Authentication

On 23 March, the View Previous Changes feature was added to the Administration > Company > Authentication Admin >Manage Single Sign-On page. This feature enables the Authentication Admin to view a table that lists SAP Concur Single Sign-On (SSO) configuration changes, view details of those changes and revert (reinstate) deleted configurations.

The View Previous Changes table can display the last 100 changes. Changes that are listed in the table include:

• Adding a configuration.

• Deleting a configuration.

• Editing the name in the Custom IdP Name field.

• Editing the URL in the Logout URL field.

This change enables the Authentication Admin to view and track changes made to the SSO configuration over time and to reinstate configurations that were previously deleted.

Priority (P2) Communications

Concur Travel Priority 2 (P2) Communications are currently published and available on a concurtraining.com landing page. Targeted for April 2021, the Travel P2s will be published on the Personalised Concur Open dashboard. At the same time, the concurtraining.com landing page for P2s will be archived. They will no longer be maintained for any new P2 communications.

TMCs and clients will be able to view P2 notifications in a similar format with a description of the issue, regular updates and resolution. TMCs and clients will be able to subscribe for P2 notifications via email at https://open.concur.com in a manner that is similar to that for P1 notifications.

Flight

Concur Travel currently provides scheduled Wi-Fi availability for a flight, and the ability to purchase Wi-Fi access in advance for a select number of airlines via Gogo Inflight Wi-Fi.

The feature was introduced in the early days of in-plane Wi-Fi when this capability was less widely available.

This feature will be decommissioned for the following reasons:

• Most users purchase this product in-flight rather than in advance; accordingly, it is not optimal to have this item for purchase in the air shopping path of the booking tool.
• Other Wi-Fi options are available to travellers in addition to the Gogo Inflight Wi-Fi product. The Gogo Inflight Wi-Fi indicator icon for scheduled flights does not fully reflect available Wi-Fi offerings and capabilities across the entire global airline landscape.
• Receipts are not supported (requires manual reimbursement process for travellers).
• The Concur Travel vision for Flight includes the introduction of more comprehensive and universal coverage of airline product details, including Wi-Fi offering by flight.

Concur Travel now supports a new version of seat maps using the Travelport Universal API (uAPI) platform.

The SAP Concur Dev team will run a pilot with pre-selected customers and TMCs, targeted to begin during the last week of April or first week of May. The new seat map is targeted for release to all customers by the end of the second quarter.

The new seat map user experience is accurate and reliable, and it considers the customer’s Frequent Flyer status and the fare type selected. The old seat maps did not account for either of these.

The new seat map provides an improved seat selection success rate as we now have a better understanding of seat availability.

Airlines are increasingly utilising the IATA New Distribution Capability (NDC) standard to offer products that may not currently be available in Global Distribution Systems (GDS).

As part of SAP Concur’s commitment to ensuring clients have access to all relevant content, including NDC-sourced content, we are pleased to announce the Select Access programme will now include an option for sourcing NDC content via Travelfusion.

Industry-wide efforts to develop NDC at-scale for use with business travel are in the early stages. As a result, TMC and corporate flexibility is required to use NDC content in its current state via Travelfusion, while airline and GDS development efforts with NDC remain ongoing to fully meet end-to-end business travel needs.

Clients in some markets have an important need to access new airline content (for example, brands, bundles, ancillaries) that is not available in the GDS.

Providing this capability using the Select Access programme allows clients to access all the relevant content to ensure travellers can book the right type of product depending on the travel scenario. For example, Lufthansa Light (Basic) fares in Europe are normally only available through the NDC channel. The Select Access programme allows clients to book those fares when it meets their needs, such as short-haul day trips or within strict cost management programmes.

Ground

Concur Travel currently enables travellers to book limousine transfers via Limos.com. This feature was provided to offer limousine transfers via Limos.com.

As of the April 2021 release scheduled for 17 April, Limos.com will become a maintained feature, where feature requests and/or support cases are no longer accepted.

Targeted for May, this feature will be decommissioned. With continued pre-pandemic declines in Limos.com transfers booked via Concur Travel, combined with requirements to maintain the service, future investment in this feature is uneconomical.

