Administration

SAP Concur solutions now provides test companies in existing data centres. To help users distinguish between a test company and a production company, Concur Travel has been updated. Concur Travel functionality is extremely limited in these test companies. Configurations are available, search and booking functionalities are not available. These test companies offer the same level of functionality as that available for Concur Expense test entities in the implementation environment.

Any company that is produced for both test and production usage will result in company entities which share the same or similar name. This update ensures that users will be able to tell the difference between them.

Flight

When booking travel, airfare searches might only return non-refundable fares. Because of this, SAP Concur introduced the Refundable Only Air Fares feature.

The Refundable Only Air Fares feature was built on the assumption that, using the regular air fares search feature, only one fare is returned per flight option. The fare is usually the lowest available fare, which is usually not refundable. Using the Refundable Only Air Fares feature allowed users to find refundable fares that are relevant for business travel. However, with the introduction of the branded fare concept, airlines started to return a wider range of fares that included partially or fully refundable fares. Since the Refundable Only Air Fares feature anticipated only one returned fare, using it with multiple fares caused unexpected behaviour. For example, entire flights might be excluded, instead of only non-refundable fares.

The Refundable Only Air Fares feature has been updated and renamed to Include Additional Refundable Air Fares to reflect the modified functionality. Instead of hiding entire flights, the user can initiate a refundable search request that returns additional refundable options along with the branded non-refundable and refundable fares. The refund conditions of the additional refundable fares may be different than those that return in the regular air fare search; the additional refundable fares typically have higher total price and less restrictive refund conditions.

In February 2020, SAP Concur and CIBT (CIBTvisas) launched a new integration method through the SAP Concur App Centre, where the new CIBT app is available. The legacy integration method with CIBT is still supported during a transition period, but SAP Concur will eventually retire the Legacy Batch File protocol integration method, targeted for 01 August, 2021.

With the new integration through the SAP Concur App Centre, the CIBT service is available for additional countries. Travellers whose profiles are associated with a Concur Travel configuration based in Denmark, Finland, Ireland, Norway or Sweden can now benefit from CIBT’s visa services.

CIBT has integrated with SAP Concur’s Itinerary API and Travel Profile API and has released an App Centre Connector to facilitate the continuous, real-time flow of itineraries to better serve clients and travellers.

CIBT will be able to support clients and travellers in more countries and with a more stable, scalable integration. The new integration method also reduces the configuration effort for admin users in Concur Travel.

Concur Travel now supports a new version of seat maps using the Travelport Universal API platform.

SAP Concur is currently running a pilot with pre-selected customers and TMCs, targeted to release to all customers by the end of the second quarter of this year.

The new seat map user experience is accurate and reliable, and it considers the customer’s Frequent Flyer status and the fare type selected. The old seat maps did not account for either of these.

The new seat map provides an improved seat selection success rate as we now have a better understanding of seat availability.

Hotel

SAP Concur is collecting the hotel confirmation number from Hotel Service v2 API content providers.

With this release, the hotel-specific confirmation number is available in Hotel Service v2 API reservation response.

This information is necessary to facilitate the booking and critical to ensuring a traveller’s Concur Travel itinerary includes the details they need to successfully check-in. This helps to automate the process of matching e-receipts and credit card statements to itineraries, to be implemented in the future.

Ground

Concur Travel has previously enabled travellers to book limousine transfers via Limos.com.

As of the April 2021 release, Limos.com became a maintained feature, where feature requests and support cases are no longer accepted.

As of this month, this feature will be decommissioned. With continued pre-pandemic declines in Limos.com transfers booked via Concur Travel, combined with requirements to maintain the service, future investment in this feature is uneconomical.

SAP Concur recognises that some customers still need to utilise Limos.com transfer capabilities; it is recommended that users switch to any of the remaining suppliers: SummitQwest, Groundspan and Talixo.

Concur Travel has previously enabled travellers to book transfer service via Groundscope. This feature was provided to offer transfer services via Groundscope in 80 different countries.

As of the April 2021 release, Groundscope became a maintained feature, where feature requests and support cases are no longer accepted.

As of this month, this feature will be decommissioned. With continued pre-pandemic declines in Groundscope transfers booked via Concur Travel, combined with requirements to maintain the service, future investment in this feature is uneconomical.

SAP Concur recognises that some customers still need to utilise Groundscope transfer capabilities; it is recommended that users switch to the any of the remaining suppliers: SummitQwest, Groundspan and Talixo.

