BC Observatoryunofficial, made by waldo
code change · fixAL Developmentofficial - Microsoftreviewed - checked by Opus

#10232 Block unauthorized Sales Order Agent setup access

The SOA Setup page now validates user permissions before allowing access to Sales Order Agent configuration, preventing unauthorized users from bypassing agent authorization controls.

Open in Claude10232.mdPull request #10232

Pull request · merged into main (BC30) on 2026-08-21 by attilatoury · 1 file (+5 -0), 1 AL · fix · tier official · reviewed (checked by Opus)

What changed

  • Added permission check on SOA Setup page using Agent System Permissions API
  • Validates CurrentUserCanManageAgent when page opens
  • Requires Configure All Agents permission for unfiltered direct navigation
  • Preserves per-agent Can Configure access control
  • Closes authorization bypass vulnerability
  • Behaviour changes for users or extensions.

AL objects touched

Context

  • Work items: AB#640825
  • Labels: AL: Apps (W1), Team: SCM
  • Systems: development

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).