Authentication

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

SAP Concur will soon begin the deprecation process of removing Hash-Based Message Authentication Code (HMAC) as an SSO option. The replacement service for HMAC is SAML SSO, which will be a self-service method of setup whereby Company Admins will have access within SAP Concur to complete their SAML connections.

Clients currently using HMAC are encouraged to migrate to the SSO self-service tool as soon as it is released (targeted for the end of October; not on the scheduled monthly release date). The new SSO self-service tool will be offered as a free feature to all clients. The new SSO self-service tool allows multiple portals (Identity Providers) to be added.

The HMAC deprecation includes two phases:

PHASE I:

• Clients need to have an Identity Provider (IdP) or a custom SAML 2.0 solution.

• Clients begin testing the new SSO self-service tool. Testing can begin as soon as July 2019 if preparation steps have been met.

• Clients prepare for onboarding new clients using the new SSO self-service tool, which is targeted for release at the end of October 2019 (not on the scheduled monthly release date).

• Once the SSO tool is available, customers will be notified via release notes about the official deprecation date of HMAC. As of the official deprecation date, no new clients can be onboarded using HMAC; new clients must be onboarded using the new SSO self-service tool.

• Existing clients using HMAC need to be migrated using the new SSO self-service tool.

PHASE II:

• Clients continue migrating existing HMAC clients to the new SSO self-service tool.

• Shut down the HMAC service after everyone has migrated from HMAC to the new SSO self-service tool. Phase II is targeted to end mid-year 2020.

Business Purpose / Client Benefit: This change provides better security and improved support for users logging in to SAP Concur products and services.

When a user signs in to SAP Concur, one of the validation processes includes checking for and adhering to any IP Restrictions (IPRs). IPRs are specific IPs or IP ranges that are defined by a company to restrict the IPs from which their users can sign in to SAP Concur. An IPR can be a string that contains a list of acceptable IP addresses and/or IP address patterns, for example: "170.242.6.43;170.243.70.42;170.243.70.43;171.159.*.*".

Currently, IPRs are set for each of a company's travel configurations, which creates maintenance issues for companies with many travel configurations and provides opportunities for errors. In addition, new travel configurations are not automatically included and can easily be forgotten.

With this release, SAP Concur will change this setting from a configuration-level setting to a company-level setting. With the change, one set of IPRs will apply to the entire company.

Be aware that there are very few customers who will be affected by this change. In addition, all of the affected customers will be contacted individually – in advance – by SAP Concur to make any required settings changes.

Business Purpose / Client Benefit: Customers who use IPRs can be assured that the IPRs apply to the entire company.

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

In October 2019, the SAP Concur Sign In page will be updated, providing a new login experience for both direct SAP Concur username/password users and Single Sign-On (SSO) users. SSO users will start the SP-initiated SSO login process at www.concursolutions.com.

The new SAP Concur Sign In page features a two-step login process that provides enhanced security, meets current industry standards and provides a better login success rate. This feature is targeted for late October 2019.

Business Purpose / Client Benefit: This feature provides better security and a faster, convenient experience for users logging in to SAP Concur products and services.

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

Single Sign-On allows users to access multiple applications using one set of login credentials. Currently, SAP Concur has two methods for signing in: with a user name and password or using SSO with Identity Provider (IdP) credentials, such as a user's login credentials for their organisation.

Targeted for the end of October 2019 (not the scheduled monthly release date), SAP Concur is planning to add a Manage Single Sign-On (SSO) feature to SAP Concur products, which provides clients with a self-service option for setting up SSO for their organisation. SSO is currently supported for Concur Expense, Invoice, Request and Travel.

The new Manage Single Sign-On (SSO) feature is a replacement tool for clients using existing SSO configuration and a new tool for clients that now want to implement SSO at their organisation. Existing SSO configuration and the new SSO Self-Service tool will both be available until everyone has migrated to the new SSO Self-Service tool.

