Concur Invoice Standard Edition Administration Help

April 2021 Request Standard Edition Admin Summary

Initial Post

Release Note Summaries

The items in this section are summaries of the release notes for this month. The Standard Edition release notes are accessible from What's New - Standard Edition

Authentication

**Ongoing** Deprecation of HMAC and Migration to SAML v2 and the SSO Self-Service Tool

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

SAP Concur support for Hash-Based Message Authentication Code (HMAC) is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel are currently assisting customers who use HMAC to migrate to SAP Concur SAML v2 SSO (SAML v2).

SAP Concur provides a Single Sign-On self-service option that enables client admins to setup their SAML v2 connections without involving an SAP Concur support representative.

For more information about the Single Sign-On self-service option, refer to the Shared: Single Sign-On Overview (English Only) and the Shared: Single Sign-On Setup Guide (English Only).

The HMAC deprecation includes two phases:

PHASE I:

  • Clients must have an identity provider (IdP) or a custom SAML 2.0 compliant solution.

  • Clients begin testing authentication using SAML v2.

  • TMCs prepare to onboard new SAP Concur clients to SAML v2.

  • Customers will be notified via release notes about the official deprecation date of HMAC. As of the official deprecation date, no new clients can be onboarded using HMAC; new clients must be onboarded to SAML v2.

  • Existing clients using HMAC must migrate to SAML v2.

PHASE II:

  • TMCs have migrated all existing SAP Concur clients from the HMAC service to SAML v2.

  • The HMAC service is deprecated. Phase II is targeted to end mid-year in 2021.

Business Purpose / Client Benefit: This change provides better security and improved support for users logging in to SAP Concur products and services.

View Previous Changes Added to Manage Single Sign-On Page (March 23)

On March 23, 2021, the View Previous Changes feature was added to the Administration > Company > Authentication Admin > Manage Single Sign-On page. This feature enables the Authentication Admin to view a table that lists SAP Concur Single Sign-On (SSO) configuration changes, view details about those changes, and revert (reinstate) deleted configurations.

The View Previous Changes table can display the last 100 changes. Changes that are listed in the table include:

  • Adding a configuration

  • Deleting a configuration

  • Editing the name in the Custom IdP Name field

  • Editing the URL in the Logout URL field

Business Purpose / Client Benefit: This change enables the Authentication Admin to view and track changes made to the SSO configuration over time and to revert (reinstate) configurations that were previously deleted.

File Transfer Updates

**Ongoing** Mandatory SFTP with SSH Key Authentication

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and vendors participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of April 10, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

  • Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.

  • SFTP file transfer accounts that use password authentication must switch to SSH key authentication.

  • SFTP password reset requests require the client to provide an SSH key for authentication.

On April 12, 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

  • st.concursolutions.com

  • st-eu.concursolutions.com

  • vs.concursolutions.com

  • vs.concurcdc.cn

Business Purpose / Client Benefit: These changes provide greater security for file transfers.

**Ongoing** SAP Concur Legacy File Move Migration

This release note is intended for the technical staff responsible for file transmissions with SAP Concur. For our customers and vendors participating in data exchange, SAP Concur is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and July 31, 2021. After they are migrated to the more efficient process, clients will see the following improvement:

  • With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

  • st.concursolutions.com

Business Purpose / Client Benefit: These changes provide greater security and efficiency for file transfers.

Rotating PGP Key Available for File Transfers

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

concursolutionsrotate.asc

  • Key file is available in client’s root folder

  • Key ID 40AC5D35

  • RSA 4096-bit signing and encryption subkey

  • Key expires every 2 years

  • Client is responsible for replacing the key before it expires

    • Next expiry date: September 4, 2022

    • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday, January 15, 2021.

This announcement pertains to the following file transfer DNS endpoints:

  • st.concursolutions.com

  • mft-us.concursolutions.com

  • vs.concursolutions.com

  • st-eu.concursolutions.com

  • mft-eu.concursolutions.com

Business Purpose / Client Benefit: The rotating public PGP key provides greater security for file transfers.

NextGen UI for Concur Request

**Ongoing** Updated User Interface (UI) for Concur Request End Users

The continued evolution of the Concur Request solution user interface experience is the result of thoughtful design and research that provides a modern, intuitive, and streamlined experience for the request process.

Concur Request customers will have the ability to preview and then opt in to the NextGen UI before the mandatory move.

Business Purpose / Client Benefit: The result is the next generation of the Concur Request user interface designed to provide a modern, consistent, and streamlined user experience. This technology not only provides an enhanced user interface, but also allows us to react more quickly to customer requests to meet changing needs as they happen.

