[Bug 640454] Scope Expense Agent Entra permissions by company

[Prangshuman Das (t-prda)]

Summary

• centralize Expense Agent Microsoft Entra application lifecycle and identity lookup
• add the Expense Agent permission for the exact current company during activation
• remove only the current-company permission after successful ERP unregistration
• disable the shared Entra application only when no Expense Agent company permissions remain
• preserve the existing SECURITY/SUPER permission requirement for changing the Entra application state

Validation

• built and published Expense Agent and Expense Agent Tests to W1 tenant1-1
• verified the original other-company permission test failed before the fix
• passed all 7 activation/deactivation lifecycle tests in codeunit 148361 after the fix
• inspected platform AAD Application state validation and confirmed enable/disable changes the backing user state without deleting other-company access-control rows

Manual verification

• activate the agent in company A, copy to company B, activate in B, and confirm both company-scoped permissions exist

Fixes AB#640454

[alexei-dobriansky]

Good Sense Reviewer - Round 1

Recommendation: Request Changes

What this PR does

This change moves Expense Agent Entra application handling into one codeunit. Activation now adds the Expense Agent permission for the current company, and deactivation removes only the current-company permission before disabling the shared application only when no company permissions remain.

The functional approach matches the company-copy problem, and the new tests cover activation and deactivation with current-company, other-company, and unrelated permissions. However, the current build reports new overflow warnings in the changed app and test code, and those warnings are treated as failures. The PR is not merge-ready until those warnings are removed.

Problem-solution fit

Fit: Strong

The reported scenario is that a copied company keeps the old company permission for the Expense Agent application user, so activation in the copied company can still use the wrong company. The diff addresses that by checking and maintaining permissions per company, while keeping the shared application enabled when another company still uses it.

Suggestions

S1 (🔴 High): Fix new company-name overflow warnings
Use a bounded value when passing CompanyName() into Text[30] parameters or the Access Control.Company Name field, and update the new tests in the same way. The current build flags these new AA0139 warnings as failures, so the PR cannot merge until they are removed.

Risk assessment and necessity

Risk: The changed surface controls the Entra application user and its company-scoped permissions for Expense Agent activation and deactivation. A wrong permission row can block activation in copied companies or remove access for another company. The logic is narrow and tested, but the build-blocking warnings must be fixed before the change can safely go in.

Necessity: The change is justified. Without it, a copied company can keep using a permission row from the source company, and the manual mitigation requires changing application state and permissions by hand. The scope is appropriate for the bug once the build is clean.

---

[AI-PR-REVIEW] version=1 promptVersion=4 system=github pr=11290 round=1 by=alexei-dobriansky at=2026-09-10T01:24:16.3887738Z lastSha=943df727f0686d1d23bb37648239ed3437232653 reviewKey=946a03bea533c818760a97e11768b5ea6354f6e5aff25797a34d23896d09f01a suggestions=S1@66887712

[Prangshuman Das (t-prda)]

Addressed the build-blocking AA0139 findings in 50295b0 by bounding all new company-name values to Text[30]. Also scoped Expense Agent permission resolution by App ID and scope and switched the AAD lookup to Get(). The seven configuration lifecycle scenarios pass individually on tenant1-1; analyzer output has no warnings in changed files.