CustomerGate 365: release notes

Version 1.0.44.0

Released on 23 September 2026. It follows 1.0.42.0 to AppSource once Microsoft has validated that. There is no version 1.0.43.

What the first customer's new website asked for: the portal knows how a customer answered a quote, a request carries a project, an inspection certificate and processing, the website can read the attachment settings, and reordering keeps a one-off size.

Web requests

• A request can name a project or building site. Inside sales sees it on the request card and in the list, it is at the top of the quote as a text line, and the confirmation mail and the notification to inside sales name it.
• Each request line can ask for an inspection certificate (2.2, 3.1 or 3.2 under EN 10204) and for processing such as cutting to length, drilling, blasting, priming or galvanizing. Inside sales sees both as columns on the request lines; on the quote they become text lines under the item, in the language of the quote.
• The screening counts links in the project together with links in the remarks.
• The project is personal data: the cleanup, Erase Personal Data and the export handle it like the other request data.

Customer portal

• The portal hears back whether the customer declined a quote, when and why, so the accept and decline buttons no longer come back after a decline. The customer's own remark stays with inside sales.
• My requests shows the project of each request, and ordering a request again suggests its project.
• With Steel 365, reordering a line from an earlier quote or order keeps a one-off size.

Attachments

• The website can read the attachment settings in force: whether uploads work, the size and count limits and the allowed types. It no longer has to copy them.

Upgrading from 1.0.42

• Nothing to do. Every change to the web services is additive, so a website built on 1.0.42 keeps working. The data classification of the new project field is set in every company during the update.

Version 1.0.42.0

Released on 23 September 2026. It reaches AppSource once Microsoft has validated it. Versions 1.0.40 and 1.0.41 were test builds and never went to AppSource; everything in them is in 1.0.42.

Counter visits become staff orders, a setting that is off until you turn it on, the CustomerGate cues can now be added to any standard role center, and five problems found at the first customer are fixed.

Staff orders

• A staff order is a list a staff member enters for a customer who is present, for example someone who collects the goods at the warehouse. It becomes a sales order, may contain any item the company sells and sends no e-mail. In 1.0.39 this was the counter visit.
• The new setting Staff Orders Enabled on CustomerGate Setup is off after installation. While it is off, the Staff Orders cues and the Staff Member field are hidden, and the website gets [VOA-StaffOrdersDisabled] if it sends a staff order anyway: nothing is stored, and it never turns into an ordinary quote request.
• The website marks a staff order with source staffOrder. The value counterVisit from 1.0.39 is no longer recognized.
• The three Staff Orders cues open the worklist filtered on staff orders.
• Staff Orders Enabled travels with Export Settings and Import Settings.

The role center

• The Web Requests cues are on every standard role center that has cues, 30 in total, from Business Manager and Order Processor to the warehouse and manufacturing role centers.
• They start hidden on all of them, Order Processor included. Turn them on with Personalize, or for a whole profile under Profiles (Roles).
• They sit at the bottom of the role center. Drag them up in Personalize if you want them higher.
• The Order Processor role center keeps Microsoft's own help page; the help for the cues is on the cues themselves.

Fixes

• Installing no longer stops on an item variant that another app rejects. CustomerGate no longer writes to item variants at all; whether a variant is on the website follows its item.
• Personalizing a role center no longer hangs. The hidden cues did work when they loaded; they now load like Microsoft's own cues, and the "CustomerGate 365 was updated" message comes with the role center's own notifications.
• The web service voaRemovals is published again. It answered 404 in every environment, so the website never heard which items were taken off.
• The catalog sync can read items that have a picture. It got a 403 on every such item.
• The portal shows a signed-in customer's details, quotes, orders and shipments again. They answered 403, so the website treated the customer as new and the portal tabs stayed empty.

Upgrading from 1.0.39

• Turn on Staff Orders Enabled in each company that works with staff orders, and let the website send staffOrder at the same time.
• Inside sales will not see the cues after the update until they turn them on once with Personalize, or an administrator adds them to the profile.

Version 1.0.39.0

Released on AppSource on 22 September 2026.

The first version of CustomerGate 365 as an app on AppSource. It takes the place of the per-tenant extension that was built for one customer, and is not an upgrade of it: CustomerGate 365 had never run in a customer environment before, so it carries no migration.

