diff --git a/community/knowledge/security/classify-every-field-with-dataclassification.bad.al b/microsoft/knowledge/security/classify-every-field-with-dataclassification.bad.al similarity index 100% rename from community/knowledge/security/classify-every-field-with-dataclassification.bad.al rename to microsoft/knowledge/security/classify-every-field-with-dataclassification.bad.al diff --git a/community/knowledge/security/classify-every-field-with-dataclassification.good.al b/microsoft/knowledge/security/classify-every-field-with-dataclassification.good.al similarity index 100% rename from community/knowledge/security/classify-every-field-with-dataclassification.good.al rename to microsoft/knowledge/security/classify-every-field-with-dataclassification.good.al diff --git a/community/knowledge/security/classify-every-field-with-dataclassification.md b/microsoft/knowledge/security/classify-every-field-with-dataclassification.md similarity index 100% rename from community/knowledge/security/classify-every-field-with-dataclassification.md rename to microsoft/knowledge/security/classify-every-field-with-dataclassification.md diff --git a/community/knowledge/security/compose-permission-sets-with-included-sets.bad.al b/microsoft/knowledge/security/compose-permission-sets-with-included-sets.bad.al similarity index 100% rename from community/knowledge/security/compose-permission-sets-with-included-sets.bad.al rename to microsoft/knowledge/security/compose-permission-sets-with-included-sets.bad.al diff --git a/community/knowledge/security/compose-permission-sets-with-included-sets.good.al b/microsoft/knowledge/security/compose-permission-sets-with-included-sets.good.al similarity index 100% rename from community/knowledge/security/compose-permission-sets-with-included-sets.good.al rename to microsoft/knowledge/security/compose-permission-sets-with-included-sets.good.al diff --git a/community/knowledge/security/compose-permission-sets-with-included-sets.md b/microsoft/knowledge/security/compose-permission-sets-with-included-sets.md similarity index 95% rename from community/knowledge/security/compose-permission-sets-with-included-sets.md rename to microsoft/knowledge/security/compose-permission-sets-with-included-sets.md index 7fb94cb..cdeec49 100644 --- a/community/knowledge/security/compose-permission-sets-with-included-sets.md +++ b/microsoft/knowledge/security/compose-permission-sets-with-included-sets.md @@ -9,8 +9,6 @@ application-area: [all] # Compose permission sets with IncludedPermissionSets -> Contributions welcome — open a PR to refine or extend this article. - ## Description The `IncludedPermissionSets` property lets one AL permission set reference another, composing rights out of smaller building blocks. Combined with `Assignable = false` on the building blocks, an extension can ship focused per-module units (a table-data cluster, an API-access cluster) and assemble role-shaped sets that include them. Adding an object updates one building block, and every role-shaped set that includes it inherits the change automatically — instead of drifting apart across duplicated definitions. diff --git a/community/knowledge/security/do-not-grant-rights-beyond-a-users-entitlement.md b/microsoft/knowledge/security/do-not-grant-rights-beyond-a-users-entitlement.md similarity index 95% rename from community/knowledge/security/do-not-grant-rights-beyond-a-users-entitlement.md rename to microsoft/knowledge/security/do-not-grant-rights-beyond-a-users-entitlement.md index 387c778..bc9a4e8 100644 --- a/community/knowledge/security/do-not-grant-rights-beyond-a-users-entitlement.md +++ b/microsoft/knowledge/security/do-not-grant-rights-beyond-a-users-entitlement.md @@ -9,8 +9,6 @@ application-area: [all] # Do not grant rights beyond a user's entitlement -> Contributions welcome — open a PR to refine or extend this article. - ## Description Entitlements are license-level caps on what a user can access, derived automatically from the BC license tier. Permission sets are application-level grants administered on top of the entitlement. A permission set can only grant within the entitlement's boundaries; grants beyond those boundaries are silently clipped at runtime. This means a permission set authored and validated in a developer sandbox (with a broad license) can appear to work correctly there and fail silently in a customer tenant where users hold a narrower entitlement. diff --git a/community/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.bad.al b/microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.bad.al similarity index 100% rename from community/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.bad.al rename to microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.bad.al diff --git a/community/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.good.al