Audit Rules

Administrators can configure audit rules based on the date value in the Image Certification Date field. Once the audit rule is configured, administrators can compare the receipt timestamp date to the expense entry transaction date and send alerts to users/groups and stop the flow of expenses claims when regulations are not met.

Currently, the Image Certification Date field is the e-Bunsho timestamp date used in Japan.

Image Certification Date field considerations:

• Field calculation is based on the calendar day (business day logic is not included).

• Dates used in the number of day calculation are based on the GMT time zone. We recommend making audit rules for one day less than desired to account for the time difference between the GMT and JST time zones.

• Audit rules and compliance validations are based on information provided by the user for the transaction date. Because users can edit transaction dates, it is the user’s responsibility to ensure the transaction date is accurate based on receipt information.

• Admins have the ability to create multiple audit rules for comparing the transaction date to the receipt timestamp date.

This field is to new and existing clients.

This feature was released in July 2021.

Business Purpose/Client Benefit: Configuring audit rules for this field helps reduce manual reviews needed to compare the number of calendar days between the expense entry transaction date and the receipt timestamp date.

Authentication

These changes are part of the SAP Concur continued commitment to maintaining secure authentication.

SAP Concur support for Hash-Based Message Authentication Code (HMAC) has been deprecated.

SAP Concur provides a Single Sign-On self-service option that enables client admins to set up their SAML v2 connections without involving an SAP Concur support representative.

For more information about the Single Sign-On self-service option, refer to the Shared: Single Sign-On Overview (English Only) and the Shared: Single Sign-On Setup Guide (English Only).

Business Purpose/Client Benefit: This change provides better security and improved support for users logging in to SAP Concur products and services.

Cards

These changes are part of the NextGen UI experience.

This feature allows clients who have migrated to the NextGen UI for Concur Expense (NGE) to be able to use the Redirect Funds option. Redirect Funds has been updated with a new look and more logical placement in the flow of the expense claim submission process. While the user interface (UI) has been improved with new elements and messaging, the basic functionality of redirecting funds to a card payment remains the same.

The Redirect Funds option allows an employee to "redirect" payments due from the company to the employee to instead be paid to the card provider on behalf of the employee. This option is only available to an employee with an Individually Billed/Company Paid (IBCP) card where the employee is expected to pay the card provider directly for personal charges.

Redirect Funds includes the following enhancements:

• Move of the user input from the claim header to the claim totals page shown during the claim submission process. The new design puts redirect funds into the submission process so that it is presented to the user at the right moment to know what amount is possible for redirection and thus logically make the choice

• Inactive card accounts are filtered out of the list of available cards for selection

• View of currency exchange rate and amount information when the card account currency is different than the user's reimbursement currency, to aid the user in typing in an appropriate amount in card currency that will be redirected.

Business Purpose/Client Benefit: This saves time for the user since it allows reimbursement to be conveniently directed to cover personal charges on the card when submitting an expense claim.

This aids the company card programme administrator by making it easier for users to pay and thus keep their card accounts current.

Cookie Preferences and User Consent

To ensure that SAP Concur solutions meet the user cookie consent requirements of the European Union (EU), European Economic Area (EEA), European Free Trade Association (EFTA), the United Kingdom (UK), and Brazil, on 1 July, 2021, SAP implemented explicit cookie consent and zero cookie load for SAP Concur solutions in those jurisdictions.

• Explicit cookie consent: The user must agree to allow cookies to be stored on their device by responding affirmatively to a request for consent.

• Zero cookie load: The user must provide explicit cookie consent before any cookies can be saved to their device.

Business Purpose/Client Benefit: This change ensures that SAP Concur sites comply with the cookie consent requirements of the listed jurisdictions and enables users to choose which cookies are downloaded to their devices by SAP Concur solutions.

Expense Claims

These changes are part of the NextGen UI experience.

This feature allows users to select multiple expenses in an expense claim and edit common elements across all lines at once.

Business Purpose/Client Benefit: This functionality simplifies repetitive data entry for expense claims and streamlines expense claim creation for users.

File Transfer Updates

This release note is intended for technical staff responsible for file transmissions with SAP Concur products. For SAP Concur customers and suppliers participating in data exchange through various secure file transfer protocols, SAP is making changes that provide greater security for those file transfers.

As of 10 April, 2021, non-SFTP (Secure File Transfer Protocol) protocols and SFTP password authentication are not allowed to connect to SAP Concur for file transfers:

• Non-SFTP file transfer accounts must switch to SFTP with SSH Key Authentication.

• SFTP file transfer accounts that use password authentication must switch to SSH key authentication.

• SFTP password reset requests require the client to provide an SSH key for authentication.

On 12 April, 2021, SAP started disabling non-compliant file transfer connections. The process of disabling non-compliant accounts will continue throughout 2021. If you have multiple file transfer connections configured, this change applies to all of your file transfer connections.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

• st-eu.concursolutions.com

• vs.concursolutions.com

• vs.concurcdc.cn

Business Purpose / Client Benefit: These changes provide greater security for file transfers.

