Handling security

Path: Development > Programming in the AL language > Handling security · tier official · system development · narrative reviewed (checked by Opus)

Overview

This section covers how AL developers secure Business Central apps. It starts with a general guidance page on security best practices: a security development lifecycle, a layered security model, user session and web service authentication, auditing, encryption, entitlements, and permission sets.

Two subtopics go deeper. The permission sets and entitlements subtopic (14 pages) covers defining and extending permission set and entitlement objects, object permissions, inherent permissions, XML export, upgrading from legacy permissions, and permission telemetry. The Azure Key Vault subtopic (5 pages) covers setting up app key vaults for online and on-premises deployments, retrieving secrets in AL, and monitoring secret access with telemetry.

Two own pages cover storing and handling sensitive values in code: Isolated Storage keeps keys and values private to an extension, and the SecretText data type stops credentials from being exposed during debugging. Start with the security overview, then go to the subtopic or page that matches your task.

Key points

• The overview page covers authentication, authorization, auditing, encryption, and secrets management for AL developers.
• Permission sets and entitlements are defined as AL objects; permission sets can be composed and extended, and permissions can be exported to XML.
• Guidance includes setting object permissions, inherent permissions, and upgrading from legacy permissions.
• Permission telemetry can be analyzed to understand permission use.
• App key vaults can be set up for both online and on-premises deployments, and secrets are retrieved in AL code.
• Secret access from Key Vault can be monitored with telemetry.
• Isolated Storage offers extension-isolated storage with Set, Get, Contains, Delete, and SetEncrypted methods and a DataScope option type.
• SecretText prevents credential exposure during debugging by restricting assignments to debuggable types, and supports secure operations through HttpClient and SecretStrSubstNo; related features include the Unwrap method and the NonDebuggable attribute.

Subtopics

• Permission sets and entitlements overview (14 pages)
• Using Azure Key Vault for app secrets (5 pages)

More Learn pages

• Business Central security for AL developers: Understand and improve the security of your Business Central apps written in AL.
• Isolated Storage: Isolated Storage is a data storage that provides isolation between extensions, so that you can keep keys/values in one extension from being accessed from other extensions.
• Protecting sensitive values with the SecretText data type: The SecretText data type is designed to protect sensitive values from being exposed when debugging.

Videos, posts and code changes

Linked by a Haiku matcher with a grounding quote from the item’s summary (link/topics.ts); machine-generated.

• #10382 [Expense Agent] Fix administrative recall history access (code change): “Only the captured submitter or a user with Unlimited Expense Approval can recall”
• #10492 [SOA] Restrict direct deletion of contact overrides (code change): “Inherent delete permission removed from table to prevent unauthorized direct deletion”
• #11996 Restrict expense configuration maintenance to admins (code change): “Restrict configuration maintenance for expense management to administrators”
• #12140 [Email - SMTP Connector] Fix OAuth Base64URL token parsing (code change): “Base64URL tokens are converted to standard Base64 format before decoding”
• #9360 Harden SFTP Client module (security review phase 1) (code change): “MD5 host-key fingerprints are no longer supported; only SHA256 prefixes accepted”
• #9717 Fix internal admin losing SUPER during customized plan provisioning (code change): “Internal tenant administrators no longer lose SUPER permission set when their customized plan”
• #9838 Grant indirect read on Privacy Notice tables in Privacy Notice Impl. (code change): “The Privacy Notice Impl. codeunit now grants indirect read permission on Privacy Notice”
• #102 Privacy DataClassification fixes + keep Label-scope findings at minor (code change): “Fixed factual errors in the privacy data-classification article”
• #131 Correct table-level data classification guidance (code change): “Privacy guidance now states that a valid table-level DataClassification is inherited by fields”
• #92 Correct security and privacy knowledge guidance (code change): “Security and privacy knowledge articles were corrected to align with current Business Central APIs”
• BC Friday Tips #37 Inherent Permissions (community post): “Inherent Permissions in AL allow developers to grant temporary access”
• What’s New: Server and Database - A Faster Runtime (2023 release wave 2) (video): “Error Info Permission Checking; Permissions Work with Security Groups”

Source: Microsoft Learn (CC BY 4.0). Descriptions are Learn’s own.