Administration

With the upcoming migration to an AWS-based data centre, the customers of a TMC may be split across two data centres. This is a temporary condition that may continue for a number of months. To mitigate this, the Travel System Admin interface will include a new look-up tool to help TMCs manage their customers from the correct data centre. The new look-up tool will be enabled per data centre as the TMC is migrated. Migrations will start in the coming month in the EU data centre. The US data centre is expected to begin migrations in Q1 2022. There will be a follow-up release note closer to the date for the US data centre, as well as one for when migrations have completed, and this screen will be retired.

This change ensures that a customer is managed from the correct data centre, allowing, when necessary, the TMC to switch between data centres under a single login.

With the upcoming AWS migration, SAP Concur will create additional users in the current environment to assist TMC companies by simplifying the user experience when managing data across multiple data centres during the migration process.

These accounts will provide users with a single sign-on experience, to better manage data across multiple data centres.

With the upcoming migration to an AWS-based data centre, to prevent accidental lockouts of a Sabre account, SAP Concur will temporarily remove the ability for a TMC to change their Sabre login password on the user interface. Once all customers have been migrated, we will reinstate this functionality and confirm its availability by release note. This change will occur shortly after the September release.

As customers are migrated, their Sabre login password may be used across multiple data centres. Changing a password for a customer within one data centre and not the other can cause a lock out. We are disabling the change password functionality for TMCs so that this will be prevented. To change a password, please open a support case with reasonable notice for planned changes. Raise the support incident with the appropriate priority level, as this helps determine when support will be able to respond. SAP Concur support can update a password across all data centres, so the account will not be locked out.

Authentication Administration

A new Company Request Token self-service tool is now available to SAP Concur admins who have been assigned the Company Admin or Web Services Admin role.

The Company Request Token self-service tool enables clients to generate the Company Request Token that is required to request a JSON web token (JWT) when connecting to APIs on the SAP Concur platform.

The Company Request Token self-service tool enables clients to generate Company Request Tokens without contacting SAP Concur support. This tool also enables clients to generate a replacement Company Request Token without assistance from SAP Concur support if their Company Request Token expires or is lost.

SAP Concur support for Hash-Based Message Authentication Code (HMAC) has been deprecated.

SAP Concur provides a Single Sign-On self-service option that enables client administrators to set up their SAML v2 connections without involving an SAP Concur support representative.

This change provides better security and improved support for users logging in to SAP Concur products and services.

Client Web Services

On 21 August, the Register Partner Application page was deactivated.

With the October release, a new application management self-service tool will replace the Register Partner Application page.

Prior to the release of the new self-service tool, clients with SAP Concur Client Web Services can contact Client Web Services to register new applications.

Clients who do not have SAP Concur Client Web Services can still contact SAP Concur support to obtain an App ID as needed.

The Register Partner Application page was used to create OAuth 1.0 (legacy) applications. OAuth 1.0 was deprecated on 4 February 2017.

The new self-service tool for application management will enable clients to create OAuth 2.0 compliant applications.

Concur Mobile App

In late September, the Concur Mobile Registration page will be updated. To navigate to the updated Concur Mobile Registration page, click Profile > Profile Settings > Concur Mobile Registration. The updated Concur Mobile Registration page includes three new sections:

• Mobile Sign-In Policies
• Sign-In IDs
• Download the App

The Concur Mobile Registration page update provides users with more information on their sign-in IDs and their organisation's mobile sign-in policies.

Flight

Previously, Southwest Airlines (WN) confirmed segments were not combined with confirmed segments from other air carriers in the same PNR. As of 21 September, Concur Travel allows Southwest Airlines to be booked in the same PNR with other air carriers.

Even though Southwest Airlines can be combined in the same PNR, separate price information and stored fares remain separate, unless Southwest Airlines has a ticketing agreement with the other carrier.

Travellers and TMCs now only need to keep track of a single PNR instead of multiple PNRs.

Strong Customer Authentication (SCA) is a European requirement created to make online payments more secure. The directive requires that purchasers in certain online electronic transactions be authenticated using multi-factor techniques to increase security and reduce fraud opportunities. It is up to each supplier and bank/card issuer to determine on a transaction-by-transaction basis whether this extra level of authentication is required.

Prior to this update, Concur Travel supported SCA via Travelfusion using airline-hosted solutions to facilitate authentication of credit cards when booking air travel. However, this solution is not supported by all airlines and recent credit card declines have been observed due to lack of SCA facilitation.

To prevent future declines, we have partnered with Travelfusion to deliver a Travelfusion-hosted solution to increase the coverage to airlines that don’t have their own hosted SCA solution. This change will take effect on 21 September. The increase of coverage will be ongoing in the upcoming months.

Hotel

Concur Travel has certified the American Express Global Business Travel Supply MarketPlace (AmexGBT Supply MarketPlace) as an authorised Custom Hotel Sourcing (CHS) provider. This provider can manage all hotel content in the Concur Travel online booking tool for designated Concur Travel configurations. Specifically, the AmexGBT Supply MarketPlace hotel connector has been verified and found to meet Concur Travel’s standards for custom hotel sourcing.

Customers can access curated content from AmexGBT Supply MarketPlace with hotel rate discounts from many sources, including suppliers, third-party aggregators and GDSs. Travellers are able to shop and book hotel inventory and access supplemental services.

