Microsoft/bcquality
1
0
Fork 0
mirror of https://github.com/microsoft/BCQuality.git synced 2026-08-06 17:36:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions
bcquality/microsoft/knowledge/appsource/permission-sets-cover-setup-and-usage-without-super.md
Jesper Schulz-Wedde e81632b4be Complete AL review knowledge readiness 
Fill telemetry and Query coverage, strengthen thin review domains, correct audited content defects, and add deterministic cheap-model evaluation and reference-integrity safeguards.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 9825b012-e653-496a-9310-c1f4b6f8ac27
2026-07-15 07:19:15 +02:00

1.5 KiB
Raw Blame History

bc-version domain keywords technologies countries application-area
all
appsource
permission-set
super
appsource
setup
usage
tabledata
execute
submission
al
w1
all

AppSource permission sets must cover setup and usage without SUPER

Description

An AppSource app must provide permission sets that let assigned users complete the app's setup and normal usage without SUPER. The requirement is about complete effective grants, not about naming the permission set after the app. A package can compile and install with missing tabledata or execute permissions, then fail only when Marketplace validation or a real non-SUPER user reaches the omitted path.

Best Practice

Trace every setup page, normal page, report, codeunit, and tabledata operation exposed by the app and cover it through assignable role permission sets composed from focused non-assignable sets. Validate setup and representative workflows as a user assigned only those app roles. Grant the minimum required operations; completeness is not a reason to use wildcards.

See sample: permission-sets-cover-setup-and-usage-without-super.good.al.

Anti Pattern

Shipping no permission set, omitting a tabledata or execute grant used by the app's own UI, or instructing users and validators to assign SUPER when setup fails. Do not flag a permission-set name that differs from the app name; no such naming requirement exists.

See sample: permission-sets-cover-setup-and-usage-without-super.bad.al.