This Release Note is intended for the technical staff responsible for file transmissions with SAP Concur. For our customers and suppliers participating in data exchange, SAP Concur is maintaining our file transfer subsystem to provide greater security for those file transfers.

SAP Concur is in the process of migrating entities that currently use a legacy process for moving files to a more efficient and secure file routing process that relies on APIs.

Clients whose entities are currently configured to use the legacy process will be migrated to the more efficient process sometime between now and 24 January 2022. After they are migrated to the more efficient process, clients will see the following improvement:

• With the legacy process, clients had to wait for the file move schedule to run at a specified time. With the more efficient and secure API-based process, extracts and other outbound files from SAP Concur will be available within the existing overnight processing period shortly after the files are created.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

Business Purpose / Client Benefit: These changes provide greater security and efficiency for file transfers.

Files transferred to SAP Concur products must be encrypted with the SAP Concur public PGP key, concursolutionsrotate.asc.

concursolutionsrotate.asc

• Key file is available in client’s root folder

• Key ID 40AC5D35

• RSA 4096-bit signing and encryption subkey

• Key expires every 2 years

• Client is responsible for replacing the key before it expires

  • Next expiry date: 4 September 2022

  • SAP Concur plans to replace the current rotating public PGP key in the client’s root folder 90 days before the expiration date

The SAP Concur legacy PGP key (key ID D4D727C0) remains supported for existing clients but will be deprecated in the future.

SAP Concur strongly recommends that clients use the more secure rotating public PGP key for file transfers. To facilitate the use of the more secure rotating public PGP key for file transfers, SAP Concur added the key to existing client’s home folders on Friday 15 January 2021.

This announcement pertains to the following file transfer DNS endpoints:

• st.concursolutions.com

• mft-us.concursolutions.com

• vs.concursolutions.com

• st-eu.concursolutions.com

• mft-eu.concursolutions.com

Business Purpose / Client Benefit: The rotating public PGP key provides greater security for file transfers.

Localisation

With the June release, SAP Concur is changing the following terms in the Brazilian Portuguese version of the SAP Concur user interface to bring consistency in translation of the term “Cash Advance”:

Business Purpose / Client Benefit: These revisions provide a more accurate translation and improved user experience in Brazilian Portuguese.

Mileage Service

SAP Concur releases a new Mileage Service update that allows a company to track and reclaim fuel and mileage taxes. The feature for fuel Value-Added Tax (VAT) reclaim lets a user record mileage expenses and fuel expenses on the same expense claim (also known as a report) to allow tracking of the reclaimable VAT paid on the fuel that will be used during mileage journeys.

As a result of this change, a Fuel for Mileage expense type can be created by an admin for users to reclaim fuel and mileage taxes.

The result is the next generation of the Concur Expense user interface designed to provide a modern, consistent and streamlined user experience. This technology not only provides an enhanced user interface, but also allows us to react more quickly to customer requests to meet changing needs as they happen.

An admin can also create the following for new Mileage Service users to use:

• Fuel for Mileage entry form

• Mileage – No Receipt entry form

• Fuel Type simple list

• Mileage (Placeholder) UK Tax Group

• FUELFORM Audit Rule

Business Purpose/Client Benefit: This update enhances the Mileage Service functionality by allowing users to:

• Add Fuel for Mileage expenses via the Quick Expenses grid

• Add mileage expenses via the Mileage grid

• Reclaim fuel and mileage taxes

NextGen UI

The continued evolution of the Concur Expense solution user interface experience is the result of thoughtful design and research that provides a modern, intuitive and streamlined experience for creating and submitting expense claims.

Concur Expense customers have the ability to preview and then opt in to the NextGen UI before the mandatory move.

Business Purpose / Client Benefit: The result is the next generation of the Concur Expense user interface designed to provide a modern, consistent and streamlined user experience. This technology not only provides an enhanced user interface, but also allows us to react more quickly to customer requests to meet changing needs as they happen.

Profile

For Canadian users who enter or update their Bank Information page in Profile, new fields display. Some of the new fields are required to comply with local banking regulations.

The following fields are impacted by this change:

• Personal Address Line 1 (required)

• Personal Address Line 2 (optional)

• City (required)

• Province (required)

• Postal Code (required)

Business Purpose / Client Benefit: Concur Expense must contain all information that may be required for payment processing.

For Mexican users who enter or update their Bank Information page in Profile, new fields display. Some of the new fields are required to comply with local banking regulations.

The following fields are impacted by this change:

• Swift Code (required)

• RFC (required)

• Phone Number (optional)

Business Purpose / Client Benefit: Concur Expense must contain all information that may be required for payment processing.

Security

SAP is adopting the Domain-based Message Authentication (DMARC) email security protocol for all email sent from SAP. As a result, the email addresses for some email sent from SAP Concur organisations will no longer be sent from the @sap.com root domain, but will instead be sent from a subdomain of sap.com, such as @example.sap.com where “example” is the subdomain.

