Expensify Security: Configure SSO, workspace roles, approvals and card controls

Expensify holds who can spend on company cards, who approves reimbursements and which bank account pays them, so its domain, workspace and card settings are financial controls as much as IT settings. Expensify runs the service, and the customer decides how people sign in, who holds each workspace role, how reports route for approval, what Expensify Cards can buy and which integrations and AI agents act on the account. This guide covers those customer-side settings in New Expensify, with notes where a task still happens in Expensify Classic: domains and SAML single sign-on, two-factor authentication, workspace roles, approval workflows, Expensify Card limits and Spend rules, business bank accounts, API credentials and company agents. It is written for Expensify domain and workspace admins, finance systems owners and the security teams who review them. Several features depend on the plan (Collect or Control), so confirm what your workspace shows.

This is an independent guide from NHI Mgmt Group, based on Expensify's public documentation as of November 2026. It is not sponsored or reviewed by Expensify. Product features change, so confirm settings against Expensify's current documentation.

Key takeaways

• Verify the domain, then require SAML. SAML SSO needs a verified domain and a Domain Admin; once testing passes, turn on Required for login so members with company email sign in only through your identity provider.
• Require two-factor authentication for the domain. Domain Admins can require 2FA for all domain members; it uses an authenticator app (TOTP), and Domain Admins with 2FA can reset a member who loses their device.
• Use the scoped admin roles. On Control workspaces, Card admin, People admin and Payments admin split card, membership and bank duties so fewer people need full Workspace admin.
• Close the approval gaps. Set an approver for every member, add an additional approver above a report amount, and set the auto-approve threshold and random audit percentage deliberately.
• Treat API credentials and company agents as identities. The partnerUserID and partnerUserSecret pair and every AI agent's account need an owner, the least role that works and a review date.

How identity and access work in Expensify

Expensify has two layers of control. A domain (your company email domain, claimed and verified) governs how members sign in and which rules apply to them. A workspace governs expenses: roles, approval workflows, cards, accounting connections and payments. A person can belong to several workspaces with a different role in each.

Domains and Domain Admins

Domain Admins manage domain settings: verifying ownership, managing domain members and configuring security such as SAML. Only Domain Admins can invite, remove, deactivate or promote domain members, and they close a leaver's account from Domain Members with Close account (a closed account can be reopened by reinviting the member). Expensify's documentation notes that a Domain Admin does not need a company email address, and that members can request Domain Admin access, which an existing Domain Admin approves or denies. Review those requests carefully: approving one hands over the domain's security settings.

Domain groups (domain security groups) apply different rules to different sets of members. Settings include Strictly enforce workspace rules, Restrict default login selection (members cannot move their login away from the company domain) and Restrict expense workspace creation/removal. Turning on the last two keeps company spending inside the workspaces you govern.

SAML single sign-on

SAML is configured under Workspaces, then the domain, then SAML, and only for verified domains. The sequence in Expensify's documentation:

1. Toggle SAML Login to Enabled.
2. Download Expensify's Service Provider metadata and load it into your identity provider. The standard Entity ID is https://expensify.com; a multi-domain setup uses https://expensify.com/yourdomain.com.
3. Paste your identity provider's metadata into the Identity Provider MetaData field.
4. Test both SP-initiated and IdP-initiated sign-in.
5. Enable Required for login so members sign in through SSO only.

SAML applies to all domain members whose email matches the verified domain, across every workspace they belong to. Members on a personal email must change to their company address to come under it. To change SAML settings safely, Expensify advises disabling Require SAML login first so members can still sign in if the change fails, then re-enabling it. For identity provider certificate renewals in Microsoft Entra ID, Expensify documents replacing the metadata in Expensify and testing an SSO sign-in. See the SAML Security Guide.

For leavers, Expensify documents Okta SCIM for deprovisioning: when a member is deactivated in Okta, they are logged out of Expensify immediately. SCIM API access is requested through Concierge. See the SCIM Provisioning Guide.

Two-factor authentication

Any member can turn on 2FA under Account, Security, and Domain Admins can require it for every domain member. Expensify's 2FA uses a time-based one-time password from an authenticator app; sign-in then takes the email security code plus the six-digit app code. Recovery codes are created at set-up and should be stored safely. A Domain Admin can reset a member's 2FA when the member uses a company email on the verified domain and the admin also has 2FA on (as of November 2026 this reset is done in Expensify Classic). Where SAML is required, MFA is enforced by your identity provider as well; requiring Expensify 2FA still protects admins and anyone outside the verified domain, such as an external bookkeeper. See the MFA Guide.