• The new Manage SSO feature includes the following:

• A free, self-service option for setting up SSO at your organisation; this new feature is automatically available to all clients
• The new SAML2 service, which complies with SAML 2.0 and is a current industry standard
• Encrypted SAML assertion to address privacy and security concerns
• Enforcement of SSO at the company level (the ability to select SSO as optional is also available)
• The ability to upload multiple Identity Provider (IdP) metadata
• The ability to download SAP Concur Service Provider metadata

Business Purpose / Client Benefit: This feature provides SAP Concur clients with a self-service option for setting up SSO and for existing SSO clients who must eventually migrate to the new SSO service to manage SSO for their users.

Company Bill Statement Reports

In case you missed it, the SAP Concur mobile app now supports approval of Company Bill Statement reports.

For more information, refer to the May 2019 Mobile Professional Edition Admin Summary topic, Version 9.69 - Associated web release: May 2019.

E-Receipts

As part of our ongoing commitment to e-receipts and the effortless expense claim, air e-receipts generated by SAP Concur based on ticket and coupon data from GDS and some TripLink transactions have been updated.

The new e-receipt format will be released in stages, targeting the October timeframe.

User / Customer Benefit: This change brings air e-receipts up to SAP Concur’s standard e-receipt format, providing users with a more consistent experience. The format is also more convenient for users working in SAP Concur's new Expense user interface, NextGen Expense. This change also eliminates a performance/stability issue for end users who would sometimes not see new air e-receipts as quickly as they should.

Uber will be deprecating an older connection method to Concur Expense, called SMTP or "Receipt Images via Email". Uber is currently emailing certain SAP Concur users asking them to reconnect their Concur Expense account to their Uber account.

This is a result of Uber updating their integration to the more robust SAP Concur Receipts v4 API and subsequently deprecating the SMTP connection. SMTP is a non-App Centre connected / non-OAuth integration which forwards PDF images of receipts to the user’s Concur Expense account.

Specifically, SAP Concur users who received this email are those that set up a Business Profile within the Uber app, selected Concur as their Expense provider and verified an email address associated with their Concur Expense account. Connecting to SMTP was available until March 2019.

SAP Concur users who, when prompted by this email, reconnected their Concur Expense and Uber accounts will continue to receive e-receipts from Uber displayed in Concur Expense.

Business Purpose / Client Benefit: Uber will be deprecating their SMTP/"Receipt Images via Email" connection in favour of the more robust Receipts v4 integration in the SAP Concur App Centre. The SMTP connection did not provide many of the features offered by the Receipts v4 integration, including pre-populated expense fields and matching to corporate card transactions (if available).

Benefits of the new Receipts v4 integration available in the SAP Concur App Centre include:

• Global availability – works across US & EU Data Centres

• Easier connection login

• Better receipt image rendering

• Richer receipt data, such as ride location and times

• All standard Expense fields are pre-populated with data

• Automatically matched to a corporate card transaction, when applicable

Expense Pay

For USD and CAD currencies, SAP Concur’s Expense Pay – Global product has now replaced our legacy Expense Pay (classic) offerings (including NA Pay, EMEA Pay and next APA Pay.)

EXPENSE PAY – NORTH AMERICA AND EXPENSE PAY – EMEA LIMITATIONS

SAP Concur does not support clients adding the following currencies with the classic product: United States Dollars, Canadian Dollars, Mexican Pesos, European Euro, Swiss Franc, Danish Krone, Swedish Krona or UK Pounds. If a client has already implemented and is using these currencies with the classic product, they can continue using these until they are migrated to the new platform or until the defined sunset date.

Please also be aware of the following release note in the June version of this document: Expense Pay | New Approval Process for Classic Funding Accounts (English Only).

Business Purpose / Client Benefit: The Expense Pay – Global offering maintains industry best practices for payment processing functionality within SAP Concur.