b/microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.good.al similarity index 100% rename from community/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.good.al rename to microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.good.al diff --git a/community/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.md b/microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.md similarity index 96% rename from community/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.md rename to microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.md index f12a4f9..131bb9b 100644 --- a/community/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.md +++ b/microsoft/knowledge/security/prefer-oauth2-over-api-keys-for-external-http-calls.md @@ -9,8 +9,6 @@ application-area: [all] # Prefer OAuth2 over API keys for external HTTP calls -> Contributions welcome — open a PR to refine or extend this article. - ## Description External HTTP integrations from AL can authenticate using OAuth 2.0 (client-credentials for service-to-service, authorization-code for user-delegated), API keys, basic authentication, or credentials in URLs. The mechanisms differ substantially in the blast radius of a leaked secret and in how cleanly tokens can be rotated. OAuth-issued tokens expire on their own schedule and rotate cleanly; API keys and basic-auth passwords typically have to be rotated manually and usually live unencrypted in a configuration table. When the partner supports OAuth, the difference is a material security improvement, not a stylistic preference. diff --git a/community/knowledge/security/protect-sensitive-data-in-temporary-tables.bad.al b/microsoft/knowledge/security/protect-sensitive-data-in-temporary-tables.bad.al similarity index 100% rename from community/knowledge/security/protect-sensitive-data-in-temporary-tables.bad.al rename to microsoft/knowledge/security/protect-sensitive-data-in-temporary-tables.bad.al diff --git a/community/knowledge/security/protect-sensitive-data-in-temporary-tables.good.al b/microsoft/knowledge/security/protect-sensitive-data-in-temporary-tables.good.al similarity index 90% rename from community/knowledge/security/protect-sensitive-data-in-temporary-tables.good.al rename to microsoft/knowledge/security/protect-sensitive-data-in-temporary-tables.good.al index 54bf2bb..a0c9f77 100644 --- a/community/knowledge/security/protect-sensitive-data-in-temporary-tables.good.al +++ b/microsoft/knowledge/security/protect-sensitive-data-in-temporary-tables.good.al @@ -19,9 +19,6 @@ codeunit 50100 "Customer Temp Processor" until Customer.Next() = 0; ProcessCustomerBuffer(TempCustomer); - - // Explicit cleanup on the normal exit path. - TempCustomer.DeleteAll(); exit(true); end; diff --git a/community/knowledge/security/protect-sensitive-data-in-temporary-tables.md b/microsoft/knowledge/security/protect-sensitive-data-in-temporary-tables.md similarity index 77% rename from community/knowledge/security/protect-sensitive-data-in-temporary-tables.md rename to microsoft/knowledge/security/protect-sensitive-data-in-temporary-tables.md index 3f4db02..7eedc02 100644 --- a/community/knowledge/security/protect-sensitive-data-in-temporary-tables.md +++ b/microsoft/knowledge/security/protect-sensitive-data-in-temporary-tables.md @@ -9,15 +9,13 @@ application-area: [all] # Protect sensitive data in temporary tables -> Contributions welcome — open a PR to refine or extend this article. - ## Description A temporary record copies data out of the source table into session memory. The platform does not automatically enforce the source table's permission model on the copy, and a value written to a temporary buffer can outlive the procedure that put it there if the buffer is a global or is passed upward. Code that places sensitive rows into a temporary table is therefore responsible for the checks and cleanup the source table would otherwise provide. ## Best Practice -Validate the caller's read permission on the source table before populating the temporary buffer. Keep the buffer's lifetime as short as the work requires, and delete its contents on every exit path — including error paths — so sensitive values do not linger. Prefer local temporary variables over globals for anything carrying sensitive data. +Validate the caller's read permission on the source table before populating the temporary buffer. Keep the buffer's lifetime as short as the work requires, and prefer local temporary variables over globals for anything carrying sensitive data — a local buffer's contents are discarded automatically when the procedure returns. When a buffer must be global or is passed back to callers, delete its contents on every exit path — including error paths — so sensitive values do not linger. See sample: `protect-sensitive-data-in-temporary-tables.good.al`.