- Feature
- Audit AL app accessibility and debugging boundaries
- Availability
- Generally available (October 2026)
- Industry focus
- Financial services (lenders, asset finance, payment and investment firms)
Financial services firms that run Business Central rarely run it plain. They add extensions for loan servicing, fee calculation, payment files and regulatory reporting. Regulators and auditors increasingly want evidence that this custom code is secure and well controlled. Business Central 29.0 gives development teams a way to look inside their own apps with fresh clarity.
The industry challenge
In a regulated financial business, the questions about custom code are pointed:
- Which internal functions can be reached through public interfaces?
- Where does code run with elevated permissions?
- Could sensitive values, such as bank details or API keys, be seen in a debugger?
- How do our apps depend on each other?
Answering these questions by reading code is slow and error-prone, especially across several extensions written by different teams over several years. As a result, many firms answer them only partly, or only when an audit forces the issue.
What Microsoft delivered in Business Central 29.0
Business Central 29.0 lets developers build and query static call graphs of AL code. According to Microsoft, the analysis can trace:
- Calls from public procedures into internal implementation
- Where execution crosses debugging boundaries
- Code that runs with elevated permissions
- Relationships across apps
The results can be exported visually. The analysis can also run across an app and its dependencies, which Microsoft says makes it useful for architecture reviews, security assessments and automated governance in larger portfolios of extensions.
Microsoft highlights two goals: reducing unintended exposure through public APIs and spotting cases where sensitive values could become visible in the debugger.
Where the value shows up
| Business area | Impact for a financial services firm |
|---|---|
| Security | Clear view of what public interfaces expose |
| Data protection | Finds places where sensitive values might be inspectable while debugging |
| Audit and regulation | Evidence-based answers to questions about custom code controls |
| Architecture | Visual maps of how extensions depend on each other |
| Governance | Repeatable checks that can run as part of the build process |
The central benefit is moving from opinion to evidence. Instead of saying "we believe that's internal," a team can show the call graph.
A worked scenario
Consider an asset finance company that leases equipment to small businesses (an illustrative example). Over five years it has built three Business Central extensions: lease calculations, direct debit file generation and a broker commission app.
As part of an IT audit, the internal auditor asks whether the broker commission app can trigger anything inside the direct debit app. The development lead runs the call graph analysis across all three apps and their dependencies. The visual export shows one public procedure in the commission app that indirectly calls an internal function in the payment app.
The team narrows that procedure's access and adds the analysis to its build pipeline. The next audit gets a clean report, generated automatically.
Adoption considerations
- Start with your most sensitive apps. Focus first on extensions that handle payments, bank data or customer financial information.
- Involve security and audit early. Agree which findings matter most, such as elevated code or debugger exposure.
- Automate it. Run the analysis regularly, not just before audits, so problems are caught when code changes.
- Fix the design, not just the finding. Use results to tighten access modifiers and separate sensitive logic.
- Keep the visuals. Exported diagrams make strong documentation for auditors and new developers.
The bottom line
For financial services firms, custom Business Central code is part of the control environment, whether or not anyone treats it that way. AL call graph analysis in Business Central 29.0 lets development teams see, prove and improve how their extensions behave. That is valuable for security, for audits and for the confidence of everyone who relies on the system.
If your organization runs custom extensions in a regulated environment, it's worth adding a code governance review to your 29.0 upgrade plan with an experienced Business Central adviser.
Source: Microsoft roadmap 573336