File Transfer Updates

This release note is intended for technical staff responsible for file transmissions with SAP Concur. For our customers and suppliers participating in data exchange through various secure file transfer protocols, SAP Concur is making changes that provide greater security for those file transfers.

SAP Concur will implement source Internet Protocol (IP) checking for all Europe, the Middle East and Africa (EMEA) file transfer accounts on 21st October, 2019.

This announcement pertains to the following file transfer DNS endpoint:

• st-eu.concursolutions.com

Business Purpose / Client Benefit: These changes provide greater security for file transfers.

This release note is intended for technical staff responsible for file transmissions with SAP Concur. For our customers and suppliers participating in data exchange through various secure file transfer protocols, SAP Concur is making changes that provide greater security for those file transfers.

As of 8 AM PDT, 14 October, 2019, SAP Concur will no longer support the following unsecure SSH protocol algorithms/ciphers:

• (key exchange) diffie-hellman-group-exchange-sha1

• (encryption) aes128-cbc

• (encryption) aes192-cbc

• (encryption) aes256-cbc

• (message authentication code) hmac-md5

• (message authentication code) hmac-sha1-96

• (message authentication code) hmac-md5-96

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

• st-eu.concursolutions.com

• st-cge.concursolutions.com

• st-cge-dr.concursolutions.com

• vs.concursolutions.com

• vs.concurcdc.cn

If assistance is required, please contact SAP Concur support.

For more information, refer to the Shared: File Transfer for Customers and Vendors User Guide (English Only). (This guide is located with the other Expense, Invoice and/or Request setup and user guides.)

Business Purpose / Client Benefit: These changes provide greater security for file transfers.

Miscellaneous

For clients who use the SAP Concur Quick Help, be aware that it will be expanded with this release. Quick Help helps manage diverse client expectations with a wide variety of support resources in the form of multi-step tutorials, help videos and documents that are easily available when they log into their SAP Concur resources.

In addition to self-service content, the Quick Help tool makes it easier for the client's SAP Concur admin to contact SAP Concur for assistance via chat and phone.

Quick Help has been available on limited admin pages to the client's SAP Concur admin and – with the September release – we are expanding it to all pages. That is, if a user has an admin role/permission, then that user will see the Quick Help on all pages.

This tool is free of charge to all clients who have Expense, Invoice, Request or Travel.

For more information about this tool, refer to this video: SAP Concur Professional Edition Quick Help (English Only)

Business Purpose / Client Benefit: SAP Concur Quick Help tool is used to accelerate client onboarding and to create a quick and efficient way for clients to find easy-to-access help on their own while they’re logged into their SAP Concur site.

Recently, SAP Concur support introduced the Co-browse feature for all Authorised Support Contacts (ASCs). With this release, SAP Concur End User Support will provide the same screen-share service for companies that use the User Support Desk (USD) service. USD is an SAP Concur service that provides direct Help Desk services for the company's end users. These end users will now be able to use the co-browse feature.

Business Purpose / Client Benefit: Screen sharing often makes a problem easier to describe, easier to understand and quicker to resolve – saving time for end users and SAP Concur support.

Next Generation (NextGen) Expense

Update: In order to respond to and take advantage of feedback from customers, and to align with SAP Concur’s commitment to ensure a smooth and successful transition, we are working on a revised deployment strategy for Next Generation Expense.

SAP Concur is dedicated to the consistent improvement of our products, not only the features they provide, but also the experience of using those features. How users interact with technology changes over time, along with needs and expectations. We are constantly listening to our customers and soliciting feedback on how we can improve the user experience.

NextGen Expense is the continued evolution of the SAP Concur user experience. It was built from extensive user research and data analytics that include 680 1:1 conversations, 58 usability studies, 3,000+ survey responses and 1.3B monthly user actions.

Customers will have the ability to preview and then opt in to NextGen Expense before the mandatory cutover.

