---
id: change/bcapps/11996
type: change
title: "#11996 Restrict expense configuration maintenance to admins"
summary: Restrict configuration maintenance for expense management to administrators by removing write permissions from the Expense Mgmt. Edit permission set and granting them only through Expense Mgmt. Admin.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - permissionset expense mgmt. admin
  - permissionset expense mgmt. edit
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:03:19.023Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: 9b8f23733e0646da2fbe615dec67fc4ab1e70839
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/11996
    title: "microsoft/BCApps#11996: Restrict expense configuration maintenance to admins"
    date: "2026-09-29"
    commit: 9b8f23733e0646da2fbe615dec67fc4ab1e70839
    t: null
    quote: Remove direct insert, modify, and delete permissions for Expense User, Expense Team, and Expense Approval Setup from Expense Mgmt. Edit.
links:
  learn: []
  objects:
    - object/permissionset/6905
    - object/permissionset/6906
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 11996
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/11996
kind: pr
base_branch: main
major: "30"
merged_at: "2026-09-29T12:43:04Z"
author: encimita
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - "Team: Finance"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 3
  additions: 12
  deletions: 8
  al: 2
apps:
  - ExpenseAgent
objects_touched:
  - key: permissionset/6905
    page: permissionset/6905
    type: permissionset
    id: 6905
    name: Expense Mgmt. Admin
    app: ExpenseAgent
    status: modified
  - key: permissionset/6906
    page: permissionset/6906
    type: permissionset
    id: 6906
    name: Expense Mgmt. Edit
    app: ExpenseAgent
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 648885
systems:
  - development
quote: Remove direct insert, modify, and delete permissions for Expense User, Expense Team, and Expense Approval Setup from Expense Mgmt. Edit.
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #11996 Restrict expense configuration maintenance to admins

> Restrict configuration maintenance for expense management to administrators by removing write permissions from the Expense Mgmt. Edit permission set and granting them only through Expense Mgmt. Admin.

[Pull request](https://github.com/microsoft/BCApps/pull/11996) · merged into `main` (BC30) on 2026-09-29 by encimita · 3 files (+12 -8), 2 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Remove insert, modify, and delete permissions for Expense User, Expense Team, and Expense Approval Setup from Expense Mgmt. Edit
- Grant configuration permissions exclusively through Expense Mgmt. Admin permission set
- Prevent standard users (D365 BASIC, D365 TEAM MEMBER) from modifying expense setup while preserving their ability to edit expense reports
- Employee synchronization continues using scoped inherent permissions
- Add test coverage for the permission separation
- Behaviour changes for users or extensions.

## AL objects touched

- [Permission set 6905 "Expense Mgmt. Admin"](../../objects/permissionset/6905.md), ExpenseAgent: modified
- [Permission set 6906 "Expense Mgmt. Edit"](../../objects/permissionset/6906.md), ExpenseAgent: modified

## Context

- Work items: AB#648885
- Labels: AL: Apps (W1), Team: Finance
- Systems: development
- From the description: "Remove direct insert, modify, and delete permissions for Expense User, Expense Team, and Expense Approval Setup from Expense Mgmt. Edit."

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).