Expense, Travel, Invoice, Request, Analysis/Intelligence: P1

Update timeline

1. resolved Aug 21, 2026, 12:16 AM UTC

   We are working to determine the user impact and will provide information as it becomes available.

2. resolved Aug 21, 2026, 12:42 AM UTC

   In the US2 Data Center, we have identified a service degradation impacting access to Concur services, including Expense, Travel Request, Travel, Invoice, and Analysis and Intelligence. This is impacting all customers. After logging in, users are encountering the following error: “You are currently not set up to use any Concur products. Contact your Concur Administrator for assistance.” Workaround: Unfortunately, no workaround is available during this period of impact. The Incident Response Team (IRT) is currently investigating. Our next scheduled update will be in one hour, or sooner should a significant change occur.

3. resolved Aug 21, 2026, 01:31 AM UTC

   In the US2 Data Center, we have identified a service degradation impacting access to Concur services, including Expense, Travel Request, Travel, Invoice, and Analysis and Intelligence. This is impacting all customers. After logging in, users are encountering the following error: “You are currently not set up to use any Concur products. Contact your Concur Administrator for assistance.” Workaround: Unfortunately, no workaround is available during this period of impact. The Incident Response Team (IRT) is working on reverting a recently deployed change to restore service. Our next scheduled update will be in one hour, or sooner should a significant change occur.

4. resolved Aug 21, 2026, 01:47 AM UTC

   In the US2 Data Center, we identified a service degradation impacting access to Concur services, including Expense, Travel Request, Travel, Invoice, and Analysis and Intelligence. All customers were impacted. After logging in, users encountered the following error: “You are currently not set up to use any Concur products. Contact your Concur Administrator for assistance.” Workaround: Unfortunately, no workaround was available during this period of impact. Services have returned to normal operating levels. We will continue monitoring performance for the next 15-30 minutes to verify stability. Once verified as stable the incident will be resolved.

5. resolved Aug 21, 2026, 02:01 AM UTC

   In the US2 Data Center, we identified a service degradation impacting access to Concur services, including Expense, Travel Request, Travel, Invoice, and Analysis and Intelligence. This is impacting all customers. After logging in, users encountered the following error: “You are currently not set up to use any Concur products. Contact your Concur Administrator for assistance.” Workaround: Unfortunately, no workaround was available during this period of impact. The Incident Response Team (IRT) reverted a recently deployed change which restored service. We have verified that service performance is stable and will now resolve this incident. An investigation into the root cause of this incident will now be conducted, and a root cause analysis report provided when that investigation is complete.

6. resolved Aug 31, 2026, 06:47 AM UTC

   Impact as reported: In the US2 Data Center, a service degradation impacted access to Concur services, including Expense, Travel Request, Travel, Invoice, and Analysis and Intelligence. After logging in, users are encountering the following error: “You are currently not set up to use any Concur products. Contact your Concur Administrator for assistance.” Users already logged in were not impacted. Corrective Actions: The following preventive and corrective actions were identified: Update service configuration to use only supported secret paths for startup validation and eliminate reliance on legacy validation mechanisms. Implement automated regression testing to verify that only approved secret locations are referenced by the application. Add validation checks to ensure application configuration changes are reviewed against secret-management and access-policy changes before deployment. Enhance change management procedures to identify and assess dependencies between application configurations and access-control modifications. Introduce proactive production monitoring and alerting for service startup failures, unavailable service instances, and repeated initialization errors. Establish direct availability alerts so operational teams are notified of service outages before downstream systems are affected. Validate secret-access configurations and application behavior in pre-production environments whenever secret-management policies or permissions are modified. Reduce single points of failure by ensuring that a denied request to a nonessential or legacy configuration path cannot prevent the entire service from starting. Maintain temporary access restoration procedures as a contingency measure during rollout of configuration-related fixes and remove temporary permissions once the permanent solution is confirmed in production. Root Cause: The incident occurred when all instances of a service invoked while initiating user sessions after log in were restarted during routine infrastructure activity and were unable to successfully start, resulting in a temporary service outage and downstream customer-facing errors. Although a legacy access permission had been removed earlier, the issue did not surface immediately because existing instances continued operating normally. The outage occurred only after all instances restarted and attempted to validate access using an outdated configuration path, which prevented them from becoming operational. The root cause was an unintended dependency on a legacy configuration path that remained active after a related access change. To permanently address the issue, the service configuration was updated to use a supported, actively used validation path and the legacy dependency was removed. As an interim measure, the required access was restored to ensure service stability while the permanent fix was implemented, tested, and deployed.

7. resolved Sep 16, 2026, 08:06 AM UTC

   Impact as reported: In the US2 Data Center, a service degradation impacted access to Concur services, including Expense, Travel Request, Travel, Invoice, and Analysis and Intelligence. After logging in, users are encountering the following error: “You are currently not set up to use any Concur products. Contact your Concur Administrator for assistance.” Users already logged in were not impacted. Root Cause: The incident occurred when all instances of a service invoked while initiating user sessions after log in were restarted during routine infrastructure activity and were unable to successfully start, resulting in a temporary service outage and downstream customer-facing errors. Although a legacy access permission had been removed earlier, the issue did not surface immediately because existing instances continued operating normally. The outage occurred only after all instances restarted and attempted to validate access using an outdated configuration path, which prevented them from becoming operational. The root cause was an unintended dependency on a legacy configuration path that remained active after a related access change. To permanently address the issue, the service configuration was updated to use a supported, actively used validation path and the legacy dependency was removed. As an interim measure, the required access was restored to ensure service stability while the permanent fix was implemented, tested, and deployed. Corrective Actions: The following preventive and corrective actions were identified: Update service configuration to use only supported secret paths for startup validation and eliminate reliance on legacy validation mechanisms. Implement automated regression testing to verify that only approved secret locations are referenced by the application. Add validation checks to ensure application configuration changes are reviewed against secret-management and access-policy changes before deployment. Enhance change management procedures to identify and assess dependencies between application configurations and access-control modifications. Introduce proactive production monitoring and alerting for service startup failures, unavailable service instances, and repeated initialization errors. Establish direct availability alerts so operational teams are notified of service outages before downstream systems are affected. Validate secret-access configurations and application behavior in pre-production environments whenever secret-management policies or permissions are modified. Reduce single points of failure by ensuring that a denied request to a nonessential or legacy configuration path cannot prevent the entire service from starting. Maintain temporary access restoration procedures as a contingency measure during rollout of configuration-related fixes and remove temporary permissions once the permanent solution is confirmed in production.