Administration

Concur Travel has updated its Travel System Admin page to help users better differentiate which travel configurations belong to Professional or Standard Travel editions.

Users now have an accessible way to differentiate between professional and standard editions on the Travel System Admin page.

Since 2018, we have moved most of our e-mail notifications service to a new cloud platform. Because of this transition, companies who filter inbound e-mail based on the sending IP address must add new IP addresses to their Safe Sender list. This ensures that their users are able to receive e-mail from SAP Concur.

We are in the process of moving e-mails sent from Concur Travel for all customers to our e-mail notifications service running on a new cloud platform. Additionally, on the EMEA Data Centre only, will make an IP address update for all SAP Concur solutions. To ensure your organisation is prepared, we recommend that you make any necessary changes immediately.

Customers on the North America Data Centre using Concur Expense have already added the IP addresses to their allow-list and are not affected.

Customers on the North America Data Centre using Concur Travel without Concur Expense will be affected by this change if they filter incoming e-mail based on IP addresses.

All customers on the EMEA Data Centre filtering incoming e-mail based on IP addresses are affected by the change. This includes customers that are using Concur Expense and have previously added IP addresses to their Safe Sender list. SAP Concur is including additional IP addresses from which e-mails will be sent.

This new service improves stability and security. It significantly speeds up the time to process and dispatch e-mails.

Authentication

SAP Concur support for Hash-Based Message Authentication Code (HMAC) has been deprecated.

SAP Concur provides a Single Sign-On self-service option that enables client administrators to set up their SAML v2 connections without involving an SAP Concur support representative.

This change provides better security and improved support for users logging in to SAP Concur products and services.

Cookie Preferences and User Consent

To ensure that SAP Concur solutions meet the user cookie consent requirements of the European Union (EU), European Economic Area (EEA), European Free Trade Association (EFTA), the United Kingdom (UK), and Brazil, on 1 July, 2021, SAP implemented explicit cookie consent and zero cookie load for SAP Concur solutions in those jurisdictions.

• Explicit cookie consent: The user must agree to allow cookies to be stored on their device by responding affirmatively to a request for consent.
• Zero cookie load: The user must provide explicit cookie consent before any cookies can be saved to their device.

This change ensures that SAP Concur sites comply with the cookie consent requirements of the listed jurisdictions and enables users to choose which cookies are downloaded to their devices by SAP Concur solutions.

Flight

In February 2020, SAP Concur and CIBT (CIBTvisas) launched a new integration method through the SAP Concur App Centre, where the new CIBT app is available. The legacy integration method with CIBT is still supported during a transition period, but SAP Concur will eventually retire the Legacy Batch File protocol integration method, targeted for 01 August, 2021.

With the new integration through the SAP Concur App Centre, the CIBT service is available for additional countries. Travellers whose profiles are associated with a Concur Travel configuration based in Denmark, Finland, Ireland, Norway or Sweden can now benefit from CIBT’s visa services.

CIBT has integrated with the SAP Concur Itinerary API and Travel Profile API and has released an App Centre Connector to facilitate the continuous, real-time flow of itineraries to better serve clients and travellers.

CIBT will be able to support clients and travellers in more countries and with a more stable, scalable integration. The new integration method also reduces the configuration effort for admin users in Concur Travel.

Concur Travel will decommission the Search both primary GDS and the Southwest direct connect feature for customers that have both the GDS and Southwest Direct Connect (WNDC) enabled. Since the feature was built prior to the industry-standard branded fares concept, extensive code changes would be required to update this feature to work as expected with branded fares. SAP Concur has made the decision to decommission this feature to ensure Southwest branded fares continue to be searchable and bookable in Concur Travel.

Targeted for 26 July 2021, the related settings will be disabled and removed for all customers. This means that after this update occurs, customers will see Southwest content only from the direct connect.

This change will simplify the setup for how Southwest Airlines’ flights and fares are sourced in Concur Travel when the direct connect is enabled. Customers will also see a reduction in scans to the GDS since these scans will no longer take place.

Southwest Airlines will migrate from the current Basic Booking Request distribution model to a full content distribution model, Direct Connect Availability. This change only applies to Sabre subscribers with Point of Sale (POS) in the United States or US Territories that are approved by Southwest Airlines for ticketing.

In an effort to create a common experience for our customers, regardless of which GDS they choose, we are working with our partners, Sabre and Southwest Airlines (WN), to seamlessly migrate from the current Basic Booking Request functionality that exists today, to the full content participation functionality expected in July of 2021. The goal is to enable functionality like that which exists in our integration with Amadeus and Travelport.

There are several differences between the Southwest offering in Basic Booking Request and Direct Connect Availability with specific benefit to the user:

• Normal shop by price and shop by schedule paths, including branded fares content
• ARC electronic ticketing
• Pre-ticket change
• Post-ticket change
• Ticket Void
• Multi-city itineraries
• E-receipts
• Government fares for commercial customers

Concur Travel now supports a new version of seat maps using the Travelport Universal API platform.

SAP Concur has run a pilot using pre-selected customers and TMCs. The pilot was successfully completed on 30 June. Starting 2 July, the new version of seat maps is available for all Travelport customers.

