Deploying a Microsoft Power Apps solution with dataflows while maintaining environment segregation

(3) Share

Report

Posted on by FR-27081326-0

Hi all!

I've solution in Microsoft Power Apps that contains dataflows reading data from Microsoft Dataverse.
The porting process between DEV, TEST, and PROD environments cannot be performed through the standard solution import/export, because the solution includes dataflows.

As a result, the only viable option seems to be using Power Platform Pipelines.

However, using pipelines requires that the technical NOPROD account used to create the pipeline also has access rights to PROD, so that the environment can be selected as the deployment target.

I was advised to create a fourth “host” environment, used only to run the pipeline, where an additional technical account would be enabled in order to maintain segregation between PROD and NOPROD.

The issue is that this technical account from the host environment would still need to be enabled in the other environments to manage the pipelines.

Therefore, even in this scenario, the segregation between environments and technical accounts would not be fully respected.

What solution would you recommend in this situation?
Thanks

Categories:

Microsoft Dataverse with Power Apps

I have the same question (0)

All responses (4)

Answers (0)

Sort by

Suggested answer

DP_Prabh 381 on at

Like
a
(1)

Report
Copy link

Link copied!
Hi @FR-27081326-0,

To maintain proper segregation between PROD and NOPROD, a common pattern is:

Create a dedicated service account or service principal specifically for pipeline execution.

Grant this account minimum required permissions in each environment (for example Environment Maker or deployment permissions rather than full admin access).

Use a separate host environment only for managing the pipeline configuration.

Ensure PROD access is limited strictly to deployment operations, not development activities.

For pipeline deployment may refer this article: [Step by Step] Configure and run ‘Pipelines in Power Platform’ – Rajeev Pentyala – Technical Blog on Power Platform, Azure and AI
I hope this works for you!

Was this reply helpful? Yes No
Suggested answer

11manish 3,333 on at

Like
a
(2)

Report
Copy link

Link copied!

Solutions in Microsoft Power Apps that include Power Apps Dataflows cannot be fully deployed using standard solution import/export because dataflows store connections and credentials outside the solution. Many teams consider Power Platform Pipelines, but pipelines require the pipeline owner account to have access to all environments, including production, which can violate strict environment segregation policies.

Creating a separate “host” environment for pipelines does not completely solve the problem because the technical account still needs permissions across DEV, TEST, and PROD environments.

The recommended enterprise approach is to use CI/CD tools such as Azure DevOps or GitHub Actions together with a service principal from Microsoft Entra ID. This allows automated deployments between environments without giving human or shared technical accounts direct access to production, ensuring better security, governance, and auditability.

Was this reply helpful? Yes No
FR-27081326-0 86 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @11manish !

What permissions should this Service Principal have across the different environments?

Thanks

Was this reply helpful? Yes No
11manish 3,333 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi FR-27081326-0,

There could be no obvious answer to this question.

The permissions for a Service Principal in the Power Platform depend on what it needs to do, but for most enterprise scenarios (integration, automation, deployment), you should follow a least-privilege + environment-specific approach in Microsoft Dataverse and Microsoft Power Platform.

Was this reply helpful? Yes No