SAP Concur recognises that some customers still need to utilise Limos.com transfer capabilities; it is recommended to switch to any of the remaining suppliers: SummitQwest, Groundspan and Talixo.

Concur Travel currently enables travellers to book transfer service via Groundscope. This feature was provided to offer transfer services via Groundscope in 80 different countries.

As of the April 2021 release scheduled for 17 April, Groundscope will become a maintained feature, where feature requests and/or support cases are no longer accepted.

Targeted for May, this feature will be decommissioned. With continued pre-pandemic declines in Groundscope transfers booked via Concur Travel, combined with requirements to maintain the service, future investment in this feature is uneconomical.

SAP Concur recognises that some customers still need to utilise Groundscope transfer capabilities; it is recommended to switch to any of the remaining suppliers: SummitQwest, Groundspan and/or Talixo.

Profile

Approximately one year ago, SAP Concur inadvertently removed the ability to bulk delete values in the GDS Profile Name field (line 19) when using the 350 File Type in the FTP Employee Import in Concur Expense. This change restores the ability to delete GDS Profile Name (also known as CRS Name) values.

The decision to remove the ability to delete the GDS Profile Name was in response to an escalation where these values were deleted in error. In general, deleting these values is not recommended as it may lead to users being unable to book travel. GDS Profile Name should be deleted in coordination with SAP Concur and with the TMC to ensure user functionality is not interrupted.

Some clients use dynamic Best Available Rates (BAR) in their travel configurations, which means that the Org Unit value is part of the GDS Profile Name. When a user moves from one Travel Org Unit to another and the Concur Travel profile is updated, the GDS Profile Name is not automatically updated. To get the new GDS Profile Name containing the new Org Unit, the profile must be synced from GDS again.

SAP Concur will remove the user profile picture functionality, including the ability to update and display the user’s picture in the Concur CTE User Profile page.

The profile picture functionality is utilised by very few SAP Concur users. Ongoing maintenance requirements have made the cost of maintaining this feature infeasible relative to the value it provides to users.

Previously, the HasNoPassport field was set automatically by Concur Travel.

• If a user had a passport in their profile, the HasNoPassport field was set to FALSE.
• If a user ticked the I do not have a passport checkbox on the Profile page, the HasNoPassport field was set to TRUE.

There was no way to set it directly via the Travel Profile v2 API.

With this change, Concur Travel will allow TMCs or partners, who are permitted to read and write to the Passport Visa Information Scope, to set this field directly when calling the Travel Profile v2 API.

Users who have had their passport information provided by a system (for example, their employer’s Human Resources or TMC) via the Travel Profile v2 API will have the HasNoPassport flag correctly set and correctly displayed on the User Profile UI.

Miscellaneous

SAP Concur support for Hash-Based Message Authentication Code (HMAC) is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel are currently assisting customers who use HMAC to migrate to SAP Concur SAML v2 SSO (SAML v2).

SAP Concur provides a Single Sign-On self-service option that enables client admins to setup their SAML v2 connections without involving an SAP Concur support representative.

This change provides better security and improved support for users logging in to SAP Concur products and services.

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and suppliers participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of 10 April, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

• Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.
• SFTP file transfer accounts that use password authentication must switch to SSH key authentication.
• SFTP password reset requests require the client to provide an SSH key for authentication.

On 12 April, 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• st-eu.concursolutions.com
• vs.concursolutions.com
• vs.concurcdc.cn

These changes provide greater security for file transfers.

This release note is intended for the technical staff responsible for file migrations with SAP Concur solutions. For our customers and suppliers participating in data exchange, SAP Concur solutions is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

These changes provide greater security and efficiency for file transfers.

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

• Key file is available in client’s root folder.
• Key ID 40AC5D35.
• RSA 4096-bit signing and encryption sub-key.
• Key expires every 2 years.
• Client is responsible for replacing the key before it expires.
• Next expiry date: 4 September, 2022.
• • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date.
  • The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• mft-us.concursolutions.com
• vs.concursolutions.com
• st-eu.concursolutions.com
• mft-eu.concursolutions.com

The rotating public PGP key provides greater security for file transfers.