WorkshopPLUS – Power

Platform for
Administrators:
Power Platform Environments

Microsoft
Services
Conditions and Terms of Use
Microsoft Confidential
This training package is proprietary and confidential and is intended only for uses described in the training materials. Content and software is
provided to you under a Non-Disclosure Agreement and cannot be distributed. Copying or disclosing all or any portion of the content and/or
software included in such packages is strictly prohibited.
The contents of this package are for informational and training purposes only and are provided "as is" without warranty of any kind, whether
express or implied, including but not limited to the implied warranties of merchantability, fitness for a particular purpose, and non-
infringement.
Training package content, including URLs and other Internet website references, is subject to change without notice. Because Microsoft must
respond to changing market conditions, the content should not be interpreted to be a commitment on the part of Microsoft, and Microsoft
cannot guarantee the accuracy of any information presented after the date of publication. Unless otherwise noted, the companies,
organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association
with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred.

Copyright and Trademarks

© 2020 Microsoft Corporation. All rights reserved.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this
document. Except as expressly provided in written license agreement from Microsoft, the furnishing of this document does not give you any
license to these patents, trademarks, copyrights, or other intellectual property.
Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this
document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic,
mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.
For more information, see Use of Microsoft Copyrighted Content at
https://www.microsoft.com/en-us/legal/intellectualproperty/permissions/default.aspx
Microsoft®, Internet Explorer®, Outlook®, SkyDrive®, Windows Vista®, Zune®, Xbox 360®, DirectX®, Windows Server® and Windows® are
either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Other Microsoft products
mentioned herein may be either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. All
other trademarks are property of their respective owners.
Introduction
In this lesson, you will learn the following:

• Understand Power Platform Environments.

• Environment Scope/Regions.
• Understanding Environments Types.
• Understanding Environments Security.
• Provisioning Power Platform Environments.
• Environments Capacity.
 Understand Power
Platform Environments
 Understand Power Platform
Environments
Environments are containers that administrators can use to manage apps, flows, connections, and
other assets, along with permissions to allow organization users to use the resources.

Azure AD Tenant

Environments
Environments Key Facts
• Every tenant has a Default environment where all licensed Power Apps and Power Automate users can create
apps & flows.
• Environments are tied to a geographic location that is configured at the time the environment is created.
• You may choose to only build your apps in a single environment.
• You might create separate environments that host development, test and production versions of your apps
and flows.
• You might create separate environments that correspond to specific teams or departments in your company,
each containing the relevant data and apps for each audience.
• You might also create separate environments for different global branches of your company based on regions.
• Every environment can have zero or one Common Data Service databases, which provides storage for your
apps.
• Non-default environments offer more control around permissions.
• Non-default environment creation can be restricted to only particular makers and admins from the Power
Platform admin center.
Environments Scope/Region
 • Each environment is created under an Azure AD
tenant, and its resources can only be accessed by
users within that tenant.
• When you create an app in an environment, that
app is routed to only datacenters in that geographic
Environme location.

nts • Any items that you create in that environment

(including connections, gateways, flows using
Scope/Regi Microsoft Power Automate, and more) are also
bound to their environment’s location.
on • When you create an app in an environment, that
app is only permitted to connect to the data
sources that are also deployed in that same
environment, including connections, gateways,
flows, and Common Data Service databases.
Environments
Types
 Understanding environment types

Type Description
Default Every tenant has one default environment – useful for personal productivity assets.

Trial Short term environment for testing that expires after 30 days, limit 1 per user.

Production Non-expiring full environment that is used for permanent work in an organization.
A Sandbox environment is any non-production environment of Common Data
Service.
Sandbox
Isolated from production, a Sandbox environment is the place to safely develop and
test application changes with low risk.
Developer Created with the community plan license, only used by owner with limit 1 per user
http://aka.ms/powerappcommunityplan.

For more information: https://docs.microsoft.com/en-us/power-platform/admin/wp-environments

 Default Environment Characteristics
• This environment has a few unique characteristics from other environments that you create.
• This environment can’t be disabled or deleted.
• All tenant users are added automatically to the maker role for the default environment and
you can’t remove them from that role.
• They are not however added automatically to the environment administrator role.
• The default environment is created in the closest region to the default region of the AAD
tenant.
• The default environment is named as follows:
“{Azure AD tenant name} (default)”.
• This makes the default environment the perfect place for people to build personal
productivity apps and flows.
Environments
Security
 • The Environment Admin role can perform all
administrative actions on an environment
including the following:
• Add or remove a user or group from either the
Environment Admin or Environment Maker role (except
default environment).
Default or • Provision a Common Data Service database for the
environment.
Non-CDS • View and manage all resources created within an
environment.
Environme • Set data loss prevention policies.
• The Environment Maker role can:
nt Security • create resources within an environment including apps,
connections, custom connectors, gateways, and flows
using Power Automate.
• distribute the apps they build in an environment to
other users in your organization by sharing the app with
individual users, security groups, or to all users in the
organization.
Default or Non-CDS Environment Security Roles
 • One of the key features of the Common Data
Service is its rich security model that can adapt to
many business usage scenarios.
• This security model is only in play when there is a
Common Data Service database in the
CDS environment.
• Common Data Service uses role-based security to
Environme group together a collection of privileges.
nt Security • These security roles can be associated directly with
users, or they can be associated with Common
Data Service teams and business units.
• Once a CDS database is created, managing
environment permissions is taken care of by CDS.
 • When a database is created, the users who have
environment roles assigned to them, will continue
to maintain those privileges.
• Users with the Environment Admin role are now
assigned to a System Administrator role.

