Authentication Administration

SAP Concur plans to decommission Concur Expense Service (CES) SSO on 29 October 2021. SAP Concur now provides a Single Sign-On self-service option that enables client admins to set up their SAML v2 connections without involving an SAP Concur admin. This change provides better security and improved support for users logging in to SAP Concur products and services.

Client Web Services

**Planned Changes** Self-Service Tool for Application Management (Products: Expense, Invoice, Request, Travel)

Beginning with the October release, clients who have SAP Concur Client Web Services can request access to a new application management self-service tool, OAuth 2.0 Application Management. This self-service tool is enabled by the Client Web Services team for SAP Concur Web Services clients who request it.

The OAuth 2.0 Application Management self-service tool can be used to create OAuth2-compliant applications. Legacy authentication was deprecated in 2017 and is not supported by this tool.

When enabled, the tool is available from the Authentication Administration page to admin users who have been assigned the Web Services Admin role.

For admins working with Standard entities, a user with the Can Administer permission has the Web Services Administrator role.

The OAuth 2.0 Application Management tool enables clients to generate Client IDs (App IDs) and Client Secrets without contacting SAP Concur support.

Clients who do not have SAP Concur Client Web Services can still contact SAP Concur support to obtain an App ID as needed.

Localisation

This feature/change has been targeted for release. For information about this feature/change, refer to the applicable product release notes.

Miscellaneous

In Q4, 2021, SAP Concur will begin redirecting clients in the US data centre to a new homepage. The appearance of the new homepage is identical to the current SAP Concur homepage. The new homepage has enhanced functionality when services become temporarily unavailable.

The roll out of the new homepage is phased. Clients will be migrated to the new homepage over time beginning in Q4. This change ensures that the SAP Concur homepage is available even when some services are unavailable and improves the consistency of the sign-in experience.

SAP Concur User Assistance

**Planned Changes** Help Menu Directed to SAP Help Portal (Products: Expense, Invoice, Request, Travel)

In a future release, SAP will update the Help menu in the SAP Concur solutions to point to the online help content on SAP Help Portal (http://help.sap.com). SAP Help Portal includes a new look and feel for the help and additional functionality, while the help content remains the same.

This update consolidates the SAP Concur solutions documentation with other SAP products on the central SAP Help Portal.

**Planned Changes** New User Assistance Tool for End Users (Products: Expense, Invoice, Request, Travel)

In an upcoming release, SAP plans to provide SAP Concur admins with the ability to enable a new user assistance tool for their end users. The new tool helps end users complete tasks by providing guidance while the user learns new tasks.

When this feature is released, clients who have admin user assistance enabled will automatically have end user assistance enabled. SAP Concur clients who do not have admin user assistance enabled and who would like to have the ability to enable end-user assistance can open a service ticket to enable the feature.

On entities with admin user assistance enabled prior to the release, when user assistance for end users is released, it will be enabled for all end users by default. The feature can be disabled globally on the User Assistance Settings page.

This feature assists users to learn new tasks more quickly and efficiently driving user adoption, increasing efficiency and improving the end user experience and end user satisfaction with SAP Concur solutions.

Security

**Planned Changes** Some TLSv1.2 Ciphers No Longer Supported (Feb 2022) (Products: Expense, Invoice, Request, Travel)

To ensure that connections to *.concursolutions.com and *api.concursolutions.com are not disrupted, clients and partners who connect to *.concursolutions.com and *api.concursolutions.com through an application that uses an unsupported cipher must update the application to a supported cipher before 1 February 2022.

This update provides ongoing security for our products and services.

Supported Configurations

On 1 January 2022, SAP Concur plans to begin transitioning away from support for Internet Explorer 11 (IE 11). This change is in line with other SAP solutions, industry best practices and Microsoft’s lifecycle policy for IE 11.

After 1 January 2022, SAP Concur development teams will not design new features, user interface enhancements or security or bug fixes with IE 11 in mind. Over time, new functionality and existing functionality might not work properly on IE 11.

