MFA not working

[cmlarington]

I have users who try scanning the QR code when setting up MFA on their Concur accounts but are not able to scan the code.  They are both using iPhone 17 and the Microsoft Authenticator for this.  Is anyone else having this problem?

[cjmarimo]

Hello @cmlarington ,

Possible Causes and Solutions

1. Use the Manual Setup Option Instead of the QR Code

SAP Concur's official documentation states that if a user is unable to scan the QR code during the 2FA/MFA enrollment process, they can use the "Set up manually with a key" option and enter the key manually into Microsoft Authenticator.

Steps:

1. On the Concur MFA setup screen, select Set up manually with a key.

2. Copy the provided key.

3. In Microsoft Authenticator:

      Add Account

      Other Account

     Enter code manually

4. Enter the key and use the generated 6-digit authentication code.

(Reference: Enrollment Process without Email Requirement Using a Manual Key | SAP Help Portal)

1. Reset the MFA Enrollment

If the users had previously configured MFA or have recently changed devices, it may be necessary to perform a 2FA Reset:

User-Initiated Reset performed by the user. (Reference: User-initiated Reset for 2FA | SAP Help Portal)

Administrator Reset performed by a Concur Administrator. (Reference: User-initiated Reset for 2FA | SAP Help Portal)

1. Verify Microsoft Authenticator

1. The following troubleshooting steps may help:

2. Update Microsoft Authenticator to the latest version.

3. Restart the phone.

4. Remove the SAP Concur account from Microsoft Authenticator.

5. Complete the MFA enrollment process again from the beginning.

[cmlarington]

None of these things worked.  My users can't scan the QR code at all.  Entering the code manually doesn't seem to work as there is no where to enter the key in Microsoft authenticator.  It just shows Code and URL.  Not sure how that is supposed to work.

[KevinD]

@cmlarington and @ash_tree have you considered allowing users to use the Email option for signing in? It doesn't require MFA. Just a thought and might be less of a hassle. After entering their username on the Sign in screen and click Next, they can choose to Sign in from an Email link rather than a password. 

Not sure if you considered this or not. 

[ash_tree]

Same here. Can't scan the QR code. Not working on employee's phone or my phone either.  HELP!

[KevinD]

@ash_tree from our knowledge base it says that the user must have signed in on the web version of SAP Concur using Password + 2FA or via SSO. Are your users employing one of these two methods to sign in on the web?

[ash_tree]

Both new iphone 17's. I discovered that the QR code was too small on the computer screen, so by enlarging it just a bit, the authenticator app was able to read it. Problem solved! 

[cmlarington]

Thanks @ash_tree I'll give that one a try as well if this issue comes up again.  🙂

[ash_tree]

Hi Kevin! Yes, we do that when using Concur website, but this is so we can log in on the mobile app.  

[cmlarington]

I have found that the people having the most trouble are those with the newest iPhones.  One person was able to scan if they moved way far away from the screen.  One was able to scan with a different computer that had a different screen.  One couldn't do either of these and I was able to have him scan with just his camera app and the link took him to the passwords app already on the iPhone.  Same problem, same phones, 3 different solutions.  Super annoying.