bcquality/microsoft/knowledge/security/use-isolated-storage-for-module-and-company-secrets.md

bc-version	domain	keywords	technologies	countries	application-area
all	security	isolatedstorage encryption datascope secrets	al	w1	all

Use IsolatedStorage for module and company secrets

Contributions welcome — open a PR to refine or extend this article.

Description

IsolatedStorage is a per-extension, per-tenant key-value store. DataScope::Module isolates values to the extension across the tenant; DataScope::Company scopes them to a single company within the tenant. The SetEncrypted method stores the value encrypted at rest; Set stores it in plaintext. SetEncrypted accepts inputs up to 215 characters (special characters may consume more space).

Best Practice

Use IsolatedStorage.SetEncrypted to write secrets, IsolatedStorage.Contains to probe, and IsolatedStorage.Get into a SecretText destination to read. Choose DataScope::Company for per-company credentials (for example, a tenant-per-company service account) and DataScope::Module for extension-wide configuration. Procedures that call IsolatedStorage.Get, Set, SetEncrypted, Contains, or Delete must be local or internal; a public wrapper lets other extensions call into your storage boundary.

See sample: use-isolated-storage-for-module-and-company-secrets.good.al.

Anti Pattern

Storing secrets in a Setup table column as plain Text, using IsolatedStorage.Set (unencrypted) for values that authenticate the extension to an external service, or exposing a public Get/Set procedure around IsolatedStorage. The first two leave secrets readable; the public wrapper lets another extension exfiltrate or overwrite values through your codeunit.

See sample: use-isolated-storage-for-module-and-company-secrets.bad.al.