Hi all. I am back again to wrap up the final post in the six-part series made by actual Technical Consultants working at SAP Concur on Concur’ s new Identity and User Provisioning webservices. In this last post, we will address best practices and tips and tricks for using the new services.
Concur’ s User Provisioning Service and Identity APIs provide powerful capabilities for managing user accounts and access within the Concur platform. However, there are a few things to keep in mind that can help ensure you have a smooth integration and maximize the benefits of these APIs.
1. Plan Your Integration Strategy:
Create a clear integration plan that aligns with your company’s requirements. Determine the scope of the integration, such as which user fields or access roles should be maintained by the interface before coding a solution.
Spend some time clarifying the use cases with your business team that you will maintain with UPS and Identity and plan in advance where you will get the data. Many of the fields within Concur are best left to a system administrator or the employee themselves to maintain. It is also best to only populate the data that you really need. There are many more fields available in Identity and UPS than what is actually needed in Concur. If you are having difficulty determining the correct field to use, please reach out to a Technical Consultant for help.
Once you have identified the fields that you want to maintain, I recommend that you spend time mapping those fields into their corresponding extension sets so that you will know where everything needs to go in advance. As mentioned in a previous post, Concur has created a mapping guide for customers that are converting from existing flat files or upgrading to the new API’s from a previous version. These can really help. Here is a link to those guides.
Mapping guides between flat file types and APIs
2. Understand the APIs:
Before diving into implementation, take the time to thoroughly understand the functionality and capabilities of Concur’ s User Provisioning Service and Identity APIs. Familiarize yourself with the documentation, including all of the different calling methods, endpoints, request/response formats, and authentication mechanisms.
It is best to know upfront what you are getting into. If you have any questions about authenticating, a Concur Technical consultant can help you get connected quickly. The previous posts in this series highlight the high-level concepts about how the services function. The next step is to decide what types of calls you will make. A recommended best practice is to create your users with Identity and then layer your data from Spend and Travel on top of it.
You will want to use a “Post” call to create a new user and we recommend that you use a “Patch” call to make your updates throughout the year. Don’t use the “Delete” operation, inactivate your users instead and save the “Put” operation for a reorganization where you need to reset and reorganize all fields for a given user.
Also, despite the name, “bulk” updates are not necessarily a faster way of making your user updates because it can be more difficult to page through the update results to find errors. The “Users” update is almost as fast as bulk and makes troubleshooting much easier.
Finally, we recommend that you store a Concur user’s UUID after successfully creating a user in the system. This will allow you to a) determine that the user has already been created in Concur and b) quickly and easily patch only the fields that need to be updated minimizing processing time while also leaving everything else that does not need to be updated untouched.
3. Consider the Timing and Frequency:
Consider the timing and frequency of data synchronization and the potential impact on user experience. A well-thought-out integration strategy will ensure a seamless user provisioning process.
By all means take advantage of the real time nature of the API updates, but consider the entire end to end flow and all of the systems that need to be updated in-between before making your updates in Concur. For example, if your HR system updates a 10 AM each day, but your financial system does not get updated until Noon, it may be best to wait until 1 PM to send data to Concur in order to avoid any unnecessary errors due a temporary delay in synchronizing master data between all of your systems.
4. Handle Errors and Exceptions:
Develop robust error handling mechanisms to handle exceptions and errors that may occur during the integration process. Implement appropriate error logging and notification mechanisms to ensure timely identification and resolution of any issues.
When making updates to Spend or Travel data it is critical to capture and check the provisioning id of the updates that you made. This will allow you to see the specific errors that have occurred in each update request. In addition, it is important to know that more than one error may be identified in the update request you make so your logging mechanism should attempt to capture as many error messages as possible in your logs to avoid having to make multiple update attempts.
5. Monitor and Maintain Integration:
Regularly monitor the integration to ensure its smooth operation. Implement monitoring mechanisms to identify possible reoccurring issues, track API usage, and performance metrics. Set up alerts and notifications to promptly identify and address issues.
Consider implementing a periodic data validation check to ensure that the data that you care about between systems is staying in sync. Also, if the same type of error message is received for many different users, it could indicate that something in the processing chain has failed or changed and an adjustment is needed. Be sure to have a process in place to identify and get notified if a spike in errors occurs.
6. Stay Up-to-Date with API Changes:
APIs evolve over time, and Concur's Identity and User Provisioning Service APIs are no exception. Stay informed about API updates, including new features, deprecations, and version changes.
As stated at the beginning of this series, you can expect SAP Concur to continue to expand the functionality available with Identity and UPS until we have reached near parity with everything that is possible with flat file integrations. In addition, new functionality that is only available through the new APIs is likely. Remember to keep checking in on our monthly release notes to get the latest updates on what is coming up.
Ok, this completes today’s post and wraps up the final post in our six-part series. While the series is complete, I am sure that we will come up with new and interesting topics related to Identity and User Provisioning Services at Concur in the future so please continue to look for updates from us. You can find all posts made by Technical Consultants at Concur by looking at the user tag ‘
SAP Concur Technical Consulting’.
Below are the links to the previous posts in this series. We really hope that they have helped you obtain a firm understanding of our new Identity and User Provisioning Services.
If you are getting serious about UPS and Identity now, also please be sure to check out our implementation guide and a sample postman collection located at the following link.
https://developer.concur.com/api-guides/user-provisioning/user-provisioning.html
