# Integrating SailPoint with Coupa

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SailPoint Coupa connector provides governance capabilities for the users of the Coupa system. These capabilities include aggregation, user provisioning, and adding or removing entitlements at the account level. For more information, refer to [Supported Features](<#supported-features>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SailPoint Coupa connector supports the following features:

#### Account Management

- Manage Coupa users
- Aggregate and refresh accounts
- Delta aggregation
- Aggregate and update custom attributes
- Account filters
- Create, update, enable, and disable accounts
- Add or remove entitlements
- Manage an account's user groups, content groups, account groups, and approval group memberships as entitlements (string type; no specific entitlement type)

#### Entitlement Management

- Manage Coupa roles
- Refresh and aggregate entitlements

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

## Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

## Prerequisites

- You must have an OAuth 2.0 client registered with Coupa. For more information on registering the client, refer to [Registering OAuth 2.0 Client](<#registering-oauth-20-client>).
- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).

## Required Permissions

The following table lists the minimum requirements for scopes and their respective connector operations:

| Connector Operation | Scope |
| --- | --- |
| User - Read (Aggregation and Get Account) | core.user.read |
| User - Write (Create, Update, Enable, Disable, Entitlement Assignment, and Removal) | core.user.write |
| Roles - Read (Aggregation and Get Role) | core.common.read |

## Registering OAuth 2.0 Client

To connect to the Coupa source, you must have an OAuth 2.0 client registered on Coupa.

To register the OAuth 2.0 client and generate a Client ID and Client Secret, complete the following:

1. Sign in to Coupa as an Administrator or Integrations Administrator.
2. Go to **Setup \> Oauth2/OpenID Connect Clients**. In Setup, you can use the search box to search for `oauth` to find the proper entry.
3. Select **Create**.
4. For **Grant Type**, select **Client Credentials** and then enter a name for the **Client**, **Login**, **Contact Info**, and **Contact Email**.
5. Select the scopes you want to include in this API setup. Scopes are like a set of permissions set on the API key. For more information on the required scopes, refer to [Required Permissions](<#required-permissions>).
6. Select **Save**. Saving the client generates the Client ID and Client Secret values, which are needed to configure the Coupa connector.