gates SCIM behind Enterprise. Skip the Enterprise plan upgrade and automate complete outcomes across your stack. We maintain the integration layer underneath. You focus on judgment, not plumbing.

Quick SCIM facts

SCIM available?Yes
SCIM tier requiredEnterprise
SSO required first?Yes
SSO available?Yes
SSO protocolSAML 2.0
DocumentationOfficial docs

Supported identity providers

IdPSSOSCIMNotes
OktaOIN app with full provisioning
Microsoft Entra IDGallery app with SCIM
Google WorkspaceJIT onlySAML SSO with just-in-time provisioning
OneLoginSupported

The cost of not automating

Without SCIM (or an alternative like Stitchflow), your IT team manages SAP Concur accounts manually. Here's what that costs:

Source: Stitchflow aggregate data across apps with 2+ instances, normalized to 500 employees
Orphaned accounts (ex-employees with access)7
Unused licenses12
IT hours spent on manual management/year101 hours
Unused license cost/year$3,925
IT labor cost/year$6,088
Cost of compliance misses/year$1,741
Total annual financial impact$11,754

The SAP Concur pricing problem

SAP Concur gates SCIM provisioning behind premium plans, forcing significant cost increases for basic user management.

Tier comparison

PlanPriceSSOSCIM
Enterprise~$110,000/year average

Plan Structure

PlanPriceSCIM
Enterprise~$110,000/year average

Note: SCIM provisioning requires Enterprise tier and must be routed through SAP Cloud Identity Services (SAP IPS). Direct provisioning to Concur is not supported.

What this means in practice

The broken provisioning path creates several operational challenges:

Azure AD users are stuck
The deprecated gallery connector means Entra ID customers must completely restructure their provisioning architecture around SAP IPS.
Complex multi-hop provisioning
Your IdP provisions to SAP Cloud Identity Services, which then provisions to Concur. This introduces additional failure points and delayed synchronization.
Vendor lock-in acceleration
SAP is clearly pushing customers toward their broader identity ecosystem rather than supporting direct SCIM integration.

Additional constraints

Deprecated Azure connector
Microsoft's gallery app for SAP Concur provisioning is officially broken and no longer maintained.
SAP IPS dependency
All SCIM provisioning must flow through SAP's Cloud Identity Services, adding complexity and potential sync delays.
Okta authorization requirements
SAML SSO with Okta requires a separate letter of authorization, creating additional procurement friction.
Enterprise-only access
No SCIM availability on lower-cost plans, forcing organizations into six-figure annual commitments for basic user lifecycle management.

Summary of challenges

  • SAP Concur supports SCIM but only at Enterprise tier (~$110,000/year average)
  • Google Workspace users get JIT provisioning only, not full SCIM
  • Our research shows teams manually provisioning this app spend significant hidden costs annually

What the upgrade actually includes

SAP Concur doesn't sell SCIM à la carte. It's bundled with Enterprise features at ~$110,000/year average:

SCIM automated provisioning via UPS v4 API
SAML single sign-on (SSO)
Advanced travel policy enforcement
Expense report workflow automation
Invoice management capabilities
Multi-entity support
Dedicated customer success manager
Premium integration marketplace access

The catch: SCIM provisioning requires routing through SAP Cloud Identity Services (SAP IAS), not direct integration. Microsoft's Azure AD gallery connector is deprecated and broken. Okta requires a letter of authorization for SAML setup.

Stitchflow Insight

If you need comprehensive travel and expense management, the Enterprise bundle delivers value. If you just want automated user provisioning for basic expense reporting, you're paying for enterprise travel features most teams never use. We estimate ~60% of Enterprise features are irrelevant for organizations that only need user lifecycle automation.

What IT admins are saying

Community sentiment on SAP Concur's SCIM implementation is frustrated and confused. Common complaints:

  • Azure AD gallery app connector is broken and deprecated
  • Having to route through SAP Cloud Identity Services adds complexity
  • Enterprise-only pricing at ~$110K/year excludes smaller organizations
  • Okta requires authorization letters for basic SAML setup

The Azure AD connector for SAP Concur is completely broken. Microsoft's own documentation says to use SAP Cloud Identity Services instead, but that means setting up another system just to provision users.

Reddit r/sysadmin

Why do I need an authorization letter just to set up SAML with Okta? Every other SaaS app handles this automatically.

Okta Community

The recurring theme

SAP Concur forces IT teams into complex enterprise-grade integrations with high costs and administrative overhead, even for basic identity management needs.

The decision

Your SituationRecommendation
Need SCIM but not on EnterpriseUse Stitchflow: avoid the ~$110K/year Enterprise upgrade
Already on Enterprise with working SCIMUse native SCIM: you're paying for it
Using Azure AD and hit the broken connectorUse Stitchflow: skip the SAP Cloud Identity Services complexity
Need simple provisioning without SAP ecosystemUse Stitchflow: direct integration with your IdP
Small team, infrequent user changesManual may work: but watch for access control gaps

The bottom line

SAP Concur gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Make SAP Concur workflows AI-native

SAP Concur gates SCIM behind Enterprise. We build complete offboarding, user access reviews, and license workflows without that SCIM Tax upgrade.

