Environment Security

(0) Share

Report

Posted on by NativeN

Hi all

Might be a stupid question but this is a really unclear topic for me.

We are currently deploying an environment strategy at our company (prod/dev/test/..)

We assign security groups to access those environments.

- However, in the microsoft docs it says that users in those security groups, also need a dataverse license in order to access the environment.

- And what about an environment strategy with only SharePoint Online based apps in our production environment? Do we need to license these users as well? This would be really strange.

- The Microsoft docs also states the following:

Control user access to environments: security groups and licenses - Power Platform | Microsoft Learn

- Does this mean that if we assign 1 per app plan license to the environment, we are covered from a license perspective?

- Is this needed in order to define our environment strategy without having to license all users? We really want to avoid the default environment but we also don't want to license everybody when not leveraging Dataverse...

And a second question, when deploying the CoE in the tenant in a dedicated environment, we are advised to not assign a security group so end users can interact with the CoE.

- Does this mean that they can access the environment and said available data connectors? We want to restrict the usage of the HTTP connector, but this is required for the CoE. Only admins will be able to use the CoE, but since we cannot specify a security access group, is this a security gap?

Thank you in advance & kind regards

Categories:

Microsoft Dataverse with Power Apps

I have the same question (0)

All responses (4)

Answers (0)

Sort by

Drew Poggemann 9,287 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!
Hi @NativeN ,

SharePoint Online Apps - If you have Canvas apps that connect to SharePoint Online then no, you will not need additional licenses outside of the use rights included with Office 365 licensing.

"Does this mean that if we assign 1 per app plan license to the environment, we are covered from a license perspective?"

If you have a Dataverse environment then you would need to have every user licensed with Power Apps Per App or Power Apps Per User license. Both of these are per user, even though the name on the Power Apps Per App says "per App". It really should say "Per App / Per User" as these are assigned at user level still. Example is if you have 5 users accessing the app in the environment you would need 5 app passes in that environment.

"- Is this needed in order to define our environment strategy without having to license all users? We really want to avoid the default environment but we also don't want to license everybody when not leveraging Dataverse..."

Not sure I understand this question exactly... Overall each environment would have to license users appropriately if they are in Dataverse. Example, in your Dev environment you might only have developers in there and in your Test environment it might be restricted through your security group to a small set of QA testing resources, and Prod would be all users. Again, with licensing if you have User A in Dev, Test, Prod then the user would need an app pass in each environment (or the user would need to be assigned to a Power Apps Per User license).

As far as securing the connectors, you can do this with DLP policies in the environment. https://learn.microsoft.com/en-us/power-platform/admin/wp-data-loss-prevention

Was this reply helpful? Yes No
NativeN 51 on at

Like
a
(0)

Report
Copy link

Link copied!

Hi @dpoggemann

Thanks for your swift reply.

The main concern is this, we currently have a lot of stuff running on SharePoint Online, and we want to create flows & apps on top of that, however, we want to centralize these in a production environment (not the default). and give access to the apps in this production environment to almost all users (that have an office license)
- Do we need to license them with a power apps premium license, in order to access SharePoint Online based apps in a production environment?

Because if do not plan on using Dataverse as a datasource or leverage the security model for our apps, why do we need to license our users? just to access the production environment?

because then we are forced to use the default environment, which is against all best practices?...

Thanks & kind regards

Was this reply helpful? Yes No
Drew Poggemann 9,287 Most Valuable Professional on at

Like
a
(1)

Report
Copy link

Link copied!

Hi @NativeN ,

You do not need licensing to utilize the ALM components to create your PowerApps and Flows and push them through environments. Example article on this (not Microsoft sponsored but thought it would be useful) https://michalsacewicz.com/alm-for-sharepoint-based-solutions-without-premium-licensing/

Was this reply helpful? Yes No
NativeN 51 on at

Like
a
(0)

Report
Copy link

Link copied!

@dpoggemann
Thanks,

And just to be clear, we can create SharePoint based Powerapps in a production environment, and users with a M365 license will be able to access those applications when included in the environment security group?
- This is our main concern

Also, concerning the Data policies, we know how these work, we are just concerned that since Microsoft advices against setting a security access group for the CoE Environment, end users will be able to use the HTTP connectors, because these connectors need to be allowed in the data policy for this CoE dedicated environment. (This because the HTTP connectors Endpoint Configuration is still in preview)

From my perspective, I find the documentation a little bit unclear concerning this matter and this is fairly important.

Many thanks for your help

Was this reply helpful? Yes No