Customers that use AD FS as their third-party SSO provider, and have issues with SSO within the corporate network, need to know the following:

• SAP Concur mobile in-app web views do not support Windows Integrated Authentication (WIA)

• SAP Concur mobile in-app web views may have a user agent that matches one of the templates enlisted in WIASupportedUserAgentStrings. Find more information about these templates here: https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-intranet-forms-based-authentication-for-devices-that-do-not-support-wia

With this release, mobile users can now capture higher quality receipt images - with the new camera aide feature - within the SAP Concur mobile app. This feature is available to most users during this release and to all mobile users over the following months.

When the camera aide feature is enabled, users will see hints at the bottom of the camera screen on how to capture better images. If the receipt is well positioned, this feature will also crop out the areas without text.

When the camera aide feature is enabled, the camera aide icon will appear in the upper-left corner of the camera screen.

With this release, SAP Concur added a new built-in gallery within the mobile app. Mobile users can now select images - captured from their mobile device - without leaving the SAP Concur mobile app.

To access the new built-in gallery, the user taps on the gallery icon (lower-right corner) on the camera screen.

Clients that use or plan to use SAP Concur callouts (for example, Send Notification, Launch External URL, Fetch List and Fetch Attendee) need to ensure they meet the SAP Concur security standards. To reduce security risk for our clients and SAP Concur, we are giving companies until the end of 2019 to make the required update for callouts. If clients have security protocols below our standard after 31 December, 2019, their callouts will stop working in January 2020.

To use callouts, clients need to ensure that the TLS version 1.1 or greater is used for the encryption protocols of the client’s endpoint. Also, clients using callouts need to ensure their callout host endpoint uses and prioritises one or more ECDHE cipher suites with an equivalent key length greater than or equal to 2,048 bits, such as one of the ciphers listed below.

EXAMPLES OF CIPHERS TO USE

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030)

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f)

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (0xcca8)

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028)

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027)

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014)

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013)

Business Purpose / Client Benefit: Reduce security risk for the clients that use callouts and SAP Concur.

With this release, SAP Concur is proud to introduce the new deprecation policy for the mobile app. With this new policy, SAP Concur is no longer managing the requirements of the older versions of the mobile app, which allows resources to focus on current mobile features and enhancements. It also defines the process of marking attributes or features that should be inaccessible to users.

When the current mobile app version on a user’s device is older than the two latest versions, SAP Concur notifies them - through a Message Centre message and push notifications – that they are no longer using a supported version of the app.

When the current mobile version of the app is older than the last 7 versions, users see an upgrade notice on the login page and are no longer able to access the SAP Concur mobile app on their mobile device. Targeted for April 2020 (9.79), users with versions older than 9.73 lose access to the SAP Concur mobile app.

For more information about the retention policy, review this FAQ (English only).

Additional information about this policy will be provided in future release notes.

Business Purpose / Client Benefit: This policy encourages users to use the most recent version of the mobile app with current features available on the app. It also provides users with more stable versions of the app that are better maintained.

Targeted for the first quarter of 2020, the Mobile Sign In page will be redesigned and improved. The enhancements will improve the user experience, improve security and simplify configuration. It will also assist customers who use more than one Identity Provider (like OKTA or Azure) for Single Sign-On (SSO).

There will be additional changes, which will be described in future release notes.