Profile

SAP Concur solutions has not previously enforced any validation for the NamePrefix, NameSuffix and PreferredLanguage fields via the Travel Profile v2 API. As a result, data provided or updated via the API is often nonsensical and potentially exposes personal information in those fields (e.g. user’s loginID in the prefix field). Even though the user interface provides drop-down values, which ensures that user-entered values are valid, the Travel Profile v2 API does not.

SAP Concur will start enforcing allowable values for these three fields, as follows:

PreferredLanguage field:

1. As of this month, existing values that are not on the list of allowable values for PreferredLanguage will be returned to callers of the Travel Profile v2 API GET requests as empty strings.
2. Later this month, any updates to these fields that don’t conform to the lists of allowable values will be set as an empty string in the user’s profile, and the Travel Profile v2 API will return the error W006: “Non-allowed value for this field.”

NamePrefix and NameSuffix fields:

1. Later this month, SAP Concur will publish updated release notes and updated documentation before additional changes are implemented.

Updates to other user profile fields will not be affected. For example, if NamePrefix is set to empty string, the user’s first and last names will update correctly even if they are in the same API call.

This change will reduce the risk of sharing personal data in unintended ways. More consistent user data will result in better stability and fewer escalations.

Security

To ensure the ongoing security of our products and services, the concursolutions.com SSL certificate is updated on an annual basis. The current certificate was issued on 14 April, 2020 and will expire when SAP Concur issues a new certificate on 26 May, 2021.

Clients who have not pinned the expiring certificate do not need to take any action as their expiring certificate will be renewed automatically. Most clients do not pin the certificate.

SAP Integration with Concur Solutions (SAP ICS) clients and all other clients who have pinned the expiring certificate must update to the new certificate before the new certificate is issued on 26 May, 2021.

Clients who have pinned the certificate and do not update it with the new certificate by 26 May, 2021 will experience disruption to SAP Concur products and services.

Annual certificate renewal provides ongoing security for our products and services.

Miscellaneous

SAP Concur support for Hash-Based Message Authentication Code (HMAC) is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel are currently assisting customers who use HMAC to migrate to SAP Concur SAML v2 SSO (SAML v2).

SAP Concur provides a Single Sign-On self-service option that enables client admins to setup their SAML v2 connections without involving an SAP Concur support representative.

This change provides better security and improved support for users logging in to SAP Concur products and services.

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and suppliers participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of 10 April, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

• Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.
• SFTP file transfer accounts that use password authentication must switch to SSH key authentication.
• SFTP password reset requests require the client to provide an SSH key for authentication.

On 12 April, 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• st-eu.concursolutions.com
• vs.concursolutions.com
• vs.concurcdc.cn

These changes provide greater security for file transfers.

This release note is intended for the technical staff responsible for file migrations with SAP Concur solutions. For our customers and suppliers participating in data exchange, SAP Concur solutions is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

These changes provide greater security and efficiency for file transfers.

Due to circumstances resulting from the ongoing COVID-19 pandemic, the Department of Homeland Security has again extended the REAL ID enforcement deadline. The new deadline for REAL ID enforcement is 3 May, 2023.

The U.S. Transportation Security Administration is reminding travellers that, beginning 3 May, 2023, every traveller must present a REAL ID-compliant identification, such as a driver's license or passport, to fly within the United States.

To avoid disruption at the airport, please be sure to communicate these changes to your travellers. There are several custom text options available:

• Home page custom text
• Profile custom text
• Search Results custom text
• Itinerary custom text
• Configurable messaging

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

• Key file is available in client’s root folder.
• Key ID 40AC5D35.
• RSA 4096-bit signing and encryption subkey.
• Key expires every 2 years.
• Client is responsible for replacing the key before it expires.
• • Next expiry date: 4 September, 2022.
  • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date.

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• mft-us.concursolutions.com
• vs.concursolutions.com
• st-eu.concursolutions.com
• mft-eu.concursolutions.com

The rotating public PGP key provides greater security for file transfers.

Administration

Since 2018, we have moved most of our e-mail notifications service to a new cloud platform. Because of this transition, companies who filter inbound e-mail based on the sending IP address must add new IP addresses to their Safe Sender list. This ensures that their users are able to receive e-mail from SAP Concur.