CDS • Users designated as an Environment Maker

continue to function in the same role.
Environme • You can assign additional users to pre-defined roles
or even create custom roles.
nt Security
• NOTE: On creating the database, any security group assigned
to an Environment Admin or Environment Maker role will not
be honored any more. Currently, assigning permissions in
database, do not support AAD security group.
Power Platform Service Admin
Role
The new role of Power Platform Service Admin will replace Environment and
System Admin access as well as having the same privileges the Power BI Service
Admin role has.

• Members in this role will have full Environment Admin/System Admin access
to all Power Apps, Power Automate, and Dynamics 365 environments.

• Members of this role will also have the same privileges granted to the Power
BI service admin role.

• They will also have full access to manage all Gateways deployed in the tenant.

• Important: Users assigned to the Dynamics 365 service admin role will soon
be able to manage environments in power platform.
Provisioning Power
Platform Environments
 Provision based on available capacity; you
need 1GB available database capacity.

Provisionin Environments can now be provisioned in

the Power Platform Admin center.
g New
Environme
nts Admins can govern environment creation.

Admins can see all environments

Who can create environments?
• Your license determines whether you can create environments.
License Trial Production
Office 365 Plans No No
Dynamics 365 Teams Plans No No

PowerApps Community Plan No No

Dynamics 365 Trial Yes (one) Yes

Dynamics 365 Plans Yes (one) Yes
Dynamics 365 Apps Plans Yes (one) Yes
Power Apps plan Yes (one) Yes
Power Apps Trial Yes (one) Yes

Note: Office 365 Global admins and Common Data Service, Service-admins can create environments
without a license.
Environments
Capacity
Environments Capacity

• A new Capacity page is

available in the Power
Platform Admin center.
• Admins can visualize the
data stored in Databases,
Files, and Logs.
• All environments with or
without Common Data
Service will consume at
least 1GB capacity.
Storage capacity by source
La
b:
Exercise 1

Provision Power
Platform
Environments
Labs Prerequisites –
Follow the steps below to setup
labs activities

• Every workshop attendee will be having a dedicated demo tenant to

perform upcoming labs.
• To provision and access this demo tenant, please follow the steps
below:
• Use Edge, Edge Chromium or Chrome web browser to
navigate to http://aka.ms/lod.
• Sign-in using Microsoft personal account (other email service
account can also work) – don’t use business email.
• Select “My Training” > Redeem training key > type assigned
training key [Ask MS engineer delivering this workshop].
• In loaded page, scroll to “Lab” section then select “Workshop
labs title” link to launch it.
• In virtual labs environment select “Resources” tab to get Office 365
Credentials you need to sign in.
• Copy them and paste into notepad to use them later in your
machine web browser.
Step 1) Restrict
environment creation
1. Using a tenant global admin navigate to aka.ms/ppac or
https://admin.powerplatform.microsoft.com/environments
or from Power Apps studio, select the gear button on top
right-hand side and choose Admin center, then select
Environments.
2. At the top right-hand side, select the gear button for
environment Admin settings, then select:
• Who can create production environments Only specific
admins
• Who can create trial environments Only specific admins
3. Save.
Step 2) Rename
default environment

• In case of a default environment without CDS:

1. Using the Power Platform admin center,
select the Environments tab.
2. Then click on environment name.
3. A new screen opens to browse all default
environment settings; click on Edit details
to show environment name field.
4. Save.
Step 2) Rename
default environment

Note changed environment name.

Step 3) Add CDS
Database
• At environment’s settings screen click on
“Add database”
• Keep default settings then click add
• Note that environment status will be turned
to “PreparingInstance” then “Ready”
Step 4) Register Trial
Per User Licenses
• Navigate to Office 365 admin center
then select show all.
• Under billing section select “Purchase
service”
Step 4) Register Trial
Per User Licenses
• In search box type “Power Apps” then
scroll to select “Power Apps per user
plan”
• Click “Get free trial”
• Then click Try now, then Continue
Step 5) Assign Trial Per
User Licenses to Users

• Assign trial licenses to two users in your

tenant to be used in creating additional
two trial environments.
• Go to active users, then select “Allan”
and assign registered trial license.
Step 5) Assign Trial Per
User Licenses to Users

• Repeat the same steps for “Megan”

• Note that both selected users are having
global admin role as we prevented other
users from creating environment in a
previous lab.
Step 6) Create “Contoso
Testing” Trial Environment

• In new private browser, login to

aka.ms/ppac using Allan account
Please note that all tenant users are using the
same admin password.
• At Environments tab, click on New,
select required configurations as shown
in screen shot then click Next
• Keep same database configuration as
default then click Save
Step 6) Create Testing
Trial Environment

• Note that a new trial environment has

been created as shown in screen shot
• In few minutes, environment should
display status “Ready”
• Note: you can click refresh to view
updated status
• Moreover, Mod Admin as a part of
tenant global admins will be added
automatically to the environment
admins.
• To verify that, follow next steps
(Optional)
Optional) Verify Global
Admin Privilege.

• Click environment ellipses then select

“Settings”
• Expand “Users + permissions” then
select “Users”
Optional) Verify Global
Admin Privilege.
• Then select “Manage users in Dynamics
365”
• Select Mod Admin user then select
“Manage Roles”
• Note that “System Administrator” role is
already assigned.
Step 7) Create “Contoso
Production” Trial
Environment

• Repeat same steps with Megan to create

third environment using configurations
in screen shots
Environments Regions
 Switch Between
Environments
• Your current environment is
specified in the environment
picker near the right edge of the
header.
• To choose a different environment,
click or tap the picker, and a list of
available environments appears.
• Click or tap the one you wish to
switch to.
End of Lab Exercise
© 2020 Microsoft Corporation. All rights reserved.