File Transfer Updates

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and suppliers participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of 10 April, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

• Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.

• SFTP file transfer accounts that use password authentication must switch to SSH key authentication.

• SFTP password reset requests require the client to provide an SSH key for authentication.

On 12 April 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

• st-eu.concursolutions.com

• vs.concursolutions.com

• vs.concurcdc.cn

Business Purpose / Client Benefit: These changes provide greater security for file transfers.

This Release Note is intended for the technical staff responsible for file transmissions with SAP Concur. For our customers and suppliers participating in data exchange, SAP Concur is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and 24 January 2022. After they are migrated to the more efficient process, clients will see the following improvement:

• With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

Business Purpose / Client Benefit: These changes provide greater security and efficiency for file transfers.

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

concursolutionsrotate.asc

• Key file is available in client’s root folder

• Key ID 40AC5D35

• RSA 4096-bit signing and encryption subkey

• Key expires every 2 years

• Client is responsible for replacing the key before it expires

  • Next expiry date: 4 September 2022

  • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

• mft-us.concursolutions.com

• vs.concursolutions.com

• st-eu.concursolutions.com

• mft-eu.concursolutions.com

Business Purpose / Client Benefit: The rotating public PGP key provides greater security for file transfers.

Miscellaneous

On 20 September 2021, a new permission, SAP Fiori Theme Preview, was added to the list of permissions in Concur Travel Professional edition. When the SAP Fiori Theme Preview permission is assigned to a user, the user sees a new switch in the header of their SAP Concur site. They will also see a New Theme info bubble.

The switch enables the user to switch from the SAP Concur standard theme to the SAP Fiori Theme. The info bubble displays a brief message about the switch.

The new theme includes changes to visual elements such as fonts, colours and icons. In addition, some top-level tabs and menu items are relocated to the SAP Concur Home menu. These changes are site-wide and apply to all of the user’s SAP Concur products.

Clients who opt-in to preview the SAP Fiori Theme and who want to provide feedback can register on the following page to participate in the SAP Continuous Influence program:

SAP Customer Influence

After registering or logging in, clients can request to participate in the following opportunity:

Hands-on system Approach of Consistent User Experience based on SAP IE Scenario Travel-to-Reimburse

The opportunity is targeted to run from November 2021 to May 2022. Registration for this SAP Customer Influence opportunity is limited and might close prior to the targeted end date.

Business Purpose/Client Benefit: The SAP Fiori theme harmonises the look and feel of the SAP Concur UI with the look and feel of other SAP products, providing a more consistent user experience. The permission enables a client admin to allow designated users to preview and test the SAP Fiori theme.

With this release, the Profile menu within the SAP Fiori theme has been updated. This update includes changes to the layout of the menu items and some changes in functionality.

Business Purpose/Client Benefit: The Profile menu is now functionally more efficient in its design within the SAP Fiori theme and in the ease-of-use for the admin. Overall, the SAP Fiori theme harmonises the look and feel of the SAP Concur offerings with those of other SAP products, providing a more consistent user experience.

In Q4, 2021, SAP Concur began redirecting clients to a new homepage. The appearance of the new homepage is identical to the previous SAP Concur homepage. The new homepage has enhanced functionality when services become temporarily unavailable.

The roll out of the new homepage is phased:

• Phase 1: At the beginning of Q4, SAP Concur began redirecting Concur Expense, Concur Invoice and Concur Request clients in the US Datacentre to the new homepage.

• Phase 2: In December 2021, SAP Concur will begin redirecting Concur Expense, Concur Invoice and Concur Request clients in the EU Datacentre to the new homepage.

• Phase 3: In Q2 of 2022, SAP Concur will begin redirecting the remaining clients in the US and EU datacentres to the new homepage. The remaining clients include those with Concur Travel standalone or Concur Travel with Expense, Invoice and/or Request.

Business Purpose/Client Benefit: This change ensures that the SAP Concur homepage is available even when some services are unavailable and improves the consistency of the sign-in experience.

NextGen UI for Concur Request

The continued evolution of the Concur Request solution user interface experience is the result of thoughtful design and research that provides a modern, intuitive and streamlined experience for the request process.

Concur Request customers are now strongly encouraged to preview and then move to the NextGen UI well before the automatic transition date of 1 October, 2022.

Business Purpose/Client Benefit: The result is the next generation of the Concur Request user interface designed to provide a modern, consistent and streamlined user experience. This technology not only provides an enhanced user interface, but also allows us to react more quickly to customer requests to meet changing needs as they happen.

Release Note Admin Summaries

Previously, the monthly release note admin summaries were provided in two file formats:

• As PDF files from the classic landing pages

• As HTML files from the in-product Help systems and the SAP Help Portal

SAP Concur now provides only HTML files from the in-product Help system and the SAP Help Portal.

Business Purpose/Client Benefit: A single location provides a consistent user experience for accessing this content and frees resources for work on new content.