In 2021, we plan to move e-mails sent from Concur Travel for all customers to our e-mail notifications service running on a new cloud platform. Additionally, on the EMEA data centre (DC) only, we plan to make an IP address update for all SAP Concur solutions. To ensure your organisation is prepared, we recommend making any changes by 1 July, 2021.

Initially, this transition affected only companies using Concur Expense. Now, e-mail from Concur Travel will also use the new e-mail infrastructure.

Customers on the North America Data Centre using Concur Expense have already added the IP addresses to their allow-list and are not affected.

Customers on the North America Data Centre using Concur Travel without Concur Expense will be affected by this change if they filter incoming e-mail based on IP addresses.

All customers on the EMEA Data Centre filtering incoming e-mail based on IP addresses are affected by the change. This includes customers that are using Concur Expense and have previously added IP addresses to their Safe Sender list. SAP Concur is including additional IP addresses from which e-mails will be sent.

This new service improves stability and security. It significantly speeds up the time to process and dispatch e-mails.

Ground

Concur Travel currently provides travellers with the capability to purchase Park ‘N Fly off-airport parking near certain airports at a discounted rate at the time of booking.

This feature was provided to offer a cost-effective alternative to on-airport parking at many airports in the United States.

Targeted for the April release, Park ‘N Fly will become a maintained feature (feature requests or support cases will no longer be accepted). Targeted for the June release, this feature will be decommissioned for the following reasons:

• Continued pre-pandemic declines in usage of Park ‘N Fly booked via Concur Travel, combined with requirements to maintain the service and necessary functional updates (such as airport locations due to permanent Park ‘N Fly location closings), makes future investment in this feature uneconomical.
• Other discounted off-airport parking options are available to travellers in addition to the Park ‘N Fly product. A generic parking solution that is limited to US locations does not fully reflect all offerings and capabilities across the global off-airport parking landscape.
• e-Receipts are not supported (requires manual reimbursement process for travellers).

Profile

The XML Profile Sync, which is used to synchronise Concur Travel user profile data with TMC partners, will no longer be available, and this is targeted for the end of 2021. We advise all partners to engage with SAP Concur representatives to adopt the Travel Profile v2 API for managing Concur Travel user profiles.

The XML Profile Sync was officially decommissioned in 2016 due to instability and other issues. The Travel Profile v2 API was built to replace this legacy synchronisation process. It has now reached such a level of stability and maturity that there is no longer any reason to maintain multiple profile sync options.

Travel Operations / Technical Essentials

In order for Concur Travel to process offline bookings and updates to online bookings, specific information must be present in the PNR. Today, all of the following are required pieces of information:

1. Company ID (CLIQCID)
2. Travel Configuration ID (CLIQCONFIGID)
3. Login ID (CLIQUSER)

However, while all of these have been required historically, SAP Concur did not always reject PNRs when required fields were missing. With this update, these requirements will be enforced. Any Sabre, Amadeus or Worldspan PNRs missing required information will be rejected and placed in the error queue. Galileo and Apollo PNRs missing required information will be rejected.

Concur Travel uses the Travel Configuration ID to match trips to the correct configuration. This information will also be used to identify Compleat-integrated customers. Without it, Concur Travel/Compleat integration features will not be available.

TripLink

Targeted for 22 July, 2021, the capability of forwarding confirmation e-mails to plans@concur.com will be retired. The same functionality will continue to be available with plans@tripit.com. Users must have their TripIt and Concur Travel accounts linked so that the confirmation e-mails sent to plans@tripit.com are automatically synced to Concur Travel.

SAP Concur is retiring support for plans@concur.com because a richer service is provided through TripIt Pro. Forwarding travel plans to plans@tripit.com will not only provide the same functionality as plans@concur.com, but it will also improve traveller satisfaction when they use TripIt, a popular travel app and perk for business travellers.

Accessibility

SAP implements changes to better meet current Web Content Accessibility Guidelines (WCAG). Information about accessibility-related changes made to SAP Concur solutions is published on a quarterly basis. You can review the quarterly updates on the Accessibility Updates (English only) page.

Browser Certifications and Supported Configurations

The SAP Concur Release Notes – Monthly Browser Certifications document lists current and planned browser certifications. The document is available with the other SAP Concur monthly release notes.

The Concur Travel & Expense Supported Configurations – Client Version guide is available with the set-up guides, user guides and other technical documentation.

Subprocessors

The list of non-affiliated subprocessors is available here: SAP Concur list of Subprocessors

If you have questions or comments, please reach out to: Privacy-Request@Concur.com