Cross-environment Master Data synchronization (same tenant)

src/Apps/W1/MasterDataManagement/app/permissions/MDMCrossEnvRead.PermissionSet.al

@@ -0,0 +1,70 @@
+namespace Microsoft.Integration.MDM;
+
+using Microsoft.CRM.BusinessRelation;
+using Microsoft.CRM.Contact;
+using Microsoft.CRM.Setup;
+using Microsoft.CRM.Team;
+using Microsoft.Finance.Currency;
+using Microsoft.Finance.Dimension;
+using Microsoft.Finance.GeneralLedger.Account;
+using Microsoft.Finance.GeneralLedger.Setup;
+using Microsoft.Finance.SalesTax;
+using Microsoft.Finance.VAT.Setup;
+using Microsoft.Foundation.Address;
+using Microsoft.Foundation.NoSeries;
+using Microsoft.Foundation.PaymentTerms;
+using Microsoft.Foundation.Shipping;
+using Microsoft.Purchases.Setup;
+using Microsoft.Purchases.Vendor;
+using Microsoft.Sales.Customer;
+using Microsoft.Sales.Setup;
+using System.Environment;
+
+/// <summary>
+/// Assigned to the customer-registered Entra app on the SOURCE (Microsoft Entra Application Card) to grant
+/// cross-environment, read-only access to master data. Deliberately NOT part of "Master Data Mgt. - Objects":
+/// only this set grants execute on the ODataV4 source API, so local users cannot invoke it.
+/// Grants read on the master-data tables synchronized by the default configuration, so cross-environment sync
+/// works read-only out of the box. For custom or additional tables, a tenant admin extends this set (or assigns
+/// a second, narrowly scoped set alongside it) - which keeps least privilege instead of reaching for SUPER.
+/// </summary>
+permissionset 7242 "MDM Cross-Env Read"
+{
+    Assignable = true;
+    Access = Public;
+    Caption = 'Master Data Mgt. - Cross Environment';
+
+    Permissions = codeunit "MDM Cross-Env Source API" = X,
+                  tabledata "Salesperson/Purchaser" = R,
+                  tabledata Customer = R,
+                  tabledata Vendor = R,
+                  tabledata Contact = R,
+                  tabledata "Business Relation" = R,
+                  tabledata "Contact Business Relation" = R,
+                  tabledata "Country/Region" = R,
+                  tabledata "Post Code" = R,
+                  tabledata Currency = R,
+                  tabledata "Currency Exchange Rate" = R,
+                  tabledata "Payment Terms" = R,
+                  tabledata "Shipment Method" = R,
+                  tabledata "Shipping Agent" = R,
+                  tabledata "Sales & Receivables Setup" = R,
+                  tabledata "Purchases & Payables Setup" = R,
+                  tabledata "Marketing Setup" = R,
+                  tabledata "No. Series" = R,
+                  tabledata "No. Series Line" = R,
+                  tabledata "G/L Account" = R,
+                  tabledata Dimension = R,
+                  tabledata "Dimension Value" = R,
+                  tabledata "Gen. Business Posting Group" = R,
+                  tabledata "Gen. Product Posting Group" = R,
+                  tabledata "Customer Posting Group" = R,
+                  tabledata "Vendor Posting Group" = R,
+                  tabledata "VAT Business Posting Group" = R,
+                  tabledata "VAT Product Posting Group" = R,
+                  tabledata "VAT Posting Setup" = R,
+                  tabledata "Tax Area" = R,
+                  tabledata "Tax Group" = R,
+                  tabledata "Tax Jurisdiction" = R,
+                  tabledata "Tenant Media" = R;
+}

src/Apps/W1/MasterDataManagement/app/permissions/MasterDataMgtObjects.PermissionSet.al

@@ -10,7 +10,25 @@ permissionset 7230 "Master Data Mgt. - Objects"
     Assignable = false;
     Access = Public;
 
-    Permissions = codeunit * = X,
+    Permissions = codeunit "Master Data Mgt. Setup Default" = X,
+                  codeunit "Integration Master Data Synch." = X,
+                  codeunit "Master Data Management" = X,
+                  codeunit "Master Data Mgt. Table Couple" = X,
+                  codeunit "Master Data Mgt. Tbl. Uncouple" = X,
+                  codeunit "Master Data Mgt. Subscribers" = X,
+                  codeunit "Master Data Mgt. Upgrade" = X,
+                  codeunit "Master Data Mgt. Install" = X,
+                  codeunit "MDM Local Data Source" = X,
+                  codeunit "MDM Source Response" = X,
+                  codeunit "MDM Http Source Transport" = X,
+                  codeunit "MDM Cross-Env Data Source" = X,
+                  codeunit "MDM Source Connection" = X,
+                  codeunit "MDM Cross-Env Change Detector" = X,
+                  codeunit "MDM Source Capabilities" = X,
+                  codeunit "MDM Inline Media" = X,
+                  codeunit "MDM Source Watermark" = X,
+                  codeunit "MDM Contact Relation Cache" = X,
+                  codeunit "MDM Privacy Notice" = X,
                   page * = X,
                   table * = X,
                   xmlport * = X;