How to prevent Teams environment creation automatically?

(2) Share

Report

Posted on by RL-30060854-0

Hi all,

I came across a governance issue in Copilot Studio / Power Platform:

Even without a Copilot Studio license, users can access it via direct link (not from Teams app), select a Team, create a classic agent, and this automatically provisions a Dataverse for Teams environment.

In PPAC, I can restrict production/developer/trial environments creation, but there is no control for Teams environments.

So I have two questions:

Is there any way to block or control Teams environment creation?

How can we prevent non Copilot Studio license users from creating classic Copilot Studio agents without removal the environment maker permission?

Any guidance or best practices would be appreciated.

Categories:

General topics

I have the same question (0)

All responses (12)

Answers (1)

Sort by

Suggested answer

Vish WR 3,748 on at

Like
a
(1)

Report
Copy link

Link copied!

@RL-30060854-0

You can disable the Power Apps app in the Teams Admin Center, which is currently the primary way to prevent users from creating Dataverse for Teams environments. Other than that, there isn’t a direct setting available to completely disable Dataverse for Teams creation.

Another approach is to use Data Loss Prevention (DLP) policies to block all connectors within Dataverse for Teams, effectively restricting its usage even if an environment is created.

Was this reply helpful? Yes No
Verified answer

Valantis 6,735 on at

Like
a
(3)

Report
Copy link

Link copied!

Hi @RL-30060854-0,

Microsoft docs confirm: there is no PPAC setting to directly block Dataverse for Teams environment creation the way you can block production/sandbox/trial/developer environments.

The PPAC environment creation controls don't cover Teams environments. This is a confirmed gap.

The two confirmed approaches to control it:

1. Teams Admin Center (primary control): Global admins or Teams admins can disable Power Platform features in Teams via Teams Admin Center > Manage apps. You can block the Power Apps app and Power Virtual Agents/Copilot Studio app for specific users or the entire tenant using Teams app permission policies. Disabling these apps prevents users from accessing the Teams-based creation experience that triggers the environment provisioning.

2. DLP policy for damage control: create a DLP policy scoped to all environments (including new ones automatically) and restrict all connectors to Blocked in Teams environments. This doesn't prevent creation but ensures any created environment is immediately locked down and unusable for anything substantive.

For question 2 (preventing non-Copilot Studio license users from creating agents):

Microsoft docs state that Dataverse for Teams environments use a different licensing model where Teams-based Copilot Studio access is included with Microsoft 365 licenses. You can't block access purely through licensing restrictions without removing the Teams app itself. The Teams Admin Center app permission policy is the lever here too.

For a governed approach: use the CoE Starter Kit's Dataverse for Teams governance module, which sends welcome emails requesting business justification and auto-deletes environments without justification after a configurable period.

Ref: https://learn.microsoft.com/en-us/power-platform/guidance/adoption/teams-environment-strategy

Best regards,

Valantis

✅ If this helped solve your issue, please Accept as Solution so others can find it quickly.

❤️ If it didn’t fully solve it but was still useful, please click “Yes” on “Was this reply helpful?” or leave a Like :).

🏷️ For follow-ups @Valantis.

📝 https://valantisond365.com/

💼 LinkedIn

▶️ YouTube

Was this reply helpful? Yes No
Suggested answer

11manish 3,333 on at

Like
a
(0)

Report
Copy link

Link copied!
Today there is no granular admin setting that says:

"Allow users to be Environment Makers but prevent them from creating Dataverse for Teams environments or classic Copilot Studio agents."

This is the gap many customers have raised with Microsoft. The current controls are mostly indirect:

Team creation controls

Environment Maker permissions

Security groups

Licensing governance

Monitoring via CoE

So if your goal is "makers can build apps but cannot spin up Teams environments and Copilot agents", there isn't currently a single native switch that enforces

that behavior cleanly. The closest practical control is restricting Team/M365 Group creation combined with governance monitoring.

Was this reply helpful? Yes No
RL-30060854-0 14 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @Vish WR, all those power platform apps are blocked already in Teams admin center, DLP to block connector doesn't prevent the env creation, but anyway, thank you.

Was this reply helpful? Yes No
Vish WR 3,748 on at

Like
a
(0)

Report
Copy link

Link copied!

@RL-30060854-0

If the power apps is blocked or not available in teams it's not possible to create auto dataverse for teams creation.

I would suggest to raise a microsoft ticket for this

Was this reply helpful? Yes No
RL-30060854-0 14 on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @Valantis, thank you for the detail reply. All those power platform apps are blocked already in Teams admin center, DLP to block connector doesn't prevent the env creation. But you provided me a new thought for the governance.

Was this reply helpful? Yes No
RL-30060854-0 14 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @Vish WR, actually the env was not created by actions in Teams app but copilot studio.

Even without a Copilot Studio license, users can access it via direct link (not from Teams app), select a Team, create a classic agent, and this automatically provisions a Dataverse for Teams environment.

Was this reply helpful? Yes No
Vish WR 3,748 on at

Like
a
(0)

Report
Copy link

Link copied!

@RL-30060854-0

Please don't use the COE toolkit, it is no longer supported by Microsoft and its retired. There is no more support as well unless you are comfortable extending or managing the solution on your own.

Instead, can you power the platform admin center, inventory or use the inventory api which is natively supported by microsoft

If you want to use you can, but please be aware you won't get support from the COE toolkit forum on GitHub

Was this reply helpful? Yes No
RL-30060854-0 14 on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @Vish WR, thank you for reminding, no, I won't use COE toolkit.

Was this reply helpful? Yes No
Suggested answer

Manoj - ManoVerse 28 on at

Like
a
(0)

Report
Copy link

Link copied!

@RL-30060854-0 this is the right place to manage your requirement, as there is no toggle setting available.

Was this reply helpful? Yes No