Request

In an effort to ensure the ongoing security of our products and services, SAP Concur has issued a new concursolutions.com SSL certificate. The current certificate will expire on 16 March 2019.

Any customer who has pinned this expiring certificate will need to update to the new certificate prior to 16 March 2019. If the pinned certificate is not updated prior to 16 March 2019, your organisation and users will experience disruption to SAP Concur products and services.

Customers who have not pinned the certificate do not need to take any action as the new certificate is updated automatically. Most customers do not pin the certificate.

Please be aware: As an enhancement to our Security and Compliance programme, this certificate will be updated on an annual basis.

Business Purpose / Client Benefit: This update provides ongoing security for our products and services.

SAP Concur is transitioning to a new email infrastructure for outbound email from our services to SAP Concur users. Because of this, companies who filter inbound email based on the sending IP address must add new IP addresses to their Safe Sender list to ensure that their users receive email from SAP Concur.

Initially, the issue described here affected only companies that use Concur Expense. Starting in January, email from other SAP Concur services (such as Travel and Concur Pay) will move to the new email infrastructure.

We will continue to add other services throughout the first quarter of 2019. Please monitor the release notes for more information about the timing of the additional changes.

SAP Concur has provided a release note about the updated email notifications for several months. Be aware that we will discontinue this release note after this month.

IMPORTANT

Note the following:

• Be aware that the email content has not changed – just the look and feel has been updated.
• The changes will appear over time. Each product team (Expense, Invoice, Travel, etc.) decides when to use the new format. Timing will be based on resource availability and the priority of other scheduled enhancements.
• Do not expect that all product emails will change at the same time. For example, perhaps Expense approval email will be first, and then other Expense notifications will follow.
• There is no assigned end date to the project. Expect that the changes may take longer than a year.

All companies must take all reasonable steps to protect the personal and sensitive information of their employees. As per recommended security-related best practices, remember that custom fields should not contain personal and sensitive data.

NEXT STEPS

If your company is currently using custom fields to store personal or sensitive data (for example, Social Security numbers, family member names or any other personally identifying information), you should plan to remove this information from your existing fields within the service and modify your current configuration.

Refer to the FAQ (English Only) for additional information.

Concur Open

Concur Open and Personalised Concur Open users can subscribe to email notifications about the SAP Concur products they use. As part of the subscription process, SAP Concur sends a verification email to the user. The user must click Verify in that email in order to receive the notifications.

It appears that some users are not completing the verification step, so SAP Concur has added a reminder to the subscription page.

For more information about Personalized Concur Open, refer to the Personalised Concur Open fact sheet (English only).

Request

Composite login functionality allows users to use a login ID that does not include a domain to log in to SAP Concur products.

All users who use only their username (ex: johndoe) to log in will need to use their CTE Login Name rather than their login ID to log in to SAP Concur products.

SAP Concur will no longer support composite login sign-in page URLs. The typical URL for a composite login page includes the name of the entity (ex: entity=pxxxxxxxxx) and looks like this: https://www.concursolutions.com/signin.asp?entity=pxxxxxxxxx.

All clients will be using the standard Sign In page to access SAP Concur products. The standard sign in page is https://www.concursolutions.com/nui/signin.

Deprecation of the composite login pages for www.concursolutions.com is targeted for 11 May 2019.

EFFECTS ON USERS

Users who log in to a composite login page (https://www.concursolutions.com/signin.asp?entity=pxxxxxxxxx) and do not use the at (@) symbol in their user name will need to contact their company administrator to get their CTE Login Name. User passwords remain the same.

Single Sign-On functionality is not impacted by this change. The following users will not be impacted because they do not log in using https://www.concursolutions.com:

• SAP Concur web SSO
• SAP Concur mobile username/password
• SAP Concur mobile SSO

Business Purpose / Client Benefit: Deprecating this feature improves login stability and login success rates, while reducing login dependency.

SAP Concur will have a new Forgot Password feature added to the SAP Concur Sign In page, providing an updated login experience for users who log in with user name and password credentials.

When the new Forgot Password feature releases (targeted for 11 May), the following existing Forgot Password page functionality will be deprecated:

• Security Questions: Users will no longer receive security question prompts for login authentication.
• On-page text: Company custom text will no longer display.
• Password hints: The Send me an email with my password hint option will no longer be available.

Business Purpose / Client Benefit: This feature provides greater security for user passwords and streamlines the user experience.

