Concur : Two Factor Authentication (2FA) - Setup Guide for End Users

Created by Kevin Schmidt - HCPro, Modified on Thu, 9 Oct at 3:08 AM by Kevin Schmidt - HCPro

Two Factor Authentication (2FA) -

Setup Guide for End Users

By setting up 2FA, you add an extra layer of security to your SAP Concur account sign in. For example, you first enter your password and, when prompted, you also type a dynamically generated verification code provided by an authenticator app or sent to your phone.

This Setup Guide is divided into 4 sections:

Enrollment
Trouble with Scanning QR Code
Reset 2FA

Section 1: Enrollment

If you are using an SAP Concur username and password to login into concursolutions.com for your account via Web or Concur Mobile- you are required to enroll in 2FA. This is applicable to both Production and Test accounts. Each account will have a unique 2FA associated. Therefore, if you use multiple different Concur accounts to login using username/password- you are required to set up 2FA for all these accounts.
Enter your username and password as usual
After you enter your password, you will get a new screen with a QR code presented

Download an authenticator app of your choice in your mobile phone. You can use a corporate phone or also use your personal device. You are free to use any authenticator app- like Microsoft , Google, etc. Eg : https://support.microsoft.com/en-us/account-billing/add-non-microsoft-accounts-to-the-microsoft-authenticator-app-7a92b5d4-d6e5-4474-9ac6-be0b6773f574, https://apps.apple.com/us/app/google-authenticator/id388497605, https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en_US&gl=US. You generally go into the App Store or Play Store and search/download the authenticator app you wish to use.

Or, you can choose from the following list:
Twilio Authy Authenticator, Duo Mobile, Microsoft Authenticator, Google Authenticator

If you do not have a phone or do not want to download an authenticator app to your mobile phone, you can also use authenticator apps on your browser. For example: For Google Chrome, https://chrome.google.com/webstore/detail/authenticator/bhghoamapcdpbohphigoooaddinpkbai. For Microsoft Edge, https://microsoftedge.microsoft.com/addons/detail/authenticator-2fa-client/ocglkepbibnalbgmbachknglpdipeoio

To better understand how your browser will scan the QR code, please reference this YouTube video of how web browser authenticator works https://www.youtube.com/watch?v=x14KazisIAQ

Click on ' Add account' or '+' sign or whatever button is available in the authenticator app for you to add a new account
Once the QR code scanner starts on the app, scan the QR code shown on the Concur sign in page. This will add your Concur account to the authenticator app.
Once this is done, For example purpose- if your account username is hubadmin@concur.com- right below this account on the authenticator app- a 6-digit code will be generated
Before the 6-digit code expires- please copy that code into the ' Authentication Code' field on the Concur sign in page and hit Sign In
You are now successfully logged in.

Section 2: Having trouble with scanning QR code?

If you are unable to scan the QR code, you can manually add your account. Click on the ' Set up manually with a key'
Once you click, a secret key should be visible on your screen
Now, go into your authenticator app on your phone or web. Based upon what authenticator app you are using- there should be an option like ' Enter a setup key' for example in Google Authenticator or if you are using MSFT Authenticator - Click on ' Add account' → Other account→ ' Enter code manually'.
There will be two fields visible on the Authenticator app- account and secret key. In the account- add your Concur account username shown on your Concur screen . For e.g.: hubadmin@concur.com and in secret key enter the secret key shown on the Concur page- for e.g.: 100 000 000.
Once the account is added, beneath the Concur account in your authenticator app, a 6-digit code will be generated.
Before the code expires, enter the code into the ' Authenticator Code' field on your Concur screen.

Section 3: Reset 2FA.

Do you have a new device and need to reset MFA? Did you lose your device and want to reset your 2FA? Do you want to switch your Authenticator app and use a different one?

Prerequisite: You have already enrolled in 2FA before

In your Authenticator, remove any existing listings that appears as : SAP Concur : because you will be creating a new one
Enter your username and password.
You will be now prompted for a 6-digit authentication code
If you need to reset your 2FA for your new device OR you lost your phone and need to enroll in 2FA again for your new device OR you wish to switch to a different Authenticator App, click on ' Unable to enter authentication code'.
You will now receive an email with a link to reset 2FA. Please note : This email will be sent to the email1 or email2 set up in your Profile settings
To check whether your email is updated in Profile . You need to login to Concur - Profile- Profile Settings- Personal Information-Email addresses.
If you did not update email1 in Profile and are locked out, please contact the Admin of your company and ask them to update the email for you and then once they update- click on ' Unable to enter authentication code' to trigger the email one more time.
If you receive an email, you will receive a link in the email to reset 2FA. Click on the link and you will receive the QR code. Follow the same steps provided in the 2FA Enrollment section to set up 2FA