No Enterprise upgrade required
Less than a week, start to finish (~2 hours of your time)
We maintain the integration layer underneath
Book a Demo

Technical specifications

SCIM Version

2.0

Supported Operations

Create, Update, Deactivate, Groups

Supported Attributes

Not specified

Plan requirement

Enterprise

Prerequisites

SSO must be configured first

Key limitations

  • Azure AD gallery app connector broken/deprecated
  • Use SAP Cloud Identity Services for SCIM
  • Letter of authorization required for SAML with Okta
  • Must provision via SAP IPS, not directly

Configuration for Okta

Integration type

Okta Integration Network (OIN) app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Okta Admin Console → Applications → SAP Concur → Provisioning

Required credentials

SCIM endpoint URL and bearer token (generated in app admin console).

Configuration steps

Enable Create Users, Update User Attributes, and Deactivate Users.

Provisioning trigger

Okta provisions based on app assignments (users or groups).

SCIM via UPS v4 API or SAP Cloud Identity Services. Aquera connector available for bi-directional lifecycle management. Letter of authorization required for SAML with Okta.

SAP Concur gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Configuration for Entra ID

Integration type

Microsoft Entra Gallery app with SCIM provisioning

Prerequisite

SSO must be configured before enabling SCIM.

Where to enable

Entra admin center → Enterprise applications → SAP Concur → Provisioning

Required credentials

Tenant URL (SCIM endpoint) and Secret token (bearer token from app admin console).

Configuration steps

Set Provisioning Mode = Automatic, configure SCIM connection.

Provisioning trigger

Entra provisions based on user/group assignments to the enterprise app.

Sync behavior

Entra provisioning runs on a scheduled cycle (typically every 40 minutes).

IMPORTANT: Azure AD gallery app connector DEPRECATED/BROKEN. Use SAP Cloud Identity Services for SCIM provisioning. Entra provisions to SAP IPS, which provisions to Concur.

SAP Concur gates SCIM behind Enterprise. Stitchflow automates complete workflows without that SCIM Tax upgrade.

Unlock SCIM for
SAP Concur

SAP Concur gates SCIM behind Enterprise plan. We automate complete offboarding and access reviews across your stack without that SCIM Tax upgrade.

See how it works
Admin Console
Directory
Applications
SAP Concur logo
SAP Concur
via Stitchflow

Last updated: 2026-01-11

* Pricing and features sourced from public documentation.

Keep exploring

Related apps

8x8 logo

8x8

SCIM Tax

UCaaS / Business Communications

SCIM StatusIncluded
Manual Cost$11,754/yr

8x8 supports SCIM 2.0 for automated user provisioning, but only on their quote-based X Series plans (previously $24-44/user/month range before they moved to custom pricing). While SCIM can create, update, and deactivate users, it has critical gaps that create ongoing manual overhead: license assignment must be done manually after every user is provisioned, users can't be deleted (only deactivated), and provisioned users don't automatically appear in the Company Directory. For IT teams managing a unified communications platform that typically covers all employees, these limitations defeat much of SCIM's purpose. You're still manually touching every user account to assign licenses and ensure directory visibility. The lack of user deletion support also creates compliance headaches when employees leave - accounts accumulate as "deactivated" rather than being properly removed.

View full guide
Absorb LMS logo

Absorb LMS

SCIM Tax

Learning Management System (LMS)

SCIM StatusIncluded
Manual Cost$11,754/yr

Absorb LMS supports native SCIM provisioning, but only on Enterprise plans with SSO as a required paid add-on. Even with SCIM enabled, the implementation has critical limitations: SAML provisioning only creates accounts on first login and never updates existing users, and full user provisioning requires the specific "Absorb 5 - New Learner Experience" version. For organizations managing compliance training across hundreds or thousands of learners, these gaps create ongoing manual work. The SSO-as-add-on model means you're paying extra fees on top of already custom Enterprise pricing ($6-12/user/month base, but varies significantly). For learning management systems handling external partners, contractors, and employees across different access levels, the inability to update existing user attributes through SAML provisioning forces IT teams into manual account management—exactly what automated provisioning should eliminate.

View full guide
Airbase logo

Airbase

SCIM Tax

Spend Management / Corporate Cards

SCIM StatusIncluded
Manual Cost$11,754/yr

Airbase supports SCIM provisioning, but only on Enterprise plans starting around $8,500/year. While SCIM works with all major identity providers (Okta, Entra ID, Google Workspace), the Enterprise requirement creates a significant barrier for smaller finance teams who need automated provisioning for spend management but can't justify enterprise-level spend management software costs. This creates a particular challenge in finance applications where rapid provisioning and deprovisioning is critical for corporate card access and financial controls. Manual user management means delayed access for new employees needing corporate cards, and more critically, potential security gaps when departing employees retain access to spend management systems. For finance teams handling sensitive financial data and corporate spending, these delays and oversights create both operational friction and compliance risks.

View full guide