---
title: User management
description: The Concur Provisioner synchronizes users from your datastore to Concur. The following describes the behavior of each provisioning capability.
component: concur
page_id: concur::pf_concur_connector_user_management
canonical_url: https://docs.pingidentity.com/integrations/concur/pf_concur_connector_user_management.html
revdate: June 26, 2024
section_ids:
  synchronizing-existing-users: Synchronizing existing users
  user-provisioning: User provisioning
  user-updates: User updates
  user-deprovisioning: User deprovisioning
---

# User management

The Concur Provisioner synchronizes users from your datastore to Concur. The following describes the behavior of each provisioning capability.

|   |                                                                                                                                                                                                                  |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | You can configure the following capabilities and specify which users to provision when you get to the [Configure provisioning](setup/pf_concur_connector_configure_provisioning.html) part of the setup process. |

## Synchronizing existing users

PingFederate synchronizes users based on the `empId` attribute in Concur. If a user already exists in your datastore and Concur, mapping this attribute correctly links the two records together.

For example:

* In Concur, Janet's `empId` is `123abc`.

* In your datastore, Janet's `employeeID` is `123abc`.

* On the **Attribute Mapping** tab of your provisioning connection configuration, map the `empId` attribute to `employeeID`.

* When the provisioning connector runs, the datastore user is provisioned with a `empId` of `123abc`. That matches Janet's existing `empId` in Concur, so her information in the datastore is synchronized to her Concur account.

## User provisioning

PingFederate provisions users when any of the following happens:

* A user is added to the datastore group or filter that is targeted by the provisioning connector.

* A user with `disabled` status is added to the datastore group or filter that is targeted by the provisioning connector, and the **Provision disabled users** provisioning option is enabled. This feature is not available in all provisioning connectors.

|   |                                                                                                                                                |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------- |
|   | You can define which users PingFederate targets for provisioning on the **Source Location** tab of your provisioning connection configuration. |

## User updates

PingFederate updates users when a user attribute changes in your datastore.

|   |                                                                                                                                                   |
| - | ------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | You can define which attributes PingFederate monitors for changes on the **Attribute Mapping** tab of your provisioning connection configuration. |

## User deprovisioning

PingFederate deprovisions users when any of the following happens:

* A user is deleted from the user store.

* A user is disabled in the user store.

* A user is removed from the datastore group or filter that is targeted by the provisioning connector.