Audit

In preparation for an upcoming release of new functionality in expense claim auditing, three new roles have been added to the Roles section of the User Permissions > Expense tab under the Company Admin Home page. These roles currently have no impact on permissions but will be used in the future:

• Verify Administrator: Allows users to configure Verify. More information will be provided when Verify is released.

• Verify Claims Auditor: Allows users to audit Verify policy and receipt issues as part of the audit process.

• Verify Events Auditor: Allows users to audit Verify anomaly and fraud events.

Business Purpose / Client Benefit: These roles will support a new functionality that will leverage artificial intelligence to identify exceptions for auditors to review. This will improve compliance and provide a more efficient and effective auditing experience.

Audit Rules

Administrators will soon be able to configure custom audit rules based on the date value in the Digital Compliance Validation Date field. Once the custom audit rule is configured, administrators will be able to compare the receipt timestamp date with the expense entry transaction date, and able to send alerts to users/groups and stop the flow of expenses claims when regulations are not met.

Currently, the Digital Compliance Validation Date field is the e-Bunsho timestamp date used in Japan.

Digital Compliance Validation Date field considerations:

• Field calculation is based on the calendar day (business day logic is not included).

• Dates used in the number of day calculation are based on the GMT time zone. We recommend making audit rules for one day less than desired to account for the time difference between the GMT and JST time zones.

• Audit rules and compliance validations will be based on information provided by the user for the transaction date. Because users can edit transaction dates, it is the user’s responsibility to ensure the transaction date is accurate based on receipt information.

• Admins will have the ability to create multiple audit rules for comparing the transaction date with the receipt timestamp date.

This field will be available to new and existing clients.

This feature is targeted to release by early May.

Business Purpose / Client Benefit: Configuring custom audit rules for this field helps reduce manual reviews needed to compare the number of calendar days between the expense entry transaction date and the receipt timestamp date.

Authentication

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

SAP Concur support for Hash-Based Message Authentication Code (HMAC) is being deprecated. Travel Management Companies (TMCs) and SAP Concur personnel are currently assisting customers who use HMAC to migrate to SAP Concur SAML v2 SSO (SAML v2).

SAP Concur provides a Single Sign-On self-service option that enables client admins to setup their SAML v2 connections without involving an SAP Concur support representative.

For more information about the Single Sign-On self-service option, refer to the Shared: Single Sign-On Overview (English Only) and the Shared: Single Sign-On Setup Guide (English Only).

The HMAC deprecation includes two phases:

PHASE I:

• Clients must have an identity provider (IdP) or a custom SAML 2.0 compliant solution.

• Clients begin testing authentication using SAML v2.

• TMCs prepare to onboard new SAP Concur clients to SAML v2.

• Customers will be notified via release notes about the official deprecation date of HMAC. As of the official deprecation date, no new clients can be onboarded using HMAC; new clients must be onboarded to SAML v2.

• Existing clients using HMAC must migrate to SAML v2.

PHASE II:

• TMCs have migrated all existing SAP Concur clients from the HMAC service to SAML v2.

• The HMAC service is deprecated. Phase II is targeted to end mid-year in 2021.

Business Purpose / Client Benefit: This change provides better security and improved support for users logging in to SAP Concur products and services.

On 23 March, the View Previous Changes feature was added to the Administration > Company > Authentication Admin > Manage Single Sign-On page. This feature enables the Authentication Admin to view a table that lists SAP Concur Single Sign-On (SSO) configuration changes, view details of those changes and revert (reinstate) deleted configurations.

The View Previous Changes table can display the last 100 changes. Changes that are listed in the table include:

• Adding a configuration

• Deleting a configuration

• Editing the name in the Custom IdP Name field

• Editing the URL in the Logout URL field

Business Purpose / Client Benefit: This change enables the Authentication Admin to view and track changes made to the SSO configuration over time and to revert (reinstate) configurations that were previously deleted.

Cards

With the January 2021 release, the Account Number field on the Create New Card Account page was updated to allow configuration of account numbers with as few as 12 digits. Previously, the Account Number field would only allow configuration for account numbers with at least 14 digits.

This change occurred because AirPlus separated Virtual Cards from the Company Account and implemented new 12-digit account numbers for them in March 2021.

Business Purpose / Client Benefit: This change ensures that lodge accounts with account numbers as few as 12 digits can be configured. This change also helps ensure that there is no disruption in the processing of card transactions for AirPlus clients.

Expense Pay – Classic

In January 2021, for clients in Singapore, the process for submitting a completed Interbank GIRO Application changed to you submitting the completed application directly to your bank in Singapore. As of this release, that process update has been reversed by SAP Concur.

Business Purpose / Client Benefit: This change aligns with current client expectations.

Expense Pay – Global

The Expense Pay – Global payment-processing partner, Bambora, now requires a bank reference letter to complete onboarding activity.

To comply with the Bambora changes, Concur Expense indicates where to download and upload the bank reference letter on the user interface (UI) (and that it is required.)

Also, to help clarify which documents are required, the "Registration Documents" label on the Concur Expense UI has been changed to "Business Registration Documents (i.e. certificate of incorporation, non-profit registration, etc.)"

Business Purpose / Client Benefit: These changes reflect routine maintenance of the onboarding UI.

With this change, we are expanding the list of euro (EUR) countries that can be selected by users on the Bank Information page in Profile. The list now includes most European Union (EU) countries and European Economic Area (EEA) countries where the Single Euro Payment Area (SEPA) Scheme is currently supported.