Admin roles and privileged access

Workspace roles decide who can change settings, approve, issue cards and pay. The table summarises the New Expensify roles as Expensify documents them.

Use the scoped roles to keep full Workspace admin small. Our suggested split:

• Workspace admin: two named owners in finance systems, not every manager.
• Card admin: the person who runs the card programme, separate from whoever approves card expenses.
• People admin: HR or finance operations for joiners, movers and approval chains.
• Payments admin: treasury, who own the bank account and authorised payer.
• Auditor: internal audit and reviewers, who need visibility without the power to approve.

Delegated access: Copilot and vacation delegates

Copilot lets a member grant another person access to their account without sharing credentials, with a chosen level of access, removable at any time. It suits executive assistants and bookkeepers. Because a full-access Copilot can act as the account owner, include Copilot grants in access reviews, especially on admin and approver accounts. For approvals during leave, use a vacation delegate instead of a Copilot. Segregation of duties still applies: see the Segregation of Duties Guide.

Approval workflows, cards and bank accounts

Approval workflows

Approvals are turned on under Workspaces, the workspace, Workflows, Approvals. When on, a default workflow is required, and every report must be approved by each person in the submitter's workflow before it can be paid. Workspace admins and People admins configure workflows. Expensify documents:

• Default workflow: applies to Everyone, with a first approver (Collect and Control).
• Over-limit approval: a Report amount above which an Additional approver is required, added on top of the existing approver.
• Custom workflows: per member, on the Control plan.
• Reassignment: when an approver is changed or removed, outstanding reports move to the new approver (or the workspace owner) and a system message records it in the report.
• Auto-approve compliant reports: Concierge can approve reports under a threshold with no violations; Random report audit routes a percentage of compliant reports to manual approval. On Collect plans the documented values are a $100 auto-approval threshold and 0 percent random audit.

In Expensify Classic Advanced Approvals, if a member's Approves to field is empty, any Auditor or Workspace Admin can approve their reports. Set an approver for everyone so routing is explicit.

Expensify Card limits and Spend rules

Workspace admins and Card admins issue cards and choose a limit type for each:

Spend rules approve or decline card transactions in real time, before authorisation. Default protections apply to every card first and automatically decline blocked merchant category codes; they cannot be edited or overridden. A Spend rule then adds any of: Permitted currencies, a Max amount per transaction, and Restrict merchants set to Off, Allow (only listed merchants or merchant types) or Block. Workspace Rules must be enabled to create Spend rules. Allow lists suit travel-only, subscription and vendor-specific cards. Admins can freeze and unfreeze cards without reissuing them, and deactivate cards for leavers.

Business bank accounts

Workspace admins and Payments admins manage business bank accounts and the authorised expense payer. A verified business bank account that supports withdrawals can be shared with other Workspace admins and Payments admins, only on workspaces where the sharer is also an admin. Keep sharing to the treasury group and review the list of people each account is shared with. Employee reimbursement accounts are connected by each member, so strong sign-in (SAML required plus 2FA) is what stops an attacker redirecting reimbursements by taking over an account; see the Payroll Diversion Fraud Guide for the same pattern in payroll.

Integrations, API tokens and service accounts

Expensify connects to accounting, HR and internal systems through connections and through its Integration Server API.

• API credentials: the Integration Server uses a partnerUserID and partnerUserSecret generated at expensify.com/tools/integrations. The secret is shown once, so store it in a vault straight away. Expensify's help article says never to share the partnerUserSecret, including with Concierge, and to rotate it immediately if it has been shared.
• Run the API as a dedicated account: some jobs (reconciliation, creator and policy updater) require domain or policy admin rights. Generate credentials on a dedicated integration account with only the rights its jobs need, not on a person's admin account. Our suggestion: rotate the secret annually and whenever someone with access leaves.
• Expense Creator on behalf of users: Expensify verifies the setup (Domain Control, Domain Admin, Policy Admin) and your internal authorisation before granting it. Keep the approval on record.
• OAuth for multi-user integrations: as of November 2026 an OAuth2 option is in private beta; Expensify's docs say to keep the client_secret server-side, and generating a new one invalidates the old.
• Rate limits: 5 requests every 10 seconds and 20 every 60 seconds, returning HTTP 429 beyond that. Sudden 429s from an integration you did not change are worth investigating.
• HR integrations: when a connection such as Gusto or TriNet manages approval workflows, change them through the connection's Configure page, and include that connection in reviews.