Business Purpose / Client Benefit: The result is the next generation of the Expense user interface designed to provide a modern, consistent and streamlined user experience. This technology not only provides an enhanced UI, but also allows SAP Concur to react more quickly to customer requests to meet changing needs as they happen.

Quick Expense

Effective 31 March, 2020, the Quick Expense v3 API will be retired. We encourage all current users to migrate to Quick Expense v4 as soon as possible. Please note that after the API is in a retired state the API will be decommissioned in a future release.

Please refer to the deprecation policy for definitions and additional information.

Business Purpose / Client Benefit: This update will remove an outdated API.

Receipts

As of 1 October, 2019, SAP Concur allows the conversion of paper receipts into digital copies with legal value. Receipt Digitalisation enables SAP Concur customers to conform a paper receipt into a legal digital copy according to their country's regulatory or government authorities.

This feature is available to new and existing clients in France and those who have configurations in France. Additional countries will be included in future releases.

The release for France includes:

• Enabling the conversion of paper receipts into digital copies with legal value

• Viewing the "Certified" status of the digitised receipt in NextGen Expense

• Configuring audit rules that look for expenses with paper receipts

The Receipt Digitalisation feature requires that users must be using the NextGen Expense UI. It is required that clients migrate users that will use this feature to the NextGen Expense UI before activating this service.

To capture legal copies of original paper receipts, clients must also be using the latest version of the SAP Concur mobile app and can use ExpenseIt with the mobile app, though ExpenseIt is not required. The user takes a picture of the paper receipt within the mobile app. Once the picture is taken, the digitisation process is applied to the image. Once the process is complete, a stamp displays on the digitised receipt in the mobile app confirming whether the receipt is certified.

Digitised receipts display for users in NextGen Expense in Available Expenses, Available Receipts and in the expense list, like any other receipt.

Approvers and processors will view the "Certified" receipt status in the expense claim and expense list in the existing version of Concur Expense. Audit rules can be created that identify certified receipts on the expense line item. A new icon displays for receipts that are certified.

Business Purpose / Client Benefit: This feature provides a paperless receipt option that adheres to requirements and regulations for France for paper into digital tax receipt processing and compliance.

As of 1 October, 2019, SAP Concur allows the conversion of paper receipts into digital copies with legal value. Receipt Digitalisation enables SAP Concur clients to conform a paper receipt into a legal digital copy according to their country's regulatory or government authorities.

The feature is available to new and existing clients in Spain and those who have configurations in Spain. Additional countries will be included in future releases.

The release for Spain includes:

• Offering a solution audited and homologated by the Spanish tax authority, Agencia Estatal de Administración Tributaria (AEAT)

• Enabling the conversion of paper receipts into digital copies with legal value

• Configuring audit rules that look for expenses with paper receipts

• Viewing the "Certified" status of the digitised receipt in NextGen Expense

For more information regarding homologated software, refer to the AEAT (Spanish Only) website.

The Receipt Digitalisation feature requires that users must be using the NextGen Expense UI. It is required that clients migrate users that will use this feature to the NextGen Expense UI before activating this service.

To capture legal copies of original paper receipts, clients must also be using the latest version of the SAP Concur mobile app and can use ExpenseIt with the mobile app, though ExpenseIt is not required. The user takes a picture of the paper receipt within the mobile app. Once the picture is taken, the digitisation process will be applied to the image. Once the process is complete, a stamp displays on the digitised receipt in the mobile app confirming whether the receipt is certified.

Digitised receipts display for users in NextGen Expense in Available Expenses, Available Receipts and in the expense list, like any other receipt.

Approvers and processors will view the "Certified" receipt status in the expense claim and expense list in the existing version of Concur Expense. Audit rules can be created that identify certified receipts on the expense line item. A new icon displays for receipts that are certified.

Business Purpose / Client Benefit: This feature provides a paperless receipt option that adheres to requirements and regulations in Spain for paper into digital tax receipt processing and compliance.