---
id: change/bcapps/9717
type: change
title: "#9717 Fix internal admin losing SUPER during customized plan provisioning"
summary: Internal tenant administrators no longer lose SUPER permission set when their customized plan configuration omits it during first-time provisioning, preventing accidental lockout.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - codeunit azure ad plan impl.
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:10:58.456Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: ea113f8d0292fb0fff643dea78d859e7c0ef24b5
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/9717
    title: "microsoft/BCApps#9717: Fix internal admin losing SUPER during customized plan provisioning"
    date: "2026-07-29"
    commit: ea113f8d0292fb0fff643dea78d859e7c0ef24b5
    t: null
    quote: null
links:
  learn: []
  objects:
    - object/codeunit/9018
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 9717
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/9717
kind: pr
base_branch: main
major: "30"
merged_at: "2026-07-29T09:36:28Z"
author: darjoo
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - "AL: System Application"
  - "Team: Integrations"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 2
  additions: 297
  deletions: 1
  al: 1
apps:
  - System Application
objects_touched:
  - key: codeunit/9018
    page: codeunit/9018
    type: codeunit
    id: 9018
    name: Azure AD Plan Impl.
    app: System Application
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 643970
systems:
  - development
quote: null
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #9717 Fix internal admin losing SUPER during customized plan provisioning

> Internal tenant administrators no longer lose SUPER permission set when their customized plan configuration omits it during first-time provisioning, preventing accidental lockout.

[Pull request](https://github.com/microsoft/BCApps/pull/9717) · merged into `main` (BC30) on 2026-07-29 by darjoo · 2 files (+297 -1), 1 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- Added IsUserInternalAdmin helper to check Global Admin, Dynamics 365 Admin, and BC Admin plans
- Applied internal-admin exemption to customized plan branch where it was previously bypassed
- Delegated admins intentionally excluded from exemption as their SUPER is governed separately
- Added six comprehensive tests covering various admin and user scenarios with customized plans
- Default plan behavior and existing users remain unaffected
- Behaviour changes for users or extensions.

## AL objects touched

- [Codeunit 9018 "Azure AD Plan Impl."](../../objects/codeunit/9018.md), System Application: modified

## Context

- Work items: AB#643970
- Labels: AL: Apps (W1), AL: System Application, Team: Integrations
- Systems: development

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).