two-factor authentication

[Catagomez1120]

How can I set up two-factor authentication? 

[kberwin]

All of our field users, who need to submit expense reports, only have one mobile device and due to the industry we're in, for security purposes, copy/paste is disabled. So, they can't scan the code because it's a single device and they can't copy and paste a 32 digit code. They can't log in. How do I turn this off for our users until we can get SSO configured?

[Littlered13]

We have not been able to get in either, the 6 digit code when we try each time does not work for any staff, myself and another lady who are admin - we do not use a company mobile phone so cannot use the QR code we only ever connect via Google internet. We thought this would not affect us. We are not sure what will happen for the users that have a company phone. I tried the uk phone number we found, we opted for a call back as your lines were getting a high volume of calls, no call back still. As others have said we need this sorting asap so people can process their expenses, as they have credit card bills to pay.

This does not seem to of been thought of very well and to roll out and nothing works is not good 

[nicksanghvi]

It seems like SAP Concur has implemented this two factor protocol without keeping many scenarios in mind. We have close to 4000 active guests, who cannot be added to SSO and these folks submit expenses on a as needed basis. Some of them are already confused with what authenticator works for them on the phone. I just tried as a guest user and I could not complete the process. Some people don't know much about the QR code business. Sometime employee leaves the company w/o any notice and they could have pending charges to submit. We can proxy in, but can not do missing receipt affidavit, if the receipt is not available. This change will have a huge impact to our guests and we may end up getting a lot of emails and calls. A huge change management battle for us. We may have to hire a person to prepare expense reports for hundreds of guests. 

The simple solution would have been, send a six digit code to the email on file, similar to how the banks are sending to phone or via email and be done. 

They should have added an opt out option, so if the companies do not have security concerns, they can opt out. Remember, this is an expense reimbursement system, where a lot of controls are already in place w/o this new PW protocol. This is not a bank account, where someone will hack and steal the money. Simply an unnecessary move. 

[rphelps]

Well said...reminds me of a former life implementation.  Stop All Processing was the inside joke.

[Littlered13]

OK so i dont have a work phone but i have had to download the google authentication app on my personal phone, i scanned the QR code and it let me in!! I dont really want to use my personal phone for the code option!!! But when you read the instructions and its says you dont have a mobile device or prefer not to use one you can use this google authentication via the web. This option is not working!!!! Alot of us want to use the web based authenticator option but this isn't working!!!

[EHillstead22]

Hello Melanie, 

It is nice to meet you. Is there a way to have the passcode sent via sms? Most of my users have had a successful interaction with the new security implementation. However, I do have a few users that do not have phones capable of downloading the app. I have also tried a few web extensions without success. 

What options are there for users that cannot download the app ?  Any and all insights you can share will be greatly appreciated! 🙂

[KNDY]

Greetings, 

I think the issue we are facing is of course, those with smartphones have access to an authenticator, may it be Duo, Google or Microsoft. 

But not all of our employees are issued with a smartphone.  And these certain employees are currently facing this issue (which becomes an issue for locations that can't afford to purchase employees a smartphone), nor will they provide a stipend just for Concur use and the suggest  Chrome extension is not approved by our security team. 

If anything, I wished Concur did take this into consideration beforehand.  But last we heard, it is going to include an e-mail option.  The question is how long from now will this be implemented?

[MelanieT]

@apereira @hsoh  Unfortunately you cannot have it turned off.  The only way to not have to use this is if your company uses SSO (Single Sign On). 

Remember to tag me if you respond or feel free to mark this post as Solved if you don't have further questions or comments. To tag me on your response, you click the Reply button, first thing to type is @. This should bring up the username of the person you are replying to.

[dnoblitt]

We have SSO and it is still trying to require us to use the Two-Factor Authentication

[khig]

@MelanieT Hi Melanie - I'm trying to set up 2FA for myself so I know how to instruct our employees to do the same. Is having an authenticator app the only option to set this up? Not everyone has a company phone (me included) and we'd rather not have to ask all users to download an app to scan the QR code. 

Additionally, does Concur already have written instructions for how to complete 2FA set up? If so, where can I find them?

[anraley]

@MelanieT We also have SSO and unsure how to make adjustments since it appears users have to verify their email address for 2FA to work properly. We are needing assistance and have questions about SSO and Okta, seeing which employees have verified their email address, and if there is any information for users with (SSO options like Okta). 

[salmontejo]

@MelanieT It would be easier if the authentication code was received via email or a text instead of going to an app to get the code. Please advise. Thank you, Sal

[dnoblitt]

We thought we had SSO but it is still requiring two factor authentication, which is not working for most of us.  When I try to set it up, that is failing as well.

[jillpras]

@MelanieT Hi there. I used my iphone camera to scan the qr code. My company wants us to use microsoft authenticator instead. I have requested the email to reset my 2FA 4 times and no email is coming. Our IT dept has made sure concur and sap are whitelisted. What can I do to reset the 2FA without an email link??

[ACCTALeeP]

Contact the SAP Concur admin for your company and ask them to reset your MFA. This will unlink the account and allow you to restart setup from the beginning.

[jillpras]

@ACCTALeeP @MelanieT  I AM the company administrator. I saw the screen shots showing how to reset 2FA. But when I go to authentication admin from the Home/Admin screen, I only see this: 

[ACCTALeeP]

What happens if you are signed in and then visit this URL? https://www.concursolutions.com/companyadmin/company_admin.asp

It should bring you to the Company Administration page. 

[jillpras]

@ACCTALeeP  I can't seem to get there from your link either. It takes me here. I am the administrator, but I am not the one that initially set up Concur for our company. That person no longer works here. I wonder if this is truly a case for support? Meaning my complaining employees are getting very angry with this wait.,,

[ACCTALeeP]

Yeah, it sounds like your admin rights are limited. If the original administrator no longer works there, I would contact support and have them transfer ownership to your account. 

Good luck!

[jillpras]

Thank you so much I will try that.

[ltboeck]

I am finding it's not working.  I tried to do it by "Set up manually with a key" and also use the copy and paste option since it give you that and it tells me the code I entered is incorrect.  I even tried to type it in manually and got the same error (which I was glad didn't work because who what's to TYPE 32 characters every time?).  Not everyone has a company phone (me included) and we'd rather not have to ask all users to download an app to scan the QR code.  I'm with the others on asking if we can turn this off.