Two Factor authentications

[cmhazlett]

I have several team members who the codes are not working for them.   How do we trouble shoot so they can log in?   

[Amandalangton]

If you are unhappy with aspects of 2FA there are 2 improvement requests already submitted about this. Please vote for them, Improvement Request Details - 3105652FA should NOT be mandatory for Test users or Test sites - Request ID: 310565, and 

Options to authenticator app or browser extension for 2FA - Request ID: 310567 (Improvement Request Details - Request #310567)

[leela2516]

Sadly, the enhancement request was denied:

[MelanieT]

@cmhazlett Hello!  I am sorry for the issues your user's are having.  Here is guide that will be helpful for you and your users with 2FA. 

Remember to tag me if you respond or feel free to mark this post as Solved if you don't have further questions or comments. To tag me on your response, you click the Reply button, first thing to type is @. This should bring up the username of the person you are replying to.

[RSheehan]

I for one am really tired of being the "Concur" help desk since last Thursday.  NO ONE is able to get in with the instructions we were given.  The ONLY way I've been able to get our employees able to login is to have them download the Google Authenticator app.  Once they open that app there is an option to scan the QR code that is on the login screen of concur.  Google Authenticator then automatically creates an SA Concur account and creates a 6-digit code that they can use to log into Concur.  But now we have several employees who do not have mobile phones and cannot scan a QR code, so I'm stumped.

[mcnerney]

@RSheehan Hi, agree, this has been the main focus since 18 October. It will get better...till 15 November, when password requirements get enforced by SAP Concur! 😎

Employees who either don't want to download an authenticator app or do not have a mobile phone can use a browser extension authenticator (if your company allows this):

Chrome browser

https://chrome.google.com/webstore/detail/authenticator/bhghoamapcdpbohphigoooaddinpkbai

Microsoft Edge browser:

https://microsoftedge.microsoft.com/addons/detail/authenticator-2fa-client/ocglkepbibnalbgmbachknglp...

Note: you must have MS Edge installed for this extension link to work

@KevinD has posted before (Friday 20 Oct '23) the 3 options for users who don't want to or cannot install browser extensions or authenticator apps:

"if the users don't have a cell phone and don't want to use one and your IT department is putting the browser extension restriction, there are only three options:

1. IT may need to allow the browser extension.

2. Users might need to use a personal computer as 2FA requires either the browser extension or an Authenticator App since those will be needed to generate the 2FA code.

3. Your company could consider moving to Single Sign On.

This is what I was told from our 2FA team. 

Thank you,
Kevin Dorsey
SAP Concur Community Manager"

[mcnerney]

Please see Concur Influence Request 310701 2FA Trusted Device or Session 24-hour | 30 day setting and vote if you would like:

https://influence.sap.com/sap/ino/#/idea/310701/?section=sectionDetails

The Test Site idea has moved from Submitted to Acknowledged, which is encouraging:

https://influence.sap.com/sap/ino/#idea/310565 2FA should NOT be mandatory for Test users or Test sites

@Amandalangton 

Thanks!

[mcnerney]

@MeltemC  Thank you for reviewing the Concur Influence Requests! Please feel free to merge mine with existing if it makes more sense for Product Management. Thanks again.

310701 2FA Trusted Device or Session 24-hour | 30 day setting 

[mcnerney]

Some users say they are using an authenticator app, but they really aren't yet--this is a great first step to clear up/clarify with individual users, in my experience the past week.

Thanks!

[KevinD]

@cmhazlett when you say the code isn't working for them, are they getting an error? Are they able to get the account added in the authenticator app and have it generate the six-digit code? Is that the code that isn't working?

Be sure your users are not clicking the Manual Key option and trying to enter that where the six-digit generated code should go.

[cmhazlett]

Kevin

they follow the instructions and when they try and use the 6 digit code that is provided to them it does not work.  I have team members who do not want to use their personal phones and click can scan QR code and they get the code that way and none of the codes work for them.   just wondering what I need to tell them or how we can solve this. 

[mcnerney]

@cmhazlett Have you tried resetting MFA/2FA on the employee record? This solved a multitude of issues for our users, and allowed them to 'start fresh' when stuck in a seemingly infinite loop. You might want to ask if they have Concur set up in more than one authenticator app--this makes it so the authentication codes are rejected, in my experience. Thanks!

[dawnb]

How do I "reset" the MFA/2FA on the employee record?  

[mcnerney]

Hi @dawnb In Concur Professional it is on the employee record:

I am not sure about Concur Standard, but I bet one of the moderators here will know!

[DeanR]

Instructions for Standard Edition, from the User Guide:

[dawnb]

thank you, I don't see that when I look at the User Details...  I'm the Admin for the account... hmmm, very strange.  I will submit a help desk ticket. 

[mcnerney]

---

@DeanR wrote:

Instructions for Standard Edition, from the User Guide:

---

@Sunstar_Ins Please see DeanR's reply above; thanks!

[Sunstar_Ins]

Thank you so much for posting this, @mcnerney.  I do not see an MFA Reset section on our user's account page.  @KevinD can you give guidance?  I am going to Admin>Expense Settings>User Accounts>Manage Users.  I access the individual I want to reset, but do not see an MFA Reset section.  Am I in the wrong place?

[KevinD]

@Sunstar_Ins I'm looking into this as I don't see the Reset option in your site either. Stay tuned. 

[KevinD]

@Sunstar_Ins and @dawnb users can do the 2FA reset themselves. They just need a valid email that they have access to listed on their profile. See my screenshot below. It discusses the steps. This is straight from the Setup Guide.

[Sunstar_Ins]

Thank you so much @KevinD!