Request

SAP Concur is transitioning to a new email infrastructure for outbound email from our services to SAP Concur users. Because of this, companies who filter inbound email based on the sending IP address must add new IP addresses to their Safe Sender list to ensure that their users receive email from SAP Concur.

Initially, the issue described here affected only companies that use Concur Expense. Starting in January, email from other SAP Concur services (such as Travel and Concur Pay) will move to the new email infrastructure.

We will continue to add other services. Please monitor the release notes for more information about the timing of the additional changes.

With this release, customers must access SAP Concur products and services via the following domains:

• *.concursolutions.com
• *.concurcdc.cn

SAP Concur recommends clients migrate to one of the domains at their earliest convenience, if they are not already using one of them.

Please contact appsec@sap.com for any questions regarding this change.

Business Purpose / Client Benefit: This change will allow customers to access SAP Concur services in a consistent, secure manner.

Request

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

When a user signs in to SAP Concur, one of the validation processes includes checking for and adhering to any IP Restrictions (IPRs). IPRs are specific IPs or IP ranges that are defined by a company to restrict the IPs from which their users can sign in to SAP Concur. An IPR can be a string that contains a list of acceptable IP addresses and/or IP address patterns, for example: "170.242.6.43;170.243.70.42;170.243.70.43;171.159.*.*".

Currently, IPRs are set for each of a company's travel configurations, which creates maintenance issues for companies with many travel configurations and provides opportunities for errors. In addition, new travel configurations are not automatically included and can easily be forgotten.

Targeted for the August release, SAP Concur will change this setting from a configuration-level setting to a company-level setting. With the change, one set of IPRs will apply to the entire company.

Be aware that there are very few customers who will be affected by this change. In addition, all of the affected customers will be contacted individually – in advance – by SAP Concur to make any required settings changes.

Business Purpose / Client Benefit: Customers who use IPRs can be assured that the IPRs apply to the entire company.

(Release note updated: 8 June)

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

In a future release, the SAP Concur Sign In page will be updated, providing a new login experience for both direct Concur username/password users and Single Sign-On (SSO) users. SSO users will be able to start the SP-initiated SSO login process at www.concursolutions.com.

The new Sign In page feature will include a two-step login process that will provide enhanced security, meet current industry standards and provide a better login success rate. This feature is planned for 2019.

Business Purpose / Client Benefit: This feature provides better security and a faster, convenient experience for users logging in to SAP Concur products and services.

(Release note updated: 8 June)

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

Single Sign-On allows users to access multiple applications using one set of login credentials. Currently, SAP Concur has two methods for signing in: with a user name and password or using SSO with identity provider (IdP) credentials, such as a user's login credentials for their organisation.

SAP Concur is planning to add a Manage Single Sign-On (SSO) feature to SAP Concur products that provides clients with a self-service option for setting up SSO for their organisation. SSO is currently supported for Concur Expense, Invoice, Request and Travel.

The new Manage Single Sign-On (SSO) feature is a replacement tool for clients using existing SSO configuration on the Security Keys page and a new tool for clients that now want to implement SSO at their organisation. Existing SSO configuration on the Security Keys page and the new SSO Self-Service tool will both be available until everyone has migrated to the new SSO Self-Service tool.

Other SAP Concur products and services are outside the scope of this initial release.

This feature is targeted for Q3 2019.

Business Purpose / Client Benefit: This feature provides SAP Concur customers with a self-service option for setting up SSO and for existing SSO customers who must eventually migrate to the new SSO service to manage SSO for their users.

Non-SFTP (Secure File Transfer Protocol) protocols and password authentication will eventually be deprecated.

NEW CUSTOMERS

New file transfer accounts must use SFTP with Secure Shell (SSH) Key Authentication.

EXISTING CUSTOMERS

Existing non-SFTP file transfer accounts need to switch to SFTP with SSH Key Authentication.

Business Purpose / Client Benefit: These changes provide greater security for file transfers.

SAP Concur will implement source Internet Protocol (IP) checking for all Europe, the Middle East and Africa (EMEA) file transfer accounts beginning on 15 July 2019.

NEW CUSTOMERS

The IP addresses for new customers will be added by SAP Concur during new customer implementation to the SAP Concur access control list (ACL).

EXISTING CUSTOMERS

Please contact SAP Concur support by 1 July 2019 to have your source IP addresses added to the SAP Concur access control list (ACL).

Business Purpose / Client Benefit: These changes provide greater security for file transfers.

Budget Insight

Budget Insight is a budget management tool that is being retired on 31 December 2019. It is recommended that clients who want to use budget functionality purchase the new Budget product that SAP Concur released last year. The new Budget feature offers greater functionality, an improved UI and additional integrations with SAP Concur products. Most notably is the inclusion of additional expense data from Concur Expense, Concur Invoice, Concur Travel and Concur Request (previously only data from Concur Expense and Concur Request were available).

Business Purpose / Client Benefit: The retirement of Budget Insight will provide clients with the opportunity to purchase the new Budget product, which gives greater value to clients by making budgets visible, actionable and near real-time.

SAP Concur will rename the "Budget Approver step" in the Step Name column to "Legacy Budget Approver step" on the Workflows page to make a clearer distinction between the Budget Insight and Budget feature.

Business Purpose / Client Benefit: This enhancement makes it easier for clients to see what product they use.