13.2 Environment Governance, Groups, Routing & Capacity Management

Environment Governance, Groups, Routing & Capacity Management

As organizations scale their adoption of the Microsoft Power Platform, unmanaged citizen development can quickly lead to environment sprawl, fragmented security policies, and unexpected storage capacity overages. Enterprise governance requires establishing strict boundaries around who can provision environments, how environments are structured into manageable groups, how makers are onboarded, and how Dataverse storage consumption is tracked and remediated across the tenant.

---

1. PPAC Governance & Restricting Environment Creation

In an unmanaged Microsoft Entra ID tenant, default platform settings allow any licensed user to self-provision Trial and Developer environments. This self-service model frequently results in hundreds of unmonitored environments that consume shared resources and bypass organizational compliance.

+-----------------------------------------------------------------------------------+
|                     PPAC TENANT-LEVEL GOVERNANCE CONTROLS                         |
|                                                                                   |
|  [ENVIRONMENT CREATION PERMISSIONS]                                               |
|  - Production & Sandbox Environments: [Only Specific Admins]                      |
|  - Trial Environments:               [Only Specific Admins]                      |
|                                                                                   |
|  [SECURITY GROUP FILTERING]                                                       |
|  - Bind Entra Security Group to Environment                                       |
|  - Only members of the Security Group are synced to Dataverse                     |
|                                                                                   |
|  [ENVIRONMENT ROUTING]                                                            |
|  - New maker navigates to make.powerapps.com                                      |
|  - Platform auto-creates personal Developer environment                           |
|  - Maker lands in their own workspace, leaving Default environment clean          |
+-----------------------------------------------------------------------------------+

Restricting Environment Creation Permissions

Within the Power Platform Admin Center (PPAC) Tenant Settings, administrators can restrict provisioning rights:

• Production and Sandbox environments: Can be configured to allow "Everyone" or restricted to "Only specific admins" (Global Administrators and Power Platform Administrators).
• Trial environments: Can similarly be restricted to administrators to prevent users from consuming trial capacity or spinning up temporary silos.

Entra ID Security Group Association

To control which users can access a specific Dataverse environment:

• Administrators can associate a Microsoft Entra Security Group with the environment in PPAC.
• When a security group is linked, only users who are direct or nested members of that security group are synchronized into the Dataverse environment's systemuser table.
• Any user not in the security group is denied access at the network and authentication boundary, even if they hold an active Power Apps per-user license.

---

2. Environment Groups & Environment Routing

Managing dozens or hundreds of environments individually creates administrative overhead and policy drift. Microsoft introduced Environment Groups and Environment Routing to automate governance.

+-----------------------------------------------------------------------------------+
|                         ENVIRONMENT GROUPS ARCHITECTURE                           |
|                                                                                   |
|  +-----------------------------------------------------------------------------+  |
|  | ROOT ENVIRONMENT GROUP: "ENTERPRISE GOVERNANCE"                             |  |
|  |                                                                             |  |
|  |   +--------------------------+         +--------------------------+         |  |
|  |   | DEV / SANDBOX GROUP      |         | