Restrict users to create apps and flows in default environment

(0) Share

Report

Posted on by Gokulnath_March

226

Hi All

I am just looking for some clarification here. I have removed few users from "Environment Maker" role in Default Environment. Users no longer able to see Power apps/Power Automate icon in App launcher but using the direct url (https://make.powerapps.com/), users still able to create the apps/flows. Any idea how to stop this ?

Please note we need some dev team needs to have an env maker role in default environment but not all.

Categories:

Governance & administering

I have the same question (3)

All responses (7)

Answers (0)

Suggested answer

mattavdven 125 on at

Like (2)

Report
Copy link

Link copied!
You're right that by default, all users in the organization have access to the Default Environment and are assigned the Maker role, allowing them to create apps and flows. However, removing users from the "Environment Maker" role does not fully restrict their ability to create apps.

To mitigate this:

Use Data Loss Prevention (DLP) policies to restrict the use of specific connectors in the Default Environment. While this doesn’t block app creation entirely, it limits what users can build.

Create a dedicated Sandbox or Development Environment for your DEV teams. Assign the Environment Maker role only to those who need it, and keep the Default Environment tightly controlled.

Unfortunately, there’s no direct way to completely block app creation in the Default Environment for all users. But combining DLP policies with role-based access and environment segmentation is your best bet for governance.

Please ✅ Does this answer your question if my post helped you solve your issue. This will help others find it more readily. It also closes the item. If the content was useful in other ways, please consider giving it a Like.

2 people found this reply helpful.

Was this reply helpful? Yes No
Gokulnath_March 226 on at

Like (0)

Report
Copy link

Link copied!

Hi @mattavdven,

Thank-you for your response. We don't have dedicated prod environment. Since we already have over 50 production apps running in the default environment, we're trying to restrict users from creating new apps or flows to maintain stability and control. If we create DLP policies, It may affect the existing flows/apps. also dev team using the default env to build apps.

So, DLP will not be the viable solution right ? and what do you mean by "DLP policies with role-based access". can we apply DLP's based on role ?

Was this reply helpful? Yes No

mattavdven

125 on at

Like (1)

Report

Copy link

Link copied!

I would not recommend to run all your apps and flows in the default Environment, especially Production Apps and Flows. You should consider a Envrionment strategy. You can use this table provided by Microsoft to determine what to do with your apps and flows.

Parameters	Defining criteria	Environment
Number of users	1–10 users	Default
	7–30 users	Shared
	>30 users	Dedicated
Nature of data	Highly confidential	Dedicated
	Confidential	Shared
	Not confidential	Default
Monetary or reputational impact	Yes	Shared or Dedicated
	No	Default
Requires ALM	Yes	Shared or Dedicated
	No	Default

Manage and govern the default Power Platform environment - Power Platform | Microsoft Learn

I highly recommend to pack all relevant apps and flows in to multiple solutions and export / import these into shared or dedicated environments. You can control access to these environments with Entra Security Groups.

Avoid using the Default Environment for anything beyond personal or low-impact development. DEV teams should use shared or dedicated environments without DLP policies for unrestricted building. Apply strict DLP policies to the Default Environment to prevent misuse and protect sensitive data.

Please ✅ Does this answer your question if my post helped you solve your issue. This will help others find it more readily. It also closes the item. If the content was useful in other ways, please consider giving it a Like♥.

Was this reply helpful? Yes No

Gokulnath_March 226 on at

Like (0)

Report
Copy link

Link copied!

Hi @mattavdven,

I understand the environment strategy and I have also conveyed the same to customers. but they just wanted to know if there is way to restrict the users from creating apps/flows in default env. Could you please let me know is there a way ?

Was this reply helpful? Yes No
Gokulnath_March 226 on at

Like (0)

Report
Copy link

Link copied!

Hi @mattavdven,

I understand the environment strategy and I have also conveyed the same to customers. but they just wanted to know if there is way to restrict the users from creating apps/flows in default env. Could you please let me know is there a way ?

Thanks

Was this reply helpful? Yes No
Suggested answer

Pstork1 69,121 Most Valuable Professional on at

Like (1)

Report
Copy link

Link copied!

Microsoft uses the default environment to create apps and flows for use in SharePoint and other places. As a result they provide no way to limit users from creating things in the default environment. The only way to do it is through Governance Policy. Train users not to create things in the default environment and then use something like the COE tool kit to monitor the environment and follow up with users who violate the policy. But there is no way to programmatically prevent it.

----------------------------------------------------------------------------------
If this Post helped you, please click "Does this answer your question" and give it a like to help others in the community find the answer too!

Paul Papanek Stork, MVP
Blog: https://www.dontpapanic.com/blog

Was this reply helpful? Yes No
Suggested answer

mattavdven 125 on at

Like (1)

Report
Copy link

Link copied!

Hi @Gokulnath_March,

No there is no way to limit or restrict users to create apps/flows in the default environment You can only limit the connectors being used by DLP policies.

Please ✅ Does this answer your question if my post helped you solve your issue. This will help others find it more readily. It also closes the item. If the content was useful in other ways, please consider giving it a Like♥.

Was this reply helpful? Yes No