#11016 [AI Business Solutions] Enforce allow-listed Redirect URIs, token audiences and authorities for OAuth2 integrations
Hardens OAuth2 integrations: Intercompany now builds the authority from the tenant GUID over HTTPS and validates the destination host more strictly. The Outlook REST API customer app requires an exact redirect URI match. SII Setup emits audit and telemetry signals for invalid URLs, and the SharePoint connector guidance now recommends Sites.Selected.
- 12files
- 7AL files
- 7objects
Pull request · merged into main (BC30) on 2026-09-10 by dcenic · 12 files (+496 -42), 7 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Intercompany connector builds the authority from the tenant GUID with HTTPS and login.microsoftonline.com instead of reading it from setup
- Intercompany destination host validation is stricter
- Outlook REST API redirect URI must exactly match OAuth2.GetDefaultRedirectUrl()
- SharePoint connector README and tooltip now recommend Sites.Selected over Sites.ReadWrite.All
- SII Setup emits security audit and telemetry when the target URL is invalid
- Behaviour changes for users or extensions.
AL objects touched
- Codeunit 4507 “Email - OAuth Client”, Email - Outlook REST API: modified
- Page 4509 “Email - Outlook API Setup”, Email - Outlook REST API: modified
- Table 4580 “Ext. SharePoint Account”, External File Storage - SharePoint Connector: modified
- Table 10751 “SII Setup”, Base Application (ES layer): modified
- Page 561 “CrossIntercomp. Partner Setup”, Base Application: modified
- Codeunit 560 “CrossIntercompany Connector”, Base Application: modified
- Page 565 “CrossIntercompany Modify Setup”, Base Application: modified
Context
- Work items: AB#648738
- Labels: AL: Apps (W1), Ownership: Needs Review, Team: Other
- Systems: development, integration
- From the description: “Construct authority from tenant GUID, use Https and login.microsoftonline.com”
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).