The additional bank countries/regions are:

• Åland Islands

• Bulgaria

• Croatia

• Cyprus

• Czech Republic

• Estonia

• Gibraltar

• Guernsey

• Hungary

• Iceland

• Isle of Man

• Jersey

• Latvia

• Liechtenstein

• Lithuania

• Malta

• Monaco

• Norway

• Romania

• Saint Barthélemy

• Saint Martin (French part)

• San Marino

• Slovakia

• Slovenia

Business Purpose / Client Benefit: This change allows clients with employees in these countries to enter their banking information so Expense Pay - Global can process their euro reimbursements moving forward, instead of having to process those transactions outside of Concur Expense.

File Transfer Updates

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and suppliers participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of 10 April, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

• Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.

• SFTP file transfer accounts that use password authentication must switch to SSH key authentication.

• SFTP password reset requests require the client to provide an SSH key for authentication.

On 12 April, 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

• st-eu.concursolutions.com

• vs.concursolutions.com

• vs.concurcdc.cn

Business Purpose / Client Benefit: These changes provide greater security and efficiency for file transfers.

This Release Note is intended for the technical staff responsible for file transmissions with SAP Concur. For our customers and suppliers participating in data exchange, SAP Concur is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and 31 July 2021. After they are migrated to the more efficient process, clients will see the following improvement:

• With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

Business Purpose / Client Benefit: These changes provide greater security and efficiency for file transfers.

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

concursolutionsrotate.asc

• Key file is available in client’s root folder

• Key ID 40AC5D35

• RSA 4096-bit signing and encryption subkey

• Key expires every 2 years

• Client is responsible for replacing the key before it expires

  • Next expiry date: 4 September 2022

  • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

• mft-us.concursolutions.com

• vs.concursolutions.com

• st-eu.concursolutions.com

• mft-eu.concursolutions.com

Business Purpose / Client Benefit: The rotating public PGP key provides greater security for file transfers.

NextGen UI

The continued evolution of the Concur Expense solution user interface experience is the result of thoughtful design and research that provides a modern, intuitive and streamlined experience for creating and submitting expense claims.

Concur Expense customers have the ability to preview and then opt in to the NextGen UI before the mandatory move.

Business Purpose / Client Benefit: The result is the next generation of the Concur Expense user interface designed to provide a modern, consistent and streamlined user experience. This technology not only provides an enhanced user interface, but also allows us to react more quickly to customer requests to meet changing needs as they happen.

Claims

Concur Expense now offers a new, shorter identifier for an expense claim: The claim number is a six-character alphanumeric number that is a unique identifier for an expense claim. This new identifier supplements the existing Claim ID, which is a twenty-character unique identifier. The claim number is populated for all expense claims created after 31 March, 2020.

Please refer to the following release notes in the Claims section in this document: Claim Number Column for Processors, Claim Number Field for Expense Claim Header, Claim Number Field for Printed Claims.

Business Purpose / Client Benefit: This shorter claim number makes communication about specific expense claims easier for users, approvers and processors.

Processors now have the option to add a new Claim Number column to the Process Claims page. The Claim Number column displays a six-character alphanumeric number that is a unique identifier for an expense claim, which helps make identifying and tracking specific expense claims easier.

Processors who want to view the claim number can add this column to their individual list settings for the claim list. Processors may also use the claim number in search filters to quickly identify and process expense claims.

Business Purpose / Client Benefit: This shorter claim number makes communication about specific expense claims easier for users, approvers and processors.

Claim Header may now include Claim Number as the claim identifier. Claim Number is a new unique 6-character (alphanumeric) claim identifier introduced as part of the NextGen UI. This field is visible in the claim header if configured in the form in NextGen UI.

Business Purpose / Client Benefit: This shorter number makes identifying and tracking specific expense claims easier for users, approvers and processors.

Printed claims may now include Claim Number as the claim identifier. Claim Number is a new unique 6-character (alphanumeric) claim identifier introduced as part of the NextGen UI. This field is visible on a printed claim for users under either current or NextGen UI.

Business Purpose / Client Benefit: This shorter number makes identifying and tracking specific expense claims easier for users, approvers and processors.

Workflow

A new setting labelled Automatically assign authorised approvers, if enabled, ensures that all Authorised Approval steps in the workflow are pre-populated with an assigned Authorised Approver.

Without this new setting, when there were multiple authorised approvers to choose from, the user was required to select a name before the claim could proceed to the next workflow step.

Business Purpose / Client Benefit: Using this setting ensures that all authorised approval steps have an assigned approver for the expense report without user action. For most organisations, there is typically one choice per step or a small number of possible approvers, whereby any of them is eligible.

Security

To ensure the ongoing security of our products and services, the concursolutions.com SSL certificate is updated on an annual basis. The current certificate was issued on 14 April, 2020 and will expire when SAP Concur issues a new certificate on 26 May, 2021.

Clients who have not pinned the expiring certificate do not need to take any action as their expiring certificate will be renewed automatically. Most clients do not pin the certificate.

SAP Integration with Concur Solutions (SAP ICS) clients and all other clients who have pinned the expiring certificate must update to the new certificate before the new certificate is issued on 26 May, 2021.

Clients who have pinned the certificate and do not update it with the new certificate by 26 May, 2021 will experience disruption to SAP Concur products and services.

Business Purpose / Client Benefit: Annual certificate renewal provides ongoing security for our products and services.