Quote requests and inside sales

• Quote requests from the website arrive with their lines in a worklist. One action turns a request into a sales quote, or into a sales order for a counter visit.
• The lines of a web request show profile, grade and the three dimensions only with Steel 365.
• Requests from signed-in customers are linked to their customer, and ship-to codes are checked.
• Attachments on a request: a drawing, a DXF, a photo or a cutting list. The customer sees and downloads their own files in the portal, inside sales sees them on the request and adds their own, and at conversion they travel to the sales document as a document attachment.
• Every file is checked on its type, its own first bytes, the number of files and the size, against a deny list that no setting can override.
• Assignment: Assign to Me and Assign To… record who picked a request up, with a column, a filter and the cues My Requests and Unassigned. An assignment is not a lock.
• Bulk actions on both worklists: reject, mark as spam, assign, and approve for account requests, with one confirmation naming the number. What fails is named by request number, and what succeeded need not be redone.
• Rejection reasons as a maintainable list, with an optional message to the requester in their own language and a switch that makes a reason mandatory.
• Duplicate and spam screening, on arrival and on demand. It flags and sorts; it never refuses, hides, deletes or mails.
• Reply from the request card, in the standard Business Central e-mail editor, with the requester's address and the request number already filled in. Sending is recorded on the request.
• Create a customer from a request, through the standard customer templates, with the VAT number in the field the customer's country actually uses, and with the existing customer offered when that number is already known.
• Account requests for the customer portal, approved with a customer and a role (Buyer or Viewer), or rejected.
• Role center cues for the requests that need attention, and a Needs a Look cue that turns amber as soon as the screening has flagged something.
• The screening score is a column on the worklist, next to the outcome and in the same colour.

The customer portal

• Signing in with a one-time code by e-mail, so there are no passwords. Sessions with a sliding duration and a maximum age, and access that can be revoked at once.
• Customers see their requests, quotes, orders, shipments and document lines, and download PDFs.
• Acceptance of a released quote, recorded with the amount, the currency, the number of lines, the archive version and a fingerprint of the quote. Check Quote tells whether the quote still matches what the customer accepted.
• With the acceptance the customer passes their own purchase order number and requested delivery date. Those reach the sales document and never overwrite what inside sales entered.
• Declining a quote with a reason from a fixed list and an optional remark, in a worklist of its own for inside sales. The quote itself is not cancelled: what happens to it stays a decision by a person.
• Order the same again: the lines of an earlier request come back in the request form, including those of a request that has already been converted.
• Track and trace: the package number, the shipping agent and a ready-made tracking link. Empty where the steel goes out on the company's own lorries.
• Delivery per order line: the requested and promised date of the line itself and a status per line, so a partial delivery is visible line by line instead of as one average on the header.
• Notifications on request: a portal user switches on what they want to be e-mailed about, across their quotes, orders, shipments, invoices and requests. Everything is off until they switch it on, the company has a master switch that is off after every installation and update, and every message says why it was sent and where to switch it off.
• One address at two customers: a buyer who purchases for two companies signs in once and switches customer in the portal. Inside sales makes the second link with Link Another Customer, and every attempt is logged, granted or refused.
• Invite a colleague: a Buyer asks for access for a colleague at the same customer. That creates an account request, not access; inside sales still approves it. With a limit per inviter per day.
• Documents from the reports Business Central already uses (document layouts per customer, otherwise report selections), or from iFacto DXSteel Doc Archive where that is installed, limited to the archive categories you choose. A download does not archive the document.
• MyDetails returns the VAT number the installation actually stores, the Enterprise No. for a domestic customer in Belgium.

The web catalog

• Business Central decides which items the website may see, not the website: per item, per item category, with numbered publication rules and one policy. Blocked items never.
• Every step leaves a reason on the item, in words, so that "it is not on the website" is never the whole answer.
• The reason on Items on the Website is in the language of whoever looks at it: it is stored as a code and shown as a sentence.
• Items on the Website is the screen to walk before going live: it says, per item, whether it is in the catalog and which step decided that.
• Items that cannot be ordered online stay in the catalog as price on request. A request line for such an item is refused, except at the counter, where everything the company sells may be sold.
• A removal feed: everything that leaves the catalog, excluded, blocked, deleted or renamed, lands on it, so that a website that synchronizes takes it off the site as well.
• Item pictures reach the website, with a mark that changes as soon as the pictures change. A picture above Maximum Picture Size (MB), or one that Business Central cannot load, is reported instead of handed over. Nothing is resized.
• While the catalog has never been computed in a company, the catalog services refuse to serve rather than hand over an unfiltered catalog. The decision is computed at installation, for a new company and on every update.
• Catalog web services for items, variants and categories.

