#9988 [Expense Agent] Fix Employee subscriber permissions
Fixes Expense Agent Employee event subscribers so they can sync and delete Expense Users without callers needing Expense User permissions, using method-scoped inherent permissions. Adds an API.ReadWrite.All application entitlement and moves internal agent APIs out of the Expense Management - Objects permission set.
- 8files
- 3AL files
- 3objects
Pull request · merged into main (BC30) on 2026-08-13 by t-prda · 8 files (+361 -4), 3 AL · fix · tier official · reviewed (checked by Opus)
What changed
- New entitlement ‘EA - Azure AD Application API’ grants Expense Agent application API.ReadWrite.All access mapped to ‘Expense Mgmt. Edit’
- Employee event subscribers now have method-scoped inherent permissions for synchronization and deletion logic
- Internal APIs (Expense Capabilities, Expense Projects, and Expense Project Tasks Query) moved to agent-only ‘Expense Agent - Objects’ permission set
- Existing customer and partner Employee permission sets unaffected by changes
- Comprehensive test suite added covering synchronization, deletion guards, and multiple permission profiles
- Behaviour changes for users or extensions.
AL objects touched
- Entitlement “EA - Azure AD Application API”, ExpenseAgent: added
- Permission set 6904 “Expense Management - Objects”, ExpenseAgent: modified
- Codeunit 6908 “Expense Event Subscriber”, ExpenseAgent: modified
Context
- Work items: AB#645221
- Labels: AL: Apps (W1), Team: Integrations
- Systems: development
Source: metadata of a merged pull request in microsoft/BCApps (bcapps): title, labels, changed paths and counts, with a summary in our words. No source text and no description beyond one short quote (D10, D61).