#9717 Fix internal admin losing SUPER during customized plan provisioning
Internal tenant administrators no longer lose SUPER permission set when their customized plan configuration omits it during first-time provisioning, preventing accidental lockout.
- 2files
- 1AL files
- 1objects
Pull request · merged into main (BC30) on 2026-07-29 by darjoo · 2 files (+297 -1), 1 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Added IsUserInternalAdmin helper to check Global Admin, Dynamics 365 Admin, and BC Admin plans
- Applied internal-admin exemption to customized plan branch where it was previously bypassed
- Delegated admins intentionally excluded from exemption as their SUPER is governed separately
- Added six comprehensive tests covering various admin and user scenarios with customized plans
- Default plan behavior and existing users remain unaffected
- Behaviour changes for users or extensions.
AL objects touched
- Codeunit 9018 “Azure AD Plan Impl.”, System Application: modified
Context
- Work items: AB#643970
- Labels: AL: Apps (W1), AL: System Application, Team: Integrations
- Systems: development
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).