What’s new: ALGraph (2026 release wave 2)
AL Graph, a tool in the AL tools package that builds call graphs of AL code, is shown in a 2026 release wave 2 video. It covers querying callers, exporting to DGML and SARIF, and auditing the non-debuggable to debuggable boundary for security.
- Introduction to AL Graph
- Use cases: code auditing and security
- Query language and export formats
- Building the meta model
- Querying HTTP client callers
- Auditing non-debuggable to debuggable boundaries
- Security implications and closing
Overview
The video introduces AL Graph, a tool in the AL tools package that constructs call graphs. These graphs show caller-callee relationships, external integration points and dependencies, and can be used for code auditing and security analysis.
The demo builds a meta model of an app once, stores it as JSON and queries it repeatedly. It then runs two audits: finding all callers of the HTTP client and tracing call paths that reach HTTP requests, and finding callees of non-debuggable methods to see where debugging could expose secrets. Query syntax is documented on MS Learn.
Key points
- AL Graph builds call graphs to show caller-callee relationships, external integration points, dependencies and possible security issues.
- The meta model is built once with the ‘extract whole’ method, stored as JSON and then queried many times.
- The query language can build complex queries, such as callers of an object, methods that interact with tables, or paths from your own sensitive objects. Syntax is documented on MS Learn.
- Query results can be exported as DGML for human analysis of call relationships, or as SARIF, which is flat and meant to be easy for agents to consume.
- An HTTP client caller query lists all callers and the call paths that can reach HTTP requests, which helps audit external integrations.
- The non-debuggable to debuggable boundary audit finds callees of non-debuggable methods. A breakpoint in a debuggable method reached from non-debuggable code can leak secrets.
Features
| Feature | Status | At |
|---|---|---|
| AL Graph | generally available (roadmap Audit AL app accessibility and debugging boundaries), demoed | 0:05 |
| AL Graph query language | generally available (roadmap Audit AL app accessibility and debugging boundaries), demoed | 1:38 |
| AL Graph DGML export | generally available (roadmap Audit AL app accessibility and debugging boundaries), demoed | 1:56 |
| AL Graph SARIF export | generally available (roadmap Audit AL app accessibility and debugging boundaries) | 1:56 |
| AL Graph meta model extraction | generally available (roadmap Audit AL app accessibility and debugging boundaries), demoed | 2:19 |
| HTTP client caller auditing | generally available (roadmap Audit AL app accessibility and debugging boundaries), demoed | 3:04 |
| Non-debuggable to debuggable boundary audit | generally available (roadmap Audit AL app accessibility and debugging boundaries), demoed | 4:13 |
A status with a roadmap link comes from the Microsoft 365 roadmap feature this part of the video covers (matched by Haiku; links Opus dropped are not used); other statuses need a status word in the video itself.
AL objects mentioned
As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.
- other “HTTP client” at 3:26
Quotes
- 0:30 “it is a tool that is focused around constructing call graphs. Um, so if you’ve ever wanted to know, like, you know, the structure”
- 0:58 “It basically allows you to do auditing of your code base. So, for example, if you’ve ever wanted to know where in your code”
- 1:10 “if you want to do security auditing, one big one um, that we’re quite focused on is the non-debuggable to debuggable boundary. Um, because,”
- 1:38 “you can actually uh, construct fairly complex queries. So, if you have your own sensitive objects, for example, you can say, Okay, give me”
- 2:30 “this is a one-time thing. It’s basically building the representation of the different uh caller-callee relationships in your app.”
- 4:24 “this query language that all the different operations you can do this is all well documented on our um MS Learn website.”
Presenters (as heard): Thaddeus.