SAP Concur SFTP and PGP transfers with SFTPPlus MFT

SFTPPlus MFT can connect your accounting or ERP system to SAP Concur's file transfer service. It collects files for upload, prepares their contents, and retrieves extracts for your business applications to process. You configure the transfers through the Web Manager or INI files on your own Windows or Linux system.

SAP Concur requires both an encrypted SFTP connection and PGP encryption of the files themselves. SFTP protects the connection, while PGP keeps the file contents encrypted after delivery. SFTPPlus MFT can automate both parts of the exchange.

Connect with RSA or ECDSA SSH authentication ​

SFTPPlus MFT supports RSA and ECDSA SSH key authentication, matching SAP Concur's accepted key types. For client accounts, the username is the Concur Entity ID. See SAP's authentication and file transfer details for account requirements and regional endpoints.

Provide your SSH public key to SAP Concur and keep the corresponding private key in the SFTPPlus MFT vault. Create an SFTP location with your regional SAP Concur hostname, port 22, and username. Select the private key through the location's ssh_client_key setting, and configure ssh_server_identity using the verified SAP Concur server fingerprint. The SFTP location reference explains these settings.

Compatible SFTP ciphers ​

SFTPPlus MFT's SFTP ciphers are compatible with TransferSecurityPolicy-Restricted-2020-06, the policy listed in SAP Concur's file transfer protocol guide. SFTPPlus MFT supports AES in GCM mode, SHA-2 message authentication, and all SSH key exchange algorithms used by SAP Concur. See the SFTPPlus cryptographic standards reference for the supported algorithms.

Convert source text to UTF-8 ​

An older business application may export text that is neither ASCII nor UTF-8. SFTPPlus MFT can automatically convert supported source encodings, such as ISO-8859-15 or UTF-16, to UTF-8 as part of the upload workflow. This preserves characters such as accented names that would be lost in an ASCII conversion.

For example, use this destination content action to convert ISO-8859-15 text to UTF-8 with a byte order mark (BOM) during a transfer:

destination_content_actions =
  *.txt, encoding, iso-8859-15-to-utf-8-bom
  *, no-action

SFTPPlus converts the content in memory during the transfer, and the source file stays unchanged. Check the conversion results in the SFTPPlus logs. Choose the conversion for the known source encoding; this setting does not automatically detect it. The file content conversion guide explains how matching rules select files for conversion.

Automate PGP encryption and decryption ​

SFTPPlus MFT includes a PGP event handler for automatic encryption and decryption, without a separate PGP command line tool. SSH keys authenticate the connection, while separate PGP keys protect file contents.

For uploads, obtain SAP Concur's current public PGP key from your account's root folder and import it into the SFTPPlus vault. Configure the PGP handler to encrypt files prepared for upload with that key. Then transfer only the completed encrypted files to SAP Concur's /in directory, using the required import file names. Use the encryption preferences in SAP Concur's PGP key.

For downloads, register your organization's public PGP key with SAP Concur and retain its private key in the SFTPPlus vault. Configure a transfer to collect encrypted extracts from /out into a local folder. After each download completes, the PGP handler decrypts the file with your private key and makes the result available to your accounting or ERP application.

Configure the upload and download workflows so that each operation starts only after the preceding step succeeds. The PGP handler reference covers key selection, output folders, and source file retention. During setup, check SAP's current PGP key requirements and test a downloaded extract, including its encryption format, with your installed SFTPPlus version.

Check the complete exchange ​

Start with a sample import and extract before enabling the production schedule. For an upload, check the conversion and delivery results in the SFTPPlus logs, then confirm that SAP Concur accepts the import. For a download, verify decryption and confirm that your application reads the extracted data correctly.

SAP Concur recommends connecting no more than twice an hour and advises against remote file renaming or repeated uploads of the same file. SFTPPlus MFT can be configured to upload each file directly under its final name, without renaming it on SAP Concur. Enable transfer memory to keep track of successfully transferred files for a configured number of days. During that period, files with an unchanged name, size, and modification time are not uploaded again.

Configure changes_poll_interval to control how often SFTPPlus checks the source folder, and stable_interval to control how long a file must remain unchanged before it is uploaded. Choose a stability interval longer than the polling interval and any expected pauses while the source application writes a file. These settings let SFTPPlus wait for completed source files before uploading them to SAP Concur.

For more advanced schedules, use transfer scheduling to define daily, weekly, or monthly transfer windows. Configure the schedule and connection retries to respect SAP Concur's connection limits.

Contact the SFTPPlus MFT support team for help configuring the SSH keys, text preparation, and PGP workflow for your SAP Concur account.