Audit AL app accessibility and debugging boundaries

Microsoft 365 roadmap 573336 · Development · generally available · roadmap status “Launched”, phase General Availability

What Microsoft says

“Build and query static AL call graphs to trace public-to-internal calls, debugging boundaries, elevated code, and cross-app relationships, with visual exports. Business value: Extension developers can understand how public APIs expose internal implementation details and where execution crosses debugging boundaries. This visibility helps teams review extension architecture, reduce unintended API exposure, and identify cases where sensitive values could become inspectable in the debugger. The analysis can run across an app and its dependencies, making it useful for architecture reviews, security assessments, and automated governance in larger extension portfolios.”

Dates

• General availability: October CY2026 (2026 release wave 2)
• Public preview: not given
• On the roadmap since 2026-09-30, last changed 2026-09-30

Covered by

Matched by Haiku among videos and Learn pages in the same galaxy system, checked against the roadmap ids and the evidence text. Every link below was reviewed by Opus.

Videos

• What’s new in AL and Tools (2026 release wave 2): Static call graph analysis at 25:47
• What’s new: ALGraph (2026 release wave 2): AL Graph at 0:05; AL Graph query language at 1:38; AL Graph DGML export at 1:56; AL Graph SARIF export at 1:56; AL Graph meta model extraction at 2:19; HTTP client caller auditing at 3:04; Non-debuggable to debuggable boundary audit at 4:13

Source: Microsoft 365 roadmap. Status words follow the roadmap.