---
id: change/bcapps/9988
type: change
title: "#9988 [Expense Agent] Fix Employee subscriber permissions"
summary: Fixes Expense Agent Employee event subscribers so they can sync and delete Expense Users without callers needing Expense User permissions, using method-scoped inherent permissions. Adds an API.ReadWrite.All application entitlement and moves internal agent APIs out of the Expense Management - Objects permission set.
tier: official
language: en
tags:
  - fix
  - main
  - bc30
  - entitlement ea - azure ad application api
  - permissionset expense management - objects
  - codeunit expense event subscriber
system: development
review:
  state: reviewed
  by: opus
  at: "2026-10-08T02:09:24.384Z"
  flags: []
generated:
  at: "2026-10-08T01:26:53.141Z"
  pipeline: 0.2.0
  prompts:
    extract-change: 1
  input_hash: c75d0c73e63e26f9aaa9d43b2392aa5d0e826dec
evidence:
  - kind: code
    url: https://github.com/microsoft/BCApps/pull/9988
    title: "microsoft/BCApps#9988: [Expense Agent] Fix Employee subscriber permissions"
    date: "2026-08-13"
    commit: c75d0c73e63e26f9aaa9d43b2392aa5d0e826dec
    t: null
    quote: null
links:
  learn: []
  objects:
    - object/entitlement/ea-azure-ad-application-api
    - object/permissionset/6904
    - object/codeunit/6908
  features: []
  topics: []
  localizations: []
  videos: []
  posts: []
  guidelines: []
  changes: []
number: 9988
repo: microsoft/BCApps
source_id: bcapps-prs
url: https://github.com/microsoft/BCApps/pull/9988
kind: pr
base_branch: main
major: "30"
merged_at: "2026-08-13T16:08:55Z"
author: t-prda
author_type: User
community_contribution: false
labels:
  - "AL: Apps (W1)"
  - "Team: Integrations"
change_class: code
change_kind: fix
behavior_change: true
breaking: false
files:
  count: 8
  additions: 361
  deletions: 4
  al: 3
apps:
  - ExpenseAgent
objects_touched:
  - key: entitlement/ea - azure ad application api
    page: entitlement/ea-azure-ad-application-api
    type: entitlement
    id: null
    name: EA - Azure AD Application API
    app: ExpenseAgent
    status: added
  - key: permissionset/6904
    page: permissionset/6904
    type: permissionset
    id: 6904
    name: Expense Management - Objects
    app: ExpenseAgent
    status: modified
  - key: codeunit/6908
    page: codeunit/6908
    type: codeunit
    id: 6908
    name: Expense Event Subscriber
    app: ExpenseAgent
    status: modified
objects_unjoined: []
obsoletions: []
backports: []
fixes_issues: []
work_items:
  - 645221
systems:
  - development
quote: null
joined_against:
  major: "30"
  commit: ecbc028c25dbe83b61313bc566e6c1d41184bb1c
---

# #9988 [Expense Agent] Fix Employee subscriber permissions

> Fixes Expense Agent Employee event subscribers so they can sync and delete Expense Users without callers needing Expense User permissions, using method-scoped inherent permissions. Adds an API.ReadWrite.All application entitlement and moves internal agent APIs out of the Expense Management - Objects permission set.

[Pull request](https://github.com/microsoft/BCApps/pull/9988) · merged into `main` (BC30) on 2026-08-13 by t-prda · 8 files (+361 -4), 3 AL · fix · tier official · reviewed (checked by Opus)

## What changed

- New entitlement 'EA - Azure AD Application API' grants Expense Agent application API.ReadWrite.All access mapped to 'Expense Mgmt. Edit'
- Employee event subscribers now have method-scoped inherent permissions for synchronization and deletion logic
- Internal APIs (Expense Capabilities, Expense Projects, and Expense Project Tasks Query) moved to agent-only 'Expense Agent - Objects' permission set
- Existing customer and partner Employee permission sets unaffected by changes
- Comprehensive test suite added covering synchronization, deletion guards, and multiple permission profiles
- Behaviour changes for users or extensions.

## AL objects touched

- [Entitlement "EA - Azure AD Application API"](../../objects/entitlement/ea-azure-ad-application-api.md), ExpenseAgent: added
- [Permission set 6904 "Expense Management - Objects"](../../objects/permissionset/6904.md), ExpenseAgent: modified
- [Codeunit 6908 "Expense Event Subscriber"](../../objects/codeunit/6908.md), ExpenseAgent: modified

## Context

- Work items: AB#645221
- Labels: AL: Apps (W1), Team: Integrations
- Systems: development

Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).