SAP Concur users will not be blocked from access when using IE 11. They will still be able to sign into their SAP Concur solutions. However, to ensure their users can continue to work successfully and securely with SAP Concur solutions, SAP recommends that clients move away from allowing use of SAP Concur solutions on IE 11 and move to a more modern, supported browser.

This change enables SAP to speed up adoption of the latest browser innovations and provide a stronger security posture.

Test Entities

**Planned Changes** Email Verification (Products: Expense, Invoice, Request)

Currently, some SAP Concur users use test entities to set up, test and provide training for new configurations prior to deploying them to their live production entity. The production entity is where users perform real transactions, such as submitting expense claims and booking travel.

Today, test entities are in a separate environment called the implementation environment; production entities are in a separate environment called the production environment. To improve the stability, performance, monitoring and security of test entities, SAP Concur plans to migrate both test and production entities to the same environment as part of our move to Amazon Web Services (AWS).

Test and production entities will still remain separate and distinct entities, but will live in the same environment. Test entities will NOT be connected to the production entities after the migration – test entities will always be separate entities from production entities.

This change will result in the co-existence of both test and production entities in the same production environment.

When test entities are migrated to the AWS production environment, verified emails from the existing test entity will not carry over to the new test entity. As a result, when users test verified email functionality in a future test entity, it is recommended that the employee uses an email that is different from the email configured in their production entity. This process is required as the email in the existing test entity was most likely already verified in production and, therefore, cannot be verified in another entity.

With respect to user email addresses, the Receipt Recognition service validates user email addresses and as such, only one instance of an email address can be associated with a user account. To test in production, clients will be required to utilise alternate email addresses that are not currently associated with any production user account. If a client attempts to set up a test account in production using an email address already associated with a corresponding user profile, it will fail the validation process.

Once in AWS, test entities will benefit from the same security, stability, monitoring and performance as production entities.

**Planned Changes** Test Entity Login Updates (Products: Expense, Invoice, Request)

Currently, some SAP Concur users use test entities to set up, test and provide training for new configurations prior to deploying them to their live production entity. The production entity is where users perform real transactions, such as submitting expense claims and booking travel.

Today, test entities are in a separate environment called the implementation environment; production entities are in a separate environment called the production environment. To improve the stability, performance, monitoring and security of test entities, SAP Concur plans to migrate both test and production entities to the same environment as part of our move to Amazon Web Services (AWS).

Test and production entities will still remain separate and distinct entities, but will live in the same environment. Test entities will NOT be connected to the production entities after the migration – test entities will always be separate entities from production entities.

This change will result in the co-existence of both test and production entities in the same production environment.

Today, a user can maintain the same login ID for their test and production entities because they are in separate environments. With the plan to migrate both test and production entities to the same AWS production environment in the future, this will no longer be possible since each login ID must be unique.

While there is no action required for customers regarding this update, we want to ensure customers are aware of it because the change will be visible in certain areas of test entities. To account for this change, SAP Concur will append all test entity login IDs with a ".uat” domain during both migration and user creation to ensure they are unique and do not conflict with existing production login IDs. For example, “johnsmith@123.com” will become “johnsmith@123.com.uat”.

This change will help to safeguard against any conflicts with production login IDs.

**Planned Changes** Most Recently Used Lists Not Migrated (Products: Expense, Invoice, Request)

Some SAP Concur users use test entities to set up, test and provide training for new configurations prior to deploying them to their live production entity. SAP Concur plans to migrate test entities as part of our move to Amazon Web Services (AWS).

Due to the architectural changes that SAP Concur must make to support this move, when test entities are migrated to the new environment, some Most Recently Used (MRU) list items within the test entity will not be migrated.

MRU lists consist of recent selections made by the user. These lists are generated over time as users interact with various menus and other defined lists, and they will be regenerated after the test entity is migrated to the new environment.

Once in AWS, test entities will benefit from the same security, stability, monitoring and performance as production entities.