---
id: change/bcapps/11016
type: change
title: "#11016 [AI Business Solutions] Enforce allow-listed Redirect URIs, token audiences and authorities for OAuth2 integrations"
summary: "Hardens OAuth2 integrations: Intercompany now builds the authority from the tenant GUID over HTTPS and validates the destination host more strictly. The Outlook REST API customer app requires an exact redirect URI match. SII Setup emits audit and telemetry signals for invalid URLs, and the SharePoint connector guidance now recommends Sites.Selected."
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - codeunit email - oauth client
  - page email - outlook api setup
  - table ext. sharepoint account
  - table sii setup
  - page crossintercomp. partner setup
  - codeunit crossintercompany connector
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:05:46.824Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: f21568982af7a23ae19e8c933ce6d671315d5e1f
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/11016
    title: "microsoft/BCApps#11016: [AI Business Solutions] Enforce allow-listed Redirect URIs, token audiences and authorities for OAuth2 integrations"
    date: "2026-09-10"
    commit: f21568982af7a23ae19e8c933ce6d671315d5e1f
    t: null
    quote: Construct authority from tenant GUID, use Https and login.microsoftonline.com
links:
  learn: []
  objects:
    - object/codeunit/4507
    - object/page/4509
    - object/table/4580
    - object/table/10751-es
    - object/page/561
    - object/codeunit/560
    - object/page/565
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 11016
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/11016
kind: pr
base_branch: main
major: "30"
merged_at: "2026-09-10T17:49:21Z"
author: dcenic
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - "Ownership: Needs Review"
  - "Team: Other"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 12
  additions: 496
  deletions: 42
  al: 7
apps:
  - Base Application
  - Email - Outlook REST API
  - External File Storage - SharePoint Connector
objects_touched:
  - key: codeunit/4507
    page: codeunit/4507
    type: codeunit
    id: 4507
    name: Email - OAuth Client
    app: Email - Outlook REST API
    status: modified
  - key: page/4509
    page: page/4509
    type: page
    id: 4509
    name: Email - Outlook API Setup
    app: Email - Outlook REST API
    status: modified
  - key: table/4580
    page: table/4580
    type: table
    id: 4580
    name: Ext. SharePoint Account
    app: External File Storage - SharePoint Connector
    status: modified
  - key: table/10751
    page: table/10751-es
    type: table
    id: 10751
    name: SII Setup
    app: Base Application
    status: modified
  - key: page/561
    page: page/561
    type: page
    id: 561
    name: CrossIntercomp. Partner Setup
    app: Base Application
    status: modified
  - key: codeunit/560
    page: codeunit/560
    type: codeunit
    id: 560
    name: CrossIntercompany Connector
    app: Base Application
    status: modified
  - key: page/565
    page: page/565
    type: page
    id: 565
    name: CrossIntercompany Modify Setup
    app: Base Application
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 648738
systems:
  - development
  - integration
quote: Construct authority from tenant GUID, use Https and login.microsoftonline.com
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #11016 [AI Business Solutions] Enforce allow-listed Redirect URIs, token audiences and authorities for OAuth2 integrations

> Hardens OAuth2 integrations: Intercompany now builds the authority from the tenant GUID over HTTPS and validates the destination host more strictly. The Outlook REST API customer app requires an exact redirect URI match. SII Setup emits audit and telemetry signals for invalid URLs, and the SharePoint connector guidance now recommends Sites.Selected.

[Pull request](https://github.com/microsoft/BCApps/pull/11016) · merged into `main` (BC30) on 2026-09-10 by dcenic · 12 files (+496 -42), 7 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Intercompany connector builds the authority from the tenant GUID with HTTPS and login.microsoftonline.com instead of reading it from setup
- Intercompany destination host validation is stricter
- Outlook REST API redirect URI must exactly match OAuth2.GetDefaultRedirectUrl()
- SharePoint connector README and tooltip now recommend Sites.Selected over Sites.ReadWrite.All
- SII Setup emits security audit and telemetry when the target URL is invalid
- Behaviour changes for users or extensions.

## AL objects touched

- [Codeunit 4507 "Email - OAuth Client"](../../objects/codeunit/4507.md), Email - Outlook REST API: modified
- [Page 4509 "Email - Outlook API Setup"](../../objects/page/4509.md), Email - Outlook REST API: modified
- [Table 4580 "Ext. SharePoint Account"](../../objects/table/4580.md), External File Storage - SharePoint Connector: modified
- [Table 10751 "SII Setup"](../../objects/table/10751-es.md), Base Application (ES layer): modified
- [Page 561 "CrossIntercomp. Partner Setup"](../../objects/page/561.md), Base Application: modified
- [Codeunit 560 "CrossIntercompany Connector"](../../objects/codeunit/560.md), Base Application: modified
- [Page 565 "CrossIntercompany Modify Setup"](../../objects/page/565.md), Base Application: modified

## Context

- Work items: AB#648738
- Labels: AL: Apps (W1), Ownership: Needs Review, Team: Other
- Systems: development, integration
- From the description: "Construct authority from tenant GUID, use Https and login.microsoftonline.com"

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).