The connection to the website

• Webhooks: Business Central calls the website itself when a quote is released or accepted, an order is created, a shipment or an invoice is posted, an account is approved or rejected, or a request is converted or rejected.
• Per subscription an https address, its own secret and a signature over timestamp and body. The payload holds numbers, states, amounts and dates, and no personal data.
• Delivery through a job queue entry, never from inside a posting, with five attempts at growing intervals. A subscription that fails too often switches itself off and does not come back by itself.
• One call, without a session and without personal data, that tells a client which app version, environment, modules, document source and setup state it is talking to.
• Named error codes: every failure a website can trigger starts with a recognizable code, so the website can act on it itself.
• The interface as a file, updated and checked on every change to the app, so the website's builder sees what changes before it reaches them.
• E-mail through the standard Business Central e-mail accounts, with five scenarios, retries and a visible status per request.

Setting up and managing

• An assisted setup guide and a setup page with status lines that say what is ready and what is not.
• The Document Archive line on CustomerGate Setup says where the portal gets its documents: the Steel 365 archive, the Business Central reports (Portal Documents from Reports), or nowhere, and follows that switch as it changes.
• Repair Permissions creates the tenant permission sets and assigns them to the website's Entra applications.
• Diagnostics: one screen with the environment, the versions, the modules, the state of the mail job, the cleanup job and every web service, the counts per status and the cleanup preview, plus a report to paste into a support e-mail that holds counts and states only.
• The diagnostics report is in one language: its title and table header follow the session language too.
• Test Connection per Entra application, with a fix per line. Nothing is ever repaired silently.
• Permission Gaps: what CustomerGate expects next to what is granted, per object, differences only.
• Preview Cleanup: what the cleanup job would process tonight, per category, with the oldest date and with what cannot be erased because it sits on a posted document.
• Settings export and import as JSON, with a preview of what an import would change. Client IDs, secrets and tokens are never in the file.
• Environment copy guard: a sandbox that differs from the environment the settings were adopted in blocks all outgoing e-mail and puts the mail job and the cleanup job on hold, with a red banner and the action This Is the Real Environment. A production environment is warned about, never disabled.
• Demo mode: in a demo, training or test company every message goes to one demo address, with [DEMO] in the subject and the intended recipient in the first line. Without a demo address nothing is sent at all.
• The Demo E-mail Recipient field is only marked mandatory while demo mode is on.
• Four job queue entries, all four installed on hold: the mail round, the cleanup, the webhook delivery and the nightly catalog recompute.
• Help per screen: every page of the app links to its own page in this manual, in the user's language where there is one.
• A notification after an update saying what is new, with a link to this page and a "don't show again" that goes through Business Central's own notification settings.

The licence

• Every production environment runs on a licence key from Van Oosten Software, for the plan Requests, Portal or Complete. The app checks the key itself; there is no licence server.
• The new page CustomerGate Licence takes the key and shows what it covers, until when, and what Van Oosten Software needs to issue one.
• Without a valid key only the web services stop, and only after thirty days: of trial after the first run, of grace after the end date, or after a renamed environment. Every screen, the mail job, the cleanup job and exporting and erasing personal data keep working.
• CustomerGate Setup shows a line at the top while the licence needs attention, and the role center warns inside sales in the last two weeks.
• voaPing reports the status, the plan and the day the web services would stop. A stopped web service answers [VOA-LicenceRequired], a function outside the plan [VOA-NotInPlan].
• A sandbox and a company in demo mode need no key.

Privacy and security

• A retention period with an automatic cleanup job that anonymizes old requests, and per e-mail address an action to export all personal data as one JSON file or to erase it.
• A data classification on every field, so that Business Central itself shows where personal data sits.
• Sign-in codes and session tokens stored only as hashes, and IP addresses only as a pseudonymized hash made by the website.
• Narrow permission sets for the website's applications: execute-only where possible, and never D365 BASIC.
• Attachments are checked against a deny list that no setting can override, an allow list, the file's own first bytes and a limit on size and number. Business Central has no virus scanner: scan at the website, before the file arrives.
• Notifications to portal users are opt-in, and every message says why it was sent and where to switch it off. The link goes to the portal, not to an unsubscribe address that works without signing in.
• The secret a webhook subscription signs with lives in isolated storage: shown once and never readable afterwards, not in an export and not in a database copy.
• Telemetry without personal data, active once the Application Insights connection is set: which feature ran and with what outcome, with counts and kinds only, plus a daily heartbeat per company.

Works with

• Business Central online, version 28.0 or later. Tested against 28.5 and 29.0.
• The Netherlands and Belgium. Every build compiles in one of the two and runs the whole test suite in both; French is translated but not yet tested against a French build.
• iFacto Steel 365 and DXSteel Doc Archive are optional. The Steel 365 module switches itself on where Steel 365 is installed: steel quantities in pieces, meters and kilograms on the portal lines, profiles, grades and item types for the catalog, and the document archive.
• English, with Dutch (Netherlands and Belgium) and French (Belgium and France) translations.