If your organisation maintains an allow list for email addresses, you can update your allow list to include email from the following domains to ensure that you receive emails sent from the sap.com root domain and subdomains of the sap.com root domain:

• @info.sap.com

• @mail.sap.com

• @*sap.com

  • If your internal configuration allows it, adding @*sap.com can minimise the need for future updates by allowing all emails from the sap.com domain and from subdomains of the sap.com domain. For example, if your allow list includes @*sap.com, you do not need to add @info.sap.com or @mail.sap.com because @*sap.com encompasses those subdomains.

The following types of email communications from SAP Concur solutions are not impacted by this change:

• 1:1 email communication that you have with your SAP Concur account team or other SAP representatives. These emails will continue to come from @sap.com.

• System e-mails (for example expense claim approvals and travel bookings) that come from concursolutions.com, tripit.com, or other SAP Concur products and solutions

• SAP Concur support updates (such as case notifications)

Business Purpose / Client Benefit: DMARC compliance provides better security for emails sent from SAP to its customers.

Travel Allowance Service

For clients using the new Travel Allowance Service (TAS) when a new generic configurable bundle is created, it will include Incidental in the list of available deduction categories.

Business Purpose/Client Benefit: This change allows greater flexibility when creating custom bundles.

Test Entities

When end users, approvers, processors and admins log in to an SAP Concur test entity, they will notice the global banner across the top of the page has changed and that the UI Web frame has a unique, identifying colour.

Prior to implementing this change, logged-in users saw only a blue global banner across the top of the page. Users might have had issues distinguishing between the test environment and production environment.

Business Purpose/Client Benefit: All SAP Concur users now see a more distinct difference between a test entity and production entity. These changes help users to clearly distinguish between test and production entities. These changes might also reduce the likelihood of logging in to the wrong entity and performing critical tasks such as configuration updates and data changes.

Web Services Administration

Starting 04 October 2021, the length of the username and password associated with an application connector must be at least 10 characters long and not more than 50 characters long. To avoid disruption of callouts through application connections, usernames and passwords that do not meet these requirements must be updated before 04 October 2021.

Application connection usernames and passwords can be updated by an administrator with the Company Admin or Web Services Admin role.

Business Purpose / Client Benefit: Enforcing password and username length restrictions improves the security standards for callouts made through the application connector.

App Centre

Targeted for 2 August, 2021, SAP Concur solutions is excited to announce that Amazon Business will be integrated with SAP Concur. With this integration, companies are now able to offer their employees, who purchase items through Amazon Business, the ability to add their expenses to an expense claim, view the e-receipt and then submit, rather than needing to import receipts or filling out forms for each expense.

Business Purpose/Client Benefit: This integration allows employees to easily purchase items through Amazon Business and then submit their expenses in Concur Expense.

Employee Import

A new employee import record set, EFT Supplemental Detail Bank Account Import, will be added to the overnight employee import job. This new record set is at the 820-record level, and includes identical records to those found in the 810-level records, with the addition of fields and validations for information that will be required in the future.

The following are the supplemental fields found only in the 820 record:

• Field 20: Phone Number (optional)

• Field 21: Date of Birth (optional)

• Field 22: Bank Postal Address Line 1 (optional)

• Field 23: Bank Postal Address Line 2 (optional)

• Field 24: Bank Postal Address City (optional)

• Field 25: Bank Postal Address Region (optional)

• Field 26: Postal Code (optional)

The following additional currency-specific validations will be added for Canada Dollar (CAD) and Mexico's Nuevo Peso (MXN):

• Personal Address (Fields 11-15) will be required for CAD

• Bank Identification Number (BIN) (Field 4) and TAXID (Field 17) will be required and must be provided for MXN, where BIN is 8- or 11-character SWIFT code and the TAXID is either the RFC code (13 characters – example: MALA780724988) or the CURP code (18 characters – example: GOJO601228HVZRML07).

Business Purpose/Client Benefit: Concur Expense must contain all information that may be required for payment processing.

Mileage

SAP Concur continues to work on this change. With the next release, this information will be removed. When this change gets closer to a release date, this information will again appear in the release notes document.

Miscellaneous

Beginning on 1 August, 2021, Concur Expense end users will see a new survey when submitting Expense Claims.

Currently, after submitting an Expense Claim, a message appears intermittently asking the user to rate their experience from 1 to 5 stars. Beginning on 1 August, after submitting an Expense Claim, a short survey will intermittently appear enabling the user to provide feedback on their experience.

Business Purpose/Client Benefit: The new survey will collect more actionable feedback that can be used by the SAP Concur product teams to prioritise and improve the features they deliver.

Standard Accounting Extract

In the Standard Accounting Extract (SAE), currently the value of the PAID_DATE field may be either the date when the claim is extracted, or the date when the payment is confirmed. We plan to change the SAE (versions 2 and 3) so that this date is always the date that the claim is extracted and not overwrite the value with the date that the payment confirmation is received.

More information will be provided in future versions of these release notes.

Business Purpose / Client Benefit: This change targets improving analytics and other use cases for anyone relying on the value in this field.