SAP Concur is planning to add a new Sign In page, providing an updated login experience for users who log in with a user name and password credentials. Current Single Sign-On (SSO) users will be able to start the SSO login process at www.concursolutions.com. This feature is planned for 2019.

The new Sign In page feature includes the following:

• Two-step login: provides enhanced security, meets current industry standards and provides a better login success rate
• Multi-account login: allows administrators to log in with multiple accounts (planned for a future release)
• User avatar: enhances the user experience (planned for a future release)

Business Purpose / Client Benefit: This feature provides better security and a faster, convenient experience for users logging in to SAP Concur products and services.

The password field in the 100, 300, 305 and 310 record sets will no longer be used to update or bulk reset user passwords. SAP Concur will change the functionality in imports such that the password field is only used when a user account is created. The field will no longer be used to update or bulk reset user passwords. The update and replace password features on the 100 record will no longer be used.

This change impacts the employee import and the user import features.

Employee Import - The password field will remain available in the 100, 300, 305 and 310 record sets, but will only be read during an initial import of the file or when creating a new user in the system. Subsequent uses of the field will be ignored by the system. The update and replace password features on the 100 record will no longer be used.

For general information about this functionality, refer to the Shared: Employee Import Specification (English Only).

User Import - The password field will remain available in the downloadable Excel template, but will only be read during an initial import of the file or when creating a new user in the system. Subsequent uses of the field will be ignored by the system.

For general information about this functionality, refer to the Shared: User Import User Guide (English Only).

Business Purpose / Client Benefit: This change provides greater security for user passwords.

To simplify the Training Administration page, the functionality and content will be changing.

In addition to content changes, access to the Training Administration page will move from Company Admin to Tools.

Business Purpose / Client Benefit: These changes will make the Training Administration feature easier to find and use.

SAP Concur is retiring the functionality in the Test User Admin feature that removes the transactions of test users from Concur Expense, Concur Invoice, Concur Travel and Concur Request.

Business Purpose / Client Benefit: This change will allow SAP Concur to devote more resources to development and maintenance of features that are used by many or most of our clients.

Single Sign-On allows users to access multiple applications using one set of login credentials. Currently, SAP Concur has two methods for signing in: with a user name and password or using SSO with identity provider (IdP) credentials, such as a user's login credentials for their organisation.

SAP Concur is planning to add a Manage Single Sign-On (SSO) feature to SAP Concur that provides clients with a self-service option for setting up SSO for their organisation. SSO is currently supported for Concur Expense, Invoice, Request and Travel.

Other SAP Concur products and services are outside the scope of this initial release.

The new Manage Single Sign-On (SSO) feature will be accessible from the Administration > Company > Company Admin page.

Business Purpose / Client Benefit: This feature provides SAP Concur clients with a self-service option for setting up SSO.

Budget

In a future release, workflows will be available for Budget. Workflows define how the system routes invoices, expense claims and requests through approval and processing steps. The flexible workflow feature for Budget that SAP Concur offers allows companies to design workflows specifically tailored to their unique needs.

Without budget review, budgets may become fully consumed well before the end of a period or year leaving an organisation with limited options and budget owners with, for example, exceeded budgets. In addition, early spending means that more important (to the organisation) spending will be declined because lesser important spending consumed the budget early on.

Combining budget review in the workflow adds value. Audit rules and workflow step rules can help organisations to add in controls when it makes sense to fine tune to an organisation's specific needs.

Equally important is the determination when a spending item is regarded as committed toward a budget. In most organisations, the commit is when a spending item is paid; it went through most if not all approval steps. In other organisations, the commit occurs much earlier. As soon as a purchase request or an authorisation request is approved, it is regarded as "promised".

Business Purpose / Client Benefit: This feature will provide clients with control over the budget spend to, for example, avoid exceeded budgets too early in a budget period or budget year.

Budget Insight

Budget Insight is a budget management tool that is being retired on 30 June 2019. Clients who want to use budget functionality are recommended to purchase the new Budget product that SAP Concur released earlier this year. The new Budget feature offers greater functionality, an improved UI and additional integrations with SAP Concur products. Most notably is the inclusion of additional expense data from Concur Expense, Concur Invoice, Concur Travel and Concur Request (previously only data from Concur Expense and Concur Request were available).

Business Purpose / Client Benefit: The retirement of Budget Insight will provide clients with the opportunity to purchase the new Budget product, which gives greater value to clients by making budgets visible, actionable and near real-time.