Skip to content

Integrating SailPoint with Coupa SaaS

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SailPoint Coupa SaaS connector provides governance capabilities for the users of the Coupa system. These capabilities include aggregation, user provisioning, and adding or removing entitlements at the account level. For more information, refer to Supported Features.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SailPoint Coupa SaaS connector supports the following features:

Account Management

  • Manage Coupa users
  • Aggregate and refresh accounts
  • Delta aggregation
  • Aggregate and update custom attributes
  • Account filters
  • Create, update, enable, and disable accounts
  • Add or remove entitlements
  • Manage an account's user groups, content groups, account groups, and approval group memberships as entitlements (string type; no specific entitlement type)

Entitlement Management

  • Manage Coupa roles
  • Refresh and aggregate entitlements

For more information on features, refer to Source Features.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

Privilege Level Description
High Administrative level access to accounts
Medium Administrative level access for a specific role or function
Low Only basic access of data

Note

To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to Managing Privilege Classification.

Prerequisites

  • You must have an OAuth 2.0 client registered with Coupa. For more information on registering the client, refer to Registering OAuth 2.0 Client.

Required Permissions

The following table lists the minimum requirements for scopes and their respective connector operations:

Connector Operation Scope
User - Read (Aggregation and Get Account) core.user.read
User - Write (Create, Update, Enable, Disable, Entitlement Assignment, and Removal) core.user.write
Roles - Read (Aggregation and Get Role) core.common.read

Registering OAuth 2.0 Client

To connect to the Coupa source, you must have an OAuth 2.0 client registered on Coupa.

To register the OAuth 2.0 client and generate a Client ID and Client Secret, complete the following:

  1. Sign in to Coupa as an Administrator or Integrations Administrator.
  2. Go to Setup > Oauth2/OpenID Connect Clients. In Setup, you can use the search box to search for oauth to find the proper entry.
  3. Select Create.
  4. For Grant Type, select Client Credentials and then enter a name for the Client, Login, Contact Info, and Contact Email.
  5. Select the scopes you want to include in this API setup. Scopes are like a set of permissions set on the API key. For more information on the required scopes, refer to Required Permissions.
  6. Select Save. Saving the client generates the Client ID and Client Secret values, which are needed to configure the Coupa connector.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.