#10778 [Backport 29.x] Harden Contact Sync delta URL and ownership checks (#9966)
Contact Sync now validates delta URLs against an approved Microsoft Graph prefix and enforces record ownership to prevent malicious URL manipulation and cross-user record tampering.
- 8files
- 4AL files
- 4objects
Pull request · merged into releases/29.x (BC29) on 2026-08-31 by Naveen26423 · 8 files (+460 -34), 4 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Delta URLs are validated to match https://graph.microsoft.com/v1.0/ prefix before storage; invalid URLs trigger full sync fallback
- Record ownership checks prevent users from inserting or modifying other users’ sync records
- User ID field changes on existing Contact Sync User records are now blocked
- New subscriber codeunit wires validation logic into table insert and modify events
- Install and upgrade contexts are exempt from ownership enforcement to prevent company copy regressions
- Behaviour changes for users or extensions.
AL objects touched
- Page 7100 “Contact Sync”, Base Application: modified
- Table 7121 “Contact Sync User”, Base Application: modified
- Codeunit 7100 “Contact Sync User Subscriber”, Base Application: added
- Codeunit 7106 “O365 Bidirectional Sync”, Base Application: modified
Context
- Work items: AB#645036
- Labels: Team: SCM
- Systems: crm
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).