What's New: Environment-Level Access Controls for Delegated Administrators (2024 release wave 2)

Overview

The video covers a new environment-level control for partner access, introduced with Business Central 2024 release wave 2. On the environment details page in the tenant admin center, internal administrators can modify the partner access setting. The default is all partners, which has always applied.

The demo shows switching to selected partners by picking from a list of foreign tenants, then reverting and disabling partner access entirely. It explains that the setting affects authentication of delegated users and foreign multi-tenant applications. It sits on top of the tenant-level access that must already be configured.

Key points

• The partner access setting is on the environment details page in the tenant admin center and has three values: all partners (default), selected partners, and off.
• All partners mode grants access to external tenants with GDAP relationships or application-level access.
• Selected partners mode lets an internal administrator choose which foreign tenants can view and administer the environment.
• Current limit: access can be restricted to a maximum of 10 Entra tenants per environment.
• Turning partner access off limits environment access and administration to internal administrators.
• The setting affects authentication of delegated users and foreign multi-tenant applications, including login and admin center visibility.
• It does not replace tenant-level setup: GDAP relationships, app registrations and admin consent for external applications are still required.

Features

Every feature below: status not stated, demoed.

AL objects mentioned

As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.

• page “environments list page” at 0:46
• page “environment Details page” at 1:07
• page “tenant admin Center” at 0:26

Not found in BC28-30: page “environments list page”, page “environment Details page”, page “tenant admin Center”.

Quotes

• 0:06 “a new feature that is going to be introduced with the business Central 2024 Wave 2 and that is the ability to control the”
• 1:07 “partner access and right now the value is set to all Partners this is exactly the default value that applies and has always applied”
• 2:07 “if a tenant has a gdap relationship with my customer tenant then it will show as access type gup or if a tenant has”
• 3:08 “selected Partners so only the external tenants that I have explicitly opted in for this feature will have access to view and administer this”
• 4:08 “the partner access settings affect the authentication of delegated users and foreign multi-tenant applications so both of these set of um users or applications”
• 5:03 “this is a feature that acts on top of the requirement of having the tenant level access consents set up properly so it does”
• 5:43 “we have a limitation for being able to restrict the environment access on a given environment for up to 10 entra tenants”
• 5:43 “the ability to control the um environment level access is only available to internal administrators”

Disclaimers in the video

• 5:03 subject-to-change: this is a feature that acts on top of the requirement of having the tenant level access consents set up properly so it does not replace the need for setting up the gup relationships for external partner tenants or setting up app registrations and admin consent for uh external applications so this is still a requirement
• 5:43 other: at the moment we have a limitation for being able to restrict the environment access on a given environment for up to 10 entra tenants

Presenters (as heard): Ricardo.