Limit permissions to CCMS only

[mortenseifert]

No description provided.

[Copilot]

🟡 Changes recommended

The “read-only” permissionset now grants write access to many tables and both admin/admin-read sets include a report permission that will fail due to missing telemetry tabledata permissions.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR tightens the scope of the “D4P BC ADMIN” and “D4P BC ADMIN READ” permission sets by replacing wildcard permissions (*) with an explicit allow-list of CCMS objects (tables/tabledata/pages/reports/codeunits), aligning access more closely to the CCMS app surface area.

Changes:

• Replaced wildcard object permissions in admin and admin-read permission sets with explicit per-object permissions.
• Added/adjusted using references to match the now-explicit object set.

File summaries

File	Description
CCMS/src/Permissions/D4PBCAdminRead.permissionset.al	Replaces wildcard read permissions with an explicit object list for the read-only admin role.
CCMS/src/Permissions/D4PBCAdmin.permissionset.al	Replaces wildcard full-access permissions with an explicit object list for the admin role.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The updated permission sets currently grant unnecessary access (read role) and omit required KQL/telemetry permissions, causing telemetry and data-refresh actions to fail or be incorrectly allowed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

CCMS/src/Permissions/D4PBCAdminRead.permissionset.al:67

• "D4P BC ADMIN READ" allows executing telemetry helper/report functionality (via actions on "D4P BC Environment List") but does not currently grant the required permissions to the KQL query store/result tables/pages; those actions will fail with permission errors. Also, the read-only set should not grant execute permission to the data-refresh report "D4P Get Installed Apps" (it deletes/inserts into "D4P BC Installed App" but this permission set only has R on that table).

        table "D4P PTE Object Range" = X,
        report "D4P Get Installed Apps" = X,
        report "D4P Load Data" = X,
        codeunit "D4P AppInsights Client" = X,

CCMS/src/Permissions/D4PBCAdmin.permissionset.al:67

• "D4P BC ADMIN" grants execute access to telemetry actions (codeunit "D4P Telemetry Helper" and report "D4P Load Data" are used from actions on "D4P BC Environment List") but is missing the required permissions for the KQL query store/result tables/pages; as-is, the telemetry actions will fail with permission errors.

        table "D4P PTE Object Range" = X,
        report "D4P Get Installed Apps" = X,
        report "D4P Load Data" = X,
        codeunit "D4P AppInsights Client" = X,

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite