Concur Invoice Professional Edition Administration Help

August 2019 Request Professional Edition Admin Summary

Initial Post

Release Note Summaries

The items in this section are summaries of the release notes for this month. The Professional Edition release notes are accessible from What's New - Professional Edition.

Request

Company Notes: Use of HTML Is Deprecated From the Headline Field

When configuring messages that display to all users in the Company Notes section of the home page, use of HTML in the Headline field is deprecated. Headlines containing HTML will not render, cannot be executed and will be displayed as plain text.

Business Purpose / Client Benefit: This change provides greater security for company data.

File Transfer Updates: Support Ending for Unsecured SSH Protocol Algorithms/Ciphers

SAP Concur will no longer support the following unsecured SSH protocol algorithms/ciphers:

  • (key exchange) diffie-hellman-group-exchange-sha1
  • (encryption) aes128-cbc
  • (encryption) aes192-cbc
  • (encryption) aes256-cbc
  • (message authentication code) hmac-md5
  • (message authentication code) hmac-sha1-96
  • (message authentication code) hmac-md5-96

This announcement pertains to the following file transfer DNS endpoints:

  • st.concursolutions.com
  • st-eu.concursolutions.com
  • st-cge.concursolutions.com
  • st-cge-dr.concursolutions.com
  • vs.concurcdc.cn

If assistance is required, please contact SAP Concur support.

For more information, refer to the Shared: File Transfer for Customers and Vendors User Guide (English Only). (This guide is located with the other Expense, Invoice and/or Request setup and user guides.)

Business Purpose / Client Benefit: These changes provide greater security for file transfers.

Introducing Screen Sharing for Authorised Support Contacts

SAP Concur support is implementing the Co-browse feature, a screen-share application that is available to all Authorised Support Contacts (ASCs).

Business Purpose / Client Benefit: Screen sharing often makes a problem easier to describe, easier to understand and quicker to resolve – saving time for ASCs and SAP Concur support.

New Links Added to the Configuration Report

The Request Configuration Report (Administration > Request > Request Administration) now has a Show All Sections link and a Hide All Sections link. The new links provide the ability to expand the report to display all sections of the report or to hide all sections of the report. By default, all sections of the report are hidden.

With this update, you can now also display individual sections of the report by clicking the section link. Before this update, all sections of the report were displayed, and clicking a section link navigated you to that section of the report.

Business Purpose / Client Benefit: This change provides additional options for viewing the Request Configuration Report and enhances the report performance.

New Site Setting for Closing Requests

As of the June release, the Site Settings page (Administration > Request > Site Settings) has a new setting, Display the Close link for Authorisation Request Users. The setting determines whether Concur Request users can close requests themselves.

When the Display the Close link for Authorisation Request Users check box is selected (enabled), the Close/Inactivate Request button will be displayed for approved and cancelled requests. When the check box is not selected (disabled), the Close/Inactivate Request button will not be displayed for requests.

This update helps prevent Request users from inadvertently closing or inactivating requests before the requests are ready to be closed.

Business Purpose / Client Benefit: The setting allows the administrator to control whether their Concur Request users can close requests.

**Ongoing** Authentication: Deprecation of HMAC Initiates Migration to SSO Self-Service

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

SAP Concur will soon begin the deprecation process of removing Hash-Based Message Authentication Code (HMAC) as an SSO option. The replacement service for HMAC is SAML SSO, which will be a self-service method of setup whereby Company Admins will have access within SAP Concur to complete their SAML connections.

Clients currently using HMAC are encouraged to migrate to the SSO self-service tool as soon as it is released. The new SSO self-service tool will be offered as a free feature to all clients. The new SSO self-service tool allows multiple portals (Identity Providers) to be added.

The HMAC deprecation includes two phases:

Phase I:

  • Clients need to have an Identity Provider (IdP) or a custom SAML 2.0 solution.
  • Clients begin testing the new SSO self-service tool. Testing can begin as soon as July 2019 if preparation steps have been met.
  • Clients prepare for onboarding new clients using the new SSO self-service tool, which is targeted to release in September 2019.
  • As of 1 November 2019, no new clients will be onboarded using HMAC. New clients will be onboarded using the new SSO self-service tool.
  • Existing clients using HMAC need to be migrated using the new SSO self-service tool.

Phase II:

  • Clients continue migrating existing HMAC clients to the new SSO self-service tool.
  • Shut down the HMAC service after everyone has migrated from HMAC to the new SSO self-service tool. Phase II is targeted to end mid-year 2020.

Business Purpose / Client Benefit: This change provides better security and improved support for users logging in to SAP Concur products and services.

**Ongoing** Email Infrastructure Change - Add IP Addresses to Safe Sender List

SAP Concur is transitioning to a new email infrastructure for outbound email from our services to SAP Concur users. Because of this, companies who filter inbound email based on the sending IP address must add new IP addresses to their Safe Sender list to ensure that their users receive email from SAP Concur.

Initially, the issue described here affected only companies that use Concur Expense. Starting in January, email from other SAP Concur services (such as Travel and Concur Pay) will move to the new email infrastructure.

We will continue to add other services. Please monitor the release notes for more information about the timing of the additional changes.

Updates for Concur Open and Personalised Concur Open

Over the next several weeks, users will see several enhancements to Concur Open and Personalised Concur Open.

Release Notes

Shared Planned Changes Release Notes Consolidated

With this release, SAP Concur will consolidate the shared Planned Changes release notes into one document, instead of having the Planned Changes information repeated in several sets of release notes.

This consolidated Planned Change information is provided in addition to the product-specific Planned Changes release notes. For example, if a planned change applies only to Travel, it will only be available in the Travel release notes. So, users are encouraged to read the product-specific release notes as well as the Shared Planned Changes.

User / Customer Benefit: This change allows users to find shared Planned Changes release notes in one place. It also makes it easier for clients to keep track of updates to the Planned Changes release notes.

Planned Change Summaries

The items in this section are summaries of the changes targeted for future releases. SAP Concur reserves the right to postpone implementation of – or completely remove – any enhancement/change mentioned here.

No Request-Specific Planned Changes This Month

Client Notifications

The items in this section provide reference material for all clients.

SAP Concur Non-Affiliated Subprocessors

The list of non-affiliated subprocessors is available here: SAP Concur list of Subprocessors (English Only)

Monthly Browser Certifications

Monthly browser certifications, both current and planned, are available with the other SAP Concur monthly release notes, accessible from What's New - Professional Edition