Integrating SailPoint with Coupa

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SailPoint Coupa connector provides governance capabilities for the users of the Coupa system. These capabilities include aggregation, user provisioning, and adding or removing entitlements at the account level. For more information, refer to Supported Features.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SailPoint Coupa connector supports the following features:

Account Management

Manage Coupa users
Aggregate and refresh accounts
Delta aggregation
Aggregate and update custom attributes
Account filters
Create, update, enable, and disable accounts
Add or remove entitlements
Manage an account's user groups, content groups, account groups, and approval group memberships as entitlements (string type; no specific entitlement type)

Entitlement Management

Manage Coupa roles
Refresh and aggregate entitlements

For more information on features, refer to Source Features.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

Privilege Level	Description
High	Administrative level access to accounts
Medium	Administrative level access for a specific role or function
Low	Only basic access of data

Note

To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to Managing Privilege Classification.

Prerequisites

You must have an OAuth 2.0 client registered with Coupa. For more information on registering the client, refer to Registering OAuth 2.0 Client.
Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the Virtual Appliance Reference Guide.

Required Permissions

The following table lists the minimum requirements for scopes and their respective connector operations:

Connector Operation	Scope
User - Read (Aggregation and Get Account)	core.user.read
User - Write (Create, Update, Enable, Disable, Entitlement Assignment, and Removal)	core.user.write
Roles - Read (Aggregation and Get Role)	core.common.read

Registering OAuth 2.0 Client

To connect to the Coupa source, you must have an OAuth 2.0 client registered on Coupa.

To register the OAuth 2.0 client and generate a Client ID and Client Secret, complete the following:

Sign in to Coupa as an Administrator or Integrations Administrator.
Go to Setup > Oauth2/OpenID Connect Clients. In Setup, you can use the search box to search for oauth to find the proper entry.
Select Create.
For Grant Type, select Client Credentials and then enter a name for the Client, Login, Contact Info, and Contact Email.
Select the scopes you want to include in this API setup. Scopes are like a set of permissions set on the API key. For more information on the required scopes, refer to Required Permissions.
Select Save. Saving the client generates the Client ID and Client Secret values, which are needed to configure the Coupa connector.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.