---
id: change/bcapps/10778
type: change
title: "#10778 [Backport 29.x] Harden Contact Sync delta URL and ownership checks (#9966)"
summary: Contact Sync now validates delta URLs against an approved Microsoft Graph prefix and enforces record ownership to prevent malicious URL manipulation and cross-user record tampering.
tier: official
language: en
tags:
  - fix
  - releases/29.x
  - bc29
  - page contact sync
  - table contact sync user
  - codeunit contact sync user subscriber
  - codeunit o365 bidirectional sync
system: crm
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:07:03.811Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: d237a9694d8aa50d4ec04ef18483a96fdbbd72cd
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/10778
    title: "microsoft/BCApps#10778: [Backport 29.x] Harden Contact Sync delta URL and ownership checks (#9966)"
    date: "2026-08-31"
    commit: d237a9694d8aa50d4ec04ef18483a96fdbbd72cd
    t: null
    quote: null
links:
  learn: []
  objects:
    - object/page/7100
    - object/table/7121
    - object/codeunit/7100
    - object/codeunit/7106
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 10778
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/10778
kind: pr
base_branch: releases/29.x
major: "29"
merged_at: "2026-08-31T09:48:25Z"
author: Naveen26423
author_type: User
community_contribution: false
labels:
  - "Team: SCM"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 8
  additions: 460
  deletions: 34
  al: 4
apps:
  - Base Application
objects_touched:
  - key: page/7100
    page: page/7100
    type: page
    id: 7100
    name: Contact Sync
    app: Base Application
    status: modified
  - key: table/7121
    page: table/7121
    type: table
    id: 7121
    name: Contact Sync User
    app: Base Application
    status: modified
  - key: codeunit/7100
    page: codeunit/7100
    type: codeunit
    id: 7100
    name: Contact Sync User Subscriber
    app: Base Application
    status: added
  - key: codeunit/7106
    page: codeunit/7106
    type: codeunit
    id: 7106
    name: O365 Bidirectional Sync
    app: Base Application
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 645036
systems:
  - crm
quote: null
joined_against:
  major: "29"
  commit: 1d24dd5ee2a734510f0556ccc69342d0e616db2f
---

# #10778 [Backport 29.x] Harden Contact Sync delta URL and ownership checks (#9966)

> Contact Sync now validates delta URLs against an approved Microsoft Graph prefix and enforces record ownership to prevent malicious URL manipulation and cross-user record tampering.

[Pull request](https://github.com/microsoft/BCApps/pull/10778) · merged into `releases/29.x` (BC29) on 2026-08-31 by Naveen26423 · 8 files (+460 -34), 4 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Delta URLs are validated to match https://graph.microsoft.com/v1.0/ prefix before storage; invalid URLs trigger full sync fallback
- Record ownership checks prevent users from inserting or modifying other users' sync records
- User ID field changes on existing Contact Sync User records are now blocked
- New subscriber codeunit wires validation logic into table insert and modify events
- Install and upgrade contexts are exempt from ownership enforcement to prevent company copy regressions
- Behaviour changes for users or extensions.

## AL objects touched

- [Page 7100 "Contact Sync"](../../objects/page/7100.md), Base Application: modified
- [Table 7121 "Contact Sync User"](../../objects/table/7121.md), Base Application: modified
- [Codeunit 7100 "Contact Sync User Subscriber"](../../objects/codeunit/7100.md), Base Application: added
- [Codeunit 7106 "O365 Bidirectional Sync"](../../objects/codeunit/7106.md), Base Application: modified

## Context

- Work items: AB#645036
- Labels: Team: SCM
- Systems: crm

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).