---
id: change/bcapps/11290
type: change
title: "#11290 [Bug 640454] Scope Expense Agent Entra permissions by company"
summary: The Expense Agent now manages Microsoft Entra permissions scoped to individual companies, adding company-specific grants on activation and removing them on deactivation while preserving other permissions and disabling the shared application only when no active companies remain.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - codeunit expense agent api validation
  - codeunit ea http client
  - codeunit expense agent entra app mgt.
  - page expense agent setup wizard
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:04:30.913Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: 38c6e939f9314d2acbbf2c31ef79b3946635820c
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/11290
    title: "microsoft/BCApps#11290: [Bug 640454] Scope Expense Agent Entra permissions by company"
    date: "2026-09-18"
    commit: 38c6e939f9314d2acbbf2c31ef79b3946635820c
    t: null
    quote: always add exactly one current-company Expense Agent permission during activation
links:
  learn: []
  objects:
    - object/codeunit/6993
    - object/codeunit/6941
    - object/codeunit/6922
    - object/page/6991
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 11290
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/11290
kind: pr
base_branch: main
major: "30"
merged_at: "2026-09-18T10:51:02Z"
author: t-prda
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - ExpenseManagement
  - "Team: Finance"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 7
  additions: 897
  deletions: 94
  al: 4
apps:
  - ExpenseAgent
objects_touched:
  - key: codeunit/6993
    page: codeunit/6993
    type: codeunit
    id: 6993
    name: Expense Agent API Validation
    app: ExpenseAgent
    status: modified
  - key: codeunit/6941
    page: codeunit/6941
    type: codeunit
    id: 6941
    name: EA Http Client
    app: ExpenseAgent
    status: modified
  - key: codeunit/6922
    page: codeunit/6922
    type: codeunit
    id: 6922
    name: Expense Agent Entra App Mgt.
    app: ExpenseAgent
    status: added
  - key: page/6991
    page: page/6991
    type: page
    id: 6991
    name: Expense Agent Setup Wizard
    app: ExpenseAgent
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 640454
systems:
  - development
quote: always add exactly one current-company Expense Agent permission during activation
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #11290 [Bug 640454] Scope Expense Agent Entra permissions by company

> The Expense Agent now manages Microsoft Entra permissions scoped to individual companies, adding company-specific grants on activation and removing them on deactivation while preserving other permissions and disabling the shared application only when no active companies remain.

[Pull request](https://github.com/microsoft/BCApps/pull/11290) · merged into `main` (BC30) on 2026-09-18 by t-prda · 7 files (+897 -94), 4 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Activation always adds exactly one Expense Agent permission for the current company
- An existing global grant is kept and the current-company grant is still added
- Deactivation removes only the current-company grant and keeps global, other-company and unrelated permissions
- The shared Entra application is disabled when no other non-empty company grant remains
- SUPER needs no extra permission sets; non-SUPER users need Agent - Admin, Expense Mgmt. Admin, SECURITY and Expense Agent
- Behaviour changes for users or extensions.

## AL objects touched

- [Codeunit 6993 "Expense Agent API Validation"](../../objects/codeunit/6993.md), ExpenseAgent: modified
- [Codeunit 6941 "EA Http Client"](../../objects/codeunit/6941.md), ExpenseAgent: modified
- [Codeunit 6922 "Expense Agent Entra App Mgt."](../../objects/codeunit/6922.md), ExpenseAgent: added
- [Page 6991 "Expense Agent Setup Wizard"](../../objects/page/6991.md), ExpenseAgent: modified

## Context

- Work items: AB#640454
- Labels: AL: Apps (W1), ExpenseManagement, Team: Finance
- Systems: development
- From the description: "always add exactly one current-company Expense Agent permission during activation"

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).