Download source code from a policy-protected app

In this video, I’ll show how you can download the source code for a Business Central app that has been “protected” with an exposure policy. Check it out:

https://youtu.be/KD_3O_Q6XxU

In this video, Erik demonstrates how to download source code from a policy-protected app in Business Central on-premises. This is a scenario that arises when a customer has an installed app but has lost access to the original source code — and the original developer is no longer available.

The Problem: Lost Source Code with Download Protection

A common scenario Erik encounters: a new customer is running Business Central on-premises and wants to migrate to the cloud. During the process, they discover an installed app whose source code is nowhere to be found. The original developer who created the app is no longer available, and when they try to download the source code through Business Central’s extension management, the system refuses — the app is policy-protected.

So what do you do?

The Solution: Modifying the Resource Exposure Policy via SQL

The trick involves directly modifying a field in the Business Central database using SQL. Here’s the step-by-step process Erik walks through.

Step 1: Query the Published Application Table

First, connect to the Business Central database using your preferred SQL tool (Erik uses Visual Studio Code in the demo). Then query the Published Application table to inspect the apps and their protection settings:

SELECT name, [Resource Exposure Policy]
FROM [Published Application]
ORDER BY name

This returns all installed apps along with their resource exposure policy values. You’ll notice different numeric values:

  • 7 — Apps whose source code can be downloaded (the “lucky number”)
  • 0 — Apps that are protected and block source code downloads

In Erik’s example, the app called “Bad Actor” has a value of 0, meaning its source code download is blocked.

Step 2: Update the Resource Exposure Policy

Change the policy value from 0 to 7 for the target app:

UPDATE [Published Application]
SET [Resource Exposure Policy] = 7
WHERE name = 'Bad Actor'

You should see “1 row affected” confirming the update.

Step 3: Restart the Business Central Service

Simply changing the database value isn’t enough — the change won’t take effect until the service is restarted. Erik demonstrates this: after the update, clicking “Download Source” still doesn’t work. You need to restart the NAV server instance:

Restart-NAVServerInstance BC

In Erik’s case, he’s running Business Central in a Docker container, so the restart takes a few seconds. Once the service is back up and you log in again, navigating to Extension Management and clicking “Download Source” on the previously protected app now works — the source code downloads successfully.

Older Versions: The Show My Code Field

If your Business Central instance is an older version (before the Resource Exposure Policy was introduced), there’s a different field you need to manipulate called Show My Code:

SELECT name, [Resource Exposure Policy], [Show My Code]
FROM [Published Application]
ORDER BY name

For older versions, this is the field you’d update instead of (or in addition to) the Resource Exposure Policy.

Important Caveats

  1. This is for recovering lost source code — This technique is intended for situations where you legitimately own or need the app but have lost access to the source. It is not for gaining access to someone else’s intellectual property.
  2. This only works on-premises — You need direct SQL access to the database, which is only possible with on-prem deployments. This does not apply to Business Central Online (SaaS).
  3. App developers: use runtime packages — If you’re an ISV concerned about this, the proper protection mechanism is to distribute runtime packages rather than full app files. A runtime app does not contain source code at all, so this SQL technique has no effect — there’s simply no source code to extract.

Summary

When you’ve lost the source code for a policy-protected app on an on-premises Business Central instance, you can recover it by updating the Resource Exposure Policy field (or Show My Code on older versions) in the Published Application table via SQL, then restarting the NAV server instance. After the restart, the “Download Source” option in Extension Management will work. Remember: this is a legitimate recovery technique for on-prem environments, and ISVs who want to protect their code should distribute runtime packages instead of full app files.

Picture of hougaard

hougaard