What's new: Cross-environment Master Data Management (2026 release wave 2)

Overview

The video covers the 2026 release wave 2 capability for synchronizing master data across environments. Subsidiaries in the same tenant but in different environments can pull data from the headquarters (HQ) company with a built-in solution, without middleware or custom code. HQ stays the read-only main source and controls what subsidiaries can read through permission sets.

It walks through the architecture, security and data flow, and the setup. The demo shows subsidiary setup with the wizard, app registration and permissions, the initial synchronization, and how a change in the source propagates and is monitored in the synchronization log.

Key points

• All environments must be in the same tenant. The OAuth 2 app is registered in that tenant (for example in Azure portal) with API read write all application level permissions, a redirect URL and a single tenant sign-in audience.
• In the source (HQ) environment, the admin consents the app on the Microsoft Entra applications page and assigns the designed permission set to the created Entra user. That permission set includes read permissions for all default tables.
• Tables beyond the default ones need a new permission set with read permissions added to the Entra user in the source, so HQ controls who reads what.
• The subsidiary runs the cross-environment setup wizard from Master Data Management setup, entering the HQ environment name, company name, client ID and client secret. Credentials are kept secure and cannot be read.
• One app can be shared across multiple subsidiaries, or one app can be registered per subsidiary, depending on audit needs.
• HQ remains read-only. Subsidiaries pull only the changes after initial synchronization, which runs in a predefined order (business relation, then dimension, and so on) like single-environment sync.
• Pictures and attachments travel with records; pictures are limited, for now, to 512 KB each. The UI, mapping and synchronization engine are the same as single-environment sync, including the per-table synchronization log. In the demo, a source change propagated after about a minute.

Features

AL objects mentioned

As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.

• table 18 “Customer” at 7:59
• table 23 “Vendor” at 7:59
• table 5053 “Business Relation” at 7:26
• table 348 “Dimension” at 7:26

Quotes

• 0:55 “Now, it will be possible for subsidiaries in the same tenant, but different environments to pull data from the HQ company. And it is”
• 1:45 “HQ still the read-only and the main source uh of the data. Uh we can see the data will cross the environment boundary and”
• 2:00 “all subsidiaries can pull the data, and they’re not every time getting all the things, but only the changes. Behind it is a technology”
• 2:29 “when you’re adding tables, HQ need to give the read permissions. Uh so, the subsidiary will have an access to them.”
• 2:43 “pictures and attachments will travel along with the record. The only, for now, limitation there, pictures, uh should be up to 512 KB each,”
• 6:31 “it includes read permissions for all the default tables. As Xenia mentioned, if you add more tables than the default ones, then you need”
• 9:02 “if I refresh, I can see it got the new value that was changed in the source. So, the rescheduling of synchronization jobs and”

Disclaimers in the video

• 2:43 subject-to-change: pictures, uh should be up to 512 KB each, no more. So, as you already understand, all the environments should be in the same tenant

Presenters (as heard): Ksenia, George.