AI agents

New Expensify supports AI agents with their own Expensify accounts. A personal agent is added as a full-access Copilot on its creator's account. A company agent belongs to a workspace or domain; Workspace admin is the default role, and Expensify advises choosing the role with the least access the agent needs. Every admin of the owning workspace or domain automatically gets full Copilot access to a company agent's account. Treat each agent as a non-human identity: give it the narrowest role, record its owner and purpose, and review agents with other accounts. See NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments and the API Key Management Guide.

Logging and detection

Use the records Expensify keeps plus your identity provider's logs:

• Identity provider sign-ins: with SAML required, every member sign-in passes through your IdP, so its logs are the primary sign-in record. Alert on new devices for Domain and Workspace admins.
• Report history: approver reassignments leave a system message in each affected report; review reassignments that bypass the usual approver.
• Card exports: the card list downloads as CSV with email, name, last four digits, type, limit type and limit amount. Diff it monthly to catch raised limits and unexpected new cards.
• Member and role exports: filter Members by role (Workspace Admins, Card Admins, Payments admins and so on) and compare with last month.
• Integration Server exports: use the API to export report and expense data into your SIEM or finance analytics, and watch for 429 spikes.

See the SIEM Log Source Onboarding Checklist.

Hardening baseline

The steps below are NHI Mgmt Group recommendations, built on the vendor settings described above.

1. Claim and verify the domain and review the Domain Admin list, removing anyone who does not need it.
2. Set up SAML with SP-initiated and IdP-initiated tests on a pilot group, then turn on Required for login. Roll back by disabling Require SAML login.
3. Require 2FA for the domain and confirm every Domain Admin has it, since admin resets depend on it.
4. Turn on domain group restrictions: Restrict default login selection and Restrict expense workspace creation/removal.
5. Re-map roles: move card, membership and payment duties into Card admin, People admin and Payments admin where your plan offers them.
6. Fix approval workflows: explicit approvers for everyone, an additional approver above a report amount, and a deliberate auto-approve threshold with a random audit percentage above zero (ours: start at 10 percent).
7. Apply Spend rules to card groups, starting with Allow lists for single-purpose cards and a Max amount for all.
8. Move API secrets into a vault, on a dedicated integration account, with owners and rotation dates.
9. Review agents and Copilots quarterly, reducing company agents from the default Workspace admin role where a narrower one works.

Common misconfigurations

• SAML on but not required: members can still use email sign-in, bypassing your IdP's MFA and leaver controls. Turn on Required for login after testing.
• Admin requests approved casually: a request for Domain Admin access gives control of security settings. Verify the person out of band first.
• Empty Approves to fields: in Classic Advanced Approvals any Auditor or Workspace Admin can then approve. Set explicit approvers.
• High auto-approve threshold with no audit: compliant but fraudulent reports flow straight through. Keep a random audit percentage.
• Company agents left as Workspace admin: the default role is broad. Choose the least role the agent needs.
• API secret on a person's account: it stops working or lingers when they leave. Use a dedicated integration account and rotate on staff change.

Framework mapping

Practitioner checklist

• Domain verified; Domain Admin list reviewed and minimal.
• SAML Login enabled and Required for login on, tested both ways.
• 2FA required for domain members; every Domain Admin has 2FA.
• Restrict default login selection and Restrict expense workspace creation/removal on.
• Card admin, People admin and Payments admin used instead of extra Workspace admins.
• Every member has an explicit approver and an additional approver above your report amount.
• Auto-approve threshold set deliberately, random report audit above zero.
• Spend rules with Max amount on all cards and Allow lists on single-purpose cards.
• partnerUserSecret in a vault on a dedicated account, with owner and rotation date.
• Company agents and Copilots reviewed quarterly with least-access roles.

Standards and references

• Expensify: Set Up SAML Single Sign-On (SSO)
• Expensify: Two-Factor Authentication (2FA)
• Expensify: Managing Workspace Members
• Expensify: Add Approvals
• Expensify: Expensify Card Spend Rules
• Expensify: Create and Manage Company Agents
• Expensify: Integration Server Manual
• NIST: SP 800-53 Rev 5 Security and Privacy Controls

Related NHI Mgmt Group resources: SaaS Security Guide · SAML Security Guide · Segregation of Duties Guide · Business Email Compromise Awareness for Finance Teams Guide