SAP Concur Platform

As of 31 May 2021, the existing Concur Request APIs (v1.0, v3.0 and v3.1) are deprecated. On 1 June 2021, SAP began retiring these APIs in accordance with the SAP Concur API Lifecycle & Deprecation Policy. These APIs are replaced by the Concur Request v4 APIs. SAP will no longer support these APIs after retirement.

As of 30 November 2021, the retirement phase for the existing Concur Request APIs (v1.0, v3.0 and v3.1) is completed.

Decommissioning of the v1.0, v3.0 and v3.1 APIs will start three months after retiring the APIs. The specific dates for decommissioning are dependent on the individual client's API migration.

API Timeline for v1.0, v3.0, v3.1:

• Deprecation – 1 March, 2020 – 31 May, 2021

• Retirement – 1 June, 2021 – 30 November, 2021

• Decommission – starts after 3 months of inactivity at the retired state

Business Purpose / Client Benefit: The Concur Request APIs v1.0, v3.0 and v3.1 only support the previous authentication method, which is not best security practice and does not meet the Oauth2 standards. In addition, the previous versions of the Concur Request APIs provided limited possibilities for moving a Request through the approval workflow, as well as managing custom simple & connected list fields. These issues are resolved with the new Concur Request v4 APIs.

In addition, SAP has run a backward compatibility project between the current Concur Request APIs and the new Concur Request v4 APIs (not ISO-compatibility) in order to have the vast majority of use cases managed in the previous versions also be managed in the Concur Request v4 APIs.

SAP Concur User Assistance

This release note is a reminder to all admins about the resources available for end users to find support. SAP provides many support pathways for many products. The options listed in this release note are the only correct ones for SAP Concur end users. Admins should send the list of self-serve resources below to their end users for visibility.

SAP Concur solutions end users receive support in one of the following ways:

• User Support Desk (USD): If your company has purchased User Support Desk, end users can access support within the SAP Concur application. Click Help > Contact Support to access the User Support Desk Portal and begin support via phone or chat.

• Internal support: If your company has not purchased USD, end users work with internal contacts to support their SAP Concur solution, and supplement with the self-serve resources in the next section.

SELF-SERVE END USER RESOURCES

There are multiple locations where end users can find additional information, training resources and FAQs. All users can access these links.

SAP Concur Community:

https://community.concur.com/

Support Info and FAQs on SAP Concur Community:

https://community.concur.com/t5/Support-and-FAQs/bg-p/Support

Professional Edition SAP Concur Training Toolkit:

http://www.concurtraining.com/

Standard Edition SAP Concur Training Toolkit:

http://www.concurtraining.com/toolkit/standard/en

Concur Expense End-User Online Help:

https://help.sap.com/viewer/product/CONCUR_EXPENSE/LATEST/en-US?task=use_task

Concur Invoice End-User Online Help:

https://help.sap.com/viewer/product/CONCUR_INVOICE/LATEST/en-US?task=use_task

Concur Request End-User Online Help:

https://help.sap.com/viewer/product/CONCUR_REQUEST/LATEST/en-US?task=use_task

Concur Travel End-User Online Help:

https://help.sap.com/viewer/product/CONCUR_TRAVEL/LATEST/en-US?task=use_task

Test Entities

As part of SAP Concur routine data maintenance and operations, we will begin deleting stagnant data in SAP Concur Production Sandbox Environments (test entities).

Beginning 6 December 2021, test entities that have not been signed in to within 180 days will be deleted. For example, if a test entity has not been logged into between 9 June 2021 and 6 December 2021, it will be deleted on 6 December, 2021.

As of January 2022, as part of this ongoing routine data maintenance, test entities that have not been signed in to within 180 days will also be deleted on a regular basis, as such data is considered to be stagnant in accordance with applicable law. Any customisations to the test entities will not be recoverable in the event of deletion.

Business Purpose/Client Benefit: This maintenance activity supports SAP and client data compliance requirements by minimising the retention of personal data outside of the live production environment.

Web Services Administration

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

To meet new security requirements, the length of the username and password associated with an application connector on the Application Connectors page must be at least 10 characters long and not more than 50 characters long.

Some clients currently have usernames and passwords configured that do not meet these parameters.

On 28 February 2022, the 10-character minimum and 50-character maximum will be enforced. If the usernames and passwords are not updated prior to this change, some aspects of SAP Concur solutions might stop working. For example, workflow steps will not complete if using notifications, LEU windows will not open and there will be no results in fields using fetch lists.

To avoid disruption of callouts through application connections and subsequent disruption of some end-user tasks, SAP recommends updating your application connector username(s) and password(s) as soon as possible.

Application connection usernames and passwords can be updated by an administrator with the Company Administrator or Web Services Administrator role.

Business Purpose / Client Benefit: Enforcing password and username length restrictions improves the security standards for callouts made through the application connector.

There are no planned changes this month.