#11290 [Bug 640454] Scope Expense Agent Entra permissions by company
The Expense Agent now manages Microsoft Entra permissions scoped to individual companies, adding company-specific grants on activation and removing them on deactivation while preserving other permissions and disabling the shared application only when no active companies remain.
- 7files
- 4AL files
- 4objects
Pull request · merged into main (BC30) on 2026-09-18 by t-prda · 7 files (+897 -94), 4 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Activation always adds exactly one Expense Agent permission for the current company
- An existing global grant is kept and the current-company grant is still added
- Deactivation removes only the current-company grant and keeps global, other-company and unrelated permissions
- The shared Entra application is disabled when no other non-empty company grant remains
- SUPER needs no extra permission sets; non-SUPER users need Agent - Admin, Expense Mgmt. Admin, SECURITY and Expense Agent
- Behaviour changes for users or extensions.
AL objects touched
- Codeunit 6993 “Expense Agent API Validation”, ExpenseAgent: modified
- Codeunit 6941 “EA Http Client”, ExpenseAgent: modified
- Codeunit 6922 “Expense Agent Entra App Mgt.”, ExpenseAgent: added
- Page 6991 “Expense Agent Setup Wizard”, ExpenseAgent: modified
Context
- Work items: AB#640454
- Labels: AL: Apps (W1), ExpenseManagement, Team: Finance
- Systems: development
- From the description: “always add exactly one current-company Expense Agent permission during activation”
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).