SAP Concur Platform

**Ongoing** Retirement and Decommission of Existing Concur Request APIs (v1.0, v3.0, v3.1) (June 1, 2021)

SAP will be retiring the existing Concur Request APIs (v1.0, v3.0 and v3.1) in a future release (targeted to begin June 1, 2021), in accordance with the SAP Concur API Lifecycle & Deprecation Policy. These APIs are replaced by the Concur Request v4 APIs. SAP will no longer support these APIs after retirement.

Decommissioning of the v1.0, v3.0, and v3.1 APIs will start three months after retiring the APIs. The specific dates for decommissioning are dependent on the individual client's API migration.

API Timeline for v1.0, v3.0, v3.1:

  • Deprecation – March 1, 2020 – May 31, 2021

  • Retirement – June 1, 2021 – November 30, 2021

  • Decommission – starts after 3 months of inactivity at the retired state

Business Purpose / Client Benefit: The Concur Request APIs v1.0, v3.0 and v3.1 only support the previous authentication method, which is not best security practice and does not meet the Oauth2 standards. In addition, the previous versions of the Concur Request APIs provided limited possibilities for moving a Request through the approval workflow, as well as managing custom simple & connected list fields. These issues are resolved with the new Concur Request v4 APIs.

In addition, SAP has run a backward compatibility project between the current Concur Request APIs and the new Concur Request v4 APIs (not iso-compatibility) in order to have the vast majority of use cases managed in the previous versions also be managed in the Concur Request v4 APIs.

User Administration

**Ongoing** New User Administration Pages

On February 11, 2021, SAP Concur made new Add User and Edit User pages available to all Standard edition clients. Clients were able to opt-in to use the new pages and provide feedback on the pages through a survey.

The functionality of the new Add User and Edit User pages is the same as the functionality of the previous Create User and Edit User pages. The format of the pages has changed and the fields on these pages have been reorganized.

On March 11, 2021, the new Add User and Edit User pages became the default pages and clients had the option to revert to the previous page design.

On April 8, 2021, the new Add User and Edit User pages replaced the previous Create User and Edit User pages for all clients and the option to revert to the previous page design was removed.

Business Purpose / Client Benefit: These changes provide a simpler, more efficient experience for user administrators.

Updates to User Administration Pages (March 25)

On March 25, 2021, SAP implemented several improvements to the SAP Concur User Administration pages, including:

  • Enabling user admins to select multiple users to activate users and send email invitations

  • Implementing an alert on the Users page that indicates that a user’s account is incomplete

  • Adding a feature to the Edit User page that lists fields that are incomplete and provides a link to quickly navigate to the incomplete fields

  • Updating the Users page so that the user admin can click the user’s last name to open the Edit User page for that user

Business Purpose / Client Benefit: These changes provide a simpler, more efficient experience for user administrators.

Planned Change Summaries

The items in this section are summaries of the changes targeted for future releases. SAP reserves the right to postpone implementation of – or completely remove – any enhancement/change mentioned here.

Security

**Planned Changes** Concursolutions.com SSL Certificate Renewal (May 26)

To ensure the ongoing security of our products and services, the concursolutions.com SSL certificate is updated on an annual basis. The current certificate was issued on April 14, 2020 and will expire when SAP Concur issues a new certificate on May 26, 2021.

Clients who have not pinned the expiring certificate do not need to take any action as their expiring certificate will be renewed automatically. Most clients do not pin the certificate.

SAP Integration with Concur Solutions (SAP ICS) clients and all other clients who have pinned the expiring certificate must update to the new certificate before the new certificate is issued on May 26, 2021.

Clients who have pinned the certificate and do not update it with the new certificate by May 26, 2021 will experience disruption to SAP Concur products and services.

Business Purpose / Client Benefit: Annual certificate renewal provides ongoing security for our products and services.

Client Notifications

The items in this section provide reference material for all clients.

Accessibility Updates

SAP implements changes to better meet current Web Content Accessibility Guidelines (WCAG). Information about accessibility-related changes made to SAP Concur solutions is published on a quarterly basis. You can review the quarterly updates on the Accessibility Updates (English Only) page.

SAP Concur Non-Affiliated Subprocessors

The list of non-affiliated subprocessors is available here: SAP Concur list of Subprocessors (English Only)

Monthly Browser Certifications

Monthly browser certifications, both current and planned, are available with the other SAP Concur monthly release notes, accessible from What's New - Standard Edition