#9966 Harden Contact Sync delta URL and ownership checks
Contact Sync now validates delta URLs against the approved Microsoft Graph endpoint and enforces record ownership checks to prevent malicious URL manipulation or cross-user record access.
- 8files
- 4AL files
- 4objects
Pull request · merged into main (BC30) on 2026-08-27 by Naveen26423 · 8 files (+460 -34), 4 AL · fix · tier official · reviewed (checked by Opus)
What changed
- Delta URLs are validated before persisting to ensure they match the https://graph.microsoft.com/v1.0/ prefix
- Invalid delta URLs trigger fallback to full sync instead of failing
- Record ownership enforcement prevents users from inserting or modifying other users’ sync records
- User ID field changes on existing records are blocked
- Install and upgrade contexts bypass ownership checks to avoid regressions
- Behaviour changes for users or extensions.
AL objects touched
- Page 7100 “Contact Sync”, Base Application: modified
- Table 7121 “Contact Sync User”, Base Application: modified
- Codeunit 7100 “Contact Sync User Subscriber”, Base Application: added
- Codeunit 7106 “O365 Bidirectional Sync”, Base Application: modified
Context
- Work items: AB#645036
- Labels: Team: SCM
- Systems: crm
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).