The new seat map user experience is accurate and reliable, and it considers the customer’s Frequent Flyer status and the fare type selected. The old seat maps did not account for either of these.

The new seat map provides an improved seat selection success rate, as we now have better understanding of seat availability. The new seat map experience will be available for more than 100 airlines via Apollo and Worldspan, and more than 140 airlines via Galileo.

Profile

SAP Concur has modified the Mobile Phone field of the Profile page to accept brackets in addition to dashes, spaces and digits. Previously, brackets were not allowed and resulted in an error. No other phone number fields, such as Work Phone and Home Phone, have been modified in this manner.

This change was made to make the user interface consistent with the Travel Profile 2.0 API, which was modified to allow brackets in mobile phone data in June 2021.

A new Select a Method of Payment configuration option enables companies to let users list their payment options by personal cards first, followed by company ghost cards. Previously, available of payment options listed ghost cards before personal cards by default.

The new configuration allows users to sort payment options to better match their most-often used credit cards, helping them move through the payment process more efficiently.

TripLink

As of 22 July 2021, the capability of forwarding confirmation e-mails to plans@concur.com will be retired. The same functionality will continue to be available withplans@tripit.com. Users must have their TripIt and Concur Travel accounts linked so that the confirmation e-mails sent to plans@tripit.com are automatically synced to Concur Travel.

SAP Concur is retiring support for plans@concur.com because a richer service is provided through TripIt Pro. Forwarding travel plans to plans@tripit.com will not only provide the same functionality as plans@concur.com, but it will also improve traveller satisfaction when they use TripIt, a popular travel app and perk for business travellers.

Miscellaneous

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and suppliers participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of 10 April, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

• Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.
• SFTP file transfer accounts that use password authentication must switch to SSH key authentication.
• SFTP password reset requests require the client to provide an SSH key for authentication.

On 12 April, 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• st-eu.concursolutions.com
• vs.concursolutions.com
• vs.concurcdc.cn

These changes provide greater security for file transfers.

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

• Key file is available in client’s root folder.
• Key ID 40AC5D35.
• RSA 4096-bit signing and encryption subkey.
• Key expires every 2 years.
• Client is responsible for replacing the key before it expires.
• • Next expiry date: 4 September, 2022.
  • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date.

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• mft-us.concursolutions.com
• vs.concursolutions.com
• st-eu.concursolutions.com
• mft-eu.concursolutions.com

The rotating public PGP key provides greater security for file transfers.

This release note is intended for the technical staff responsible for file migrations with SAP Concur solutions. For our customers and suppliers participating in data exchange, SAP Concur solutions is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and 31 July 2021. After they are migrated to the more efficient process, clients will see the following improvement:

• With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur solutions will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

• • st.concursolutions.com

These changes provide greater security and efficiency for file transfers.

Flight

Currently, users are not able to make changes to Travelport Southwest flights after the ticket has been issued. Targeted for October 2021, Southwest Post-Ticket change functionality will be available for Travelport customers with the Post-Ticket Change feature enabled in configuration.

This change will enable users to change Southwest airline flights via Travelport through Concur Travel after a ticket is issued.

Travelport Post-Ticket changes will only be supported via Apollo and Worldspan. Concur Travel will communicate if this functionality will be enabled for Galileo customers at a future date.

Profile

The XML Profile Sync, which is used to synchronise Concur Travel user profile data with TMC partners, will no longer be available, and this is targeted for the end of 2021. We advise all partners to engage with SAP Concur representatives to adopt the Travel Profile v2 API for managing Concur Travel user profiles.

The XML Profile Sync was officially decommissioned in 2016 due to instability and other issues. The Travel Profile v2 API was built to replace this legacy synchronisation process. It has now reached such a level of stability and maturity that there is no longer any reason to maintain multiple profile sync options.

Travel Operations / Technical Essentials

In order for Concur Travel to process offline bookings and updates to online bookings, specific information must be present in the PNR. Today, all of the following are required pieces of information:

1. Company ID (CLIQCID)
2. Travel Configuration ID (CLIQCONFIGID)
3. Login ID (CLIQUSER)

However, while all of these have been required historically, SAP Concur did not always reject PNRs when required fields were missing. With this update, these requirements will be enforced. Any Sabre, Amadeus or Worldspan PNRs missing required information will be rejected and placed in the error queue. Galileo and Apollo PNRs missing required information will be rejected.

Concur Travel uses the Travel Configuration ID to match trips to the correct configuration. This information will also be used to identify Compleat-integrated customers. Without it, Concur Travel/Compleat integration features will not be available.

Accessibility

SAP implements changes to better meet current Web Content Accessibility Guidelines (WCAG). Information about accessibility-related changes made to SAP Concur solutions is published on a quarterly basis. You can review the quarterly updates on the Accessibility Updates (English only) page.

Browser Certifications and Supported Configurations

The SAP Concur Release Notes – Monthly Browser Certifications document lists current and planned browser certifications. The document is available with the other SAP Concur monthly release notes.

The Concur Travel & Expense Supported Configurations – Client Version guide is available with the set-up guides, user guides and other technical documentation.

Subprocessors

The list of non-affiliated subprocessors is available here: SAP Concur list of Subprocessors

If you have questions or comments, please reach out to: Privacy-Request@Concur.com