---
id: change/bcapps/10232
type: change
title: "#10232 Block unauthorized Sales Order Agent setup access"
summary: The SOA Setup page now validates user permissions before allowing access to Sales Order Agent configuration, preventing unauthorized users from bypassing agent authorization controls.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - page soa setup
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:07:56.792Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: c37781dda2e8dc723df1c46def01e122b2c896d8
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/10232
    title: "microsoft/BCApps#10232: Block unauthorized Sales Order Agent setup access"
    date: "2026-08-21"
    commit: c37781dda2e8dc723df1c46def01e122b2c896d8
    t: null
    quote: null
links:
  learn: []
  objects:
    - object/page/4400
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 10232
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/10232
kind: pr
base_branch: main
major: "30"
merged_at: "2026-08-21T12:41:09Z"
author: attilatoury
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - "Team: SCM"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 1
  additions: 5
  deletions: 0
  al: 1
apps:
  - SalesOrderAgent
objects_touched:
  - key: page/4400
    page: page/4400
    type: page
    id: 4400
    name: SOA Setup
    app: SalesOrderAgent
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 640825
systems:
  - development
quote: null
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #10232 Block unauthorized Sales Order Agent setup access

> The SOA Setup page now validates user permissions before allowing access to Sales Order Agent configuration, preventing unauthorized users from bypassing agent authorization controls.

[Pull request](https://github.com/microsoft/BCApps/pull/10232) · merged into `main` (BC30) on 2026-08-21 by attilatoury · 1 file (+5 -0), 1 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Added permission check on SOA Setup page using Agent System Permissions API
- Validates CurrentUserCanManageAgent when page opens
- Requires Configure All Agents permission for unfiltered direct navigation
- Preserves per-agent Can Configure access control
- Closes authorization bypass vulnerability
- Behaviour changes for users or extensions.

## AL objects touched

- [Page 4400 "SOA Setup"](../../objects/page/4400.md), SalesOrderAgent: modified

## Context

- Work items: AB#640825
- Labels: AL: Apps (W1), Team: SCM
- Systems: development

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).