By managing all hotel content, AmexGBT Supply MarketPlace is better able to customise the display and sort order of specific properties and rates.

Localisation

With the September release, SAP Concur plans to change the following terms in the Traditional Chinese version of the SAP Concur user interface to bring consistency to the translation of Attendee(s).

This change might impact your company’s internal documentation or training materials.

These revisions provide a more accurate translation and improved user experience.

Profile

As previously announced, Concur Locate was decommissioned on 1 September, 2021. As a result, the My Profile > Contact Information page was updated to remove the Concur Mobile Devices fields. Instead, two additional fields were added to the My Profile > Contact Information section: Mobile Phone Country/Region and Mobile Phone.

Test Entities

As per GDPR (General Data Protection Regulation) compliance requirements, clients can submit a Support ticket to request the Right To Be Forgotten (RTBF) for any user in Implementation (Test) entities. A Data Retention Administrator can then follow the steps outlined in the documentation to purge a user from the Test entity.

This enhancement is part of the SAP Concur requirement for GDPR compliance.

Train

As of 27 September, SAP Concur will provide users with access to the Spanish rail carrier, Renfe. With early adoption now complete, the existing functionality will be made generally available to facilitate the shopping, booking and itinerary management of Renfe bookings.

Travel managers and agencies are able to present Renfe content in the Concur Travel online booking tool, in mobile and desktop, and apply policy rules to this content. This ensures that booked travel aligns with company policies.

By enabling Renfe in the Concur Travel online booking tool, users can shop, book and view corporate rates and policies associated with Renfe tickets. Additionally, users are able to cancel bookings on the desktop application; cancellations are not available from the mobile app.

Miscellaneous

On 20 September, a new permission, SAP Fiori Theme Preview, will be added to the list of permissions in Concur Travel Professional edition. When the SAP Fiori Theme Preview permission is assigned to a user, the user sees a new switch in the header of their SAP Concur site. They will also see a New Theme info bubble.

The switch enables the user to switch from the SAP Concur Standard theme to the SAP Fiori Theme. The info bubble displays a brief message about the switch.

The new theme includes changes to visual elements such as fonts, colours and icons. In addition, some top-level tabs and menu items are relocated to the SAP Concur Home menu. These changes are site-wide and apply to all of the user’s SAP Concur products.

The SAP Fiori theme harmonises the look and feel of the SAP Concur UI with the look and feel of other SAP products, providing a more consistent user experience. The permission enables a client admin to allow designated users to preview and test the SAP Fiori theme.

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and suppliers participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of 10 April, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

• Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.
• SFTP file transfer accounts that use password authentication must switch to SSH key authentication.
• SFTP password reset requests require the client to provide an SSH key for authentication.

On 12 April, 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• st-eu.concursolutions.com
• vs.concursolutions.com
• vs.concurcdc.cn

These changes provide greater security for file transfers.

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

• Key file is available in client’s root folder.
• Key ID 40AC5D35.
• RSA 4096-bit signing and encryption subkey.
• Key expires every 2 years.
• Client is responsible for replacing the key before it expires.
• • Next expiry date: 4 September, 2022.
  • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date.

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com
• mft-us.concursolutions.com
• vs.concursolutions.com
• st-eu.concursolutions.com
• mft-eu.concursolutions.com

The rotating public PGP key provides greater security for file transfers.

This release note is intended for the technical staff responsible for file migrations with SAP Concur solutions. For our customers and suppliers participating in data exchange, SAP Concur solutions is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and 24 January 2022. After they are migrated to the more efficient process, clients will see the following improvement:

• With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur solutions will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

These changes provide greater security and efficiency for file transfers.

Flight

Currently, users are not able to make changes to Travelport Southwest flights after the ticket has been issued. Targeted for October 2021, Southwest Post-Ticket change functionality will be available for Travelport customers with the Post-Ticket Change feature enabled in configuration.

This change will enable users to change Southwest airline flights via Travelport through Concur Travel after a ticket is issued.

Travelport Post-Ticket changes will only be supported via Apollo and Worldspan. Concur Travel will communicate if this functionality will be enabled for Galileo customers at a future date.

Profile

The XML Profile Sync, which is used to synchronise Concur Travel user profile data with TMC partners, will no longer be available, and this is targeted for the end of 2021. We advise all partners to engage with SAP Concur representatives to adopt the Travel Profile v2 API for managing Concur Travel user profiles.

The XML Profile Sync was officially decommissioned in 2016 due to instability and other issues. The Travel Profile v2 API was built to replace this legacy synchronisation process. It has now reached such a level of stability and maturity that there is no longer any reason to maintain multiple profile sync options.

Travel Operations / Technical Essentials

In order for Concur Travel to process offline bookings and updates to online bookings, specific information must be present in the PNR. Today, both of the following are required pieces of information:

1. Company ID (CLIQCID)
2. Login ID (CLIQUSER)

However, while both of these have been required historically, SAP Concur did not always reject PNRs when the required fields were missing. With this update, this requirement will be enforced. Any Sabre, Amadeus or Worldspan PNRs missing either of the required pieces of information will be rejected and placed in the error queue. Galileo and Apollo PNRs missing required information will be rejected.

By enforcing data requirements, we are improving data security.

Concur Travel uses the Travel Configuration ID to match trips to the correct configuration. This information will be used to identify Compleat-integrated customers. Without it, Concur Travel/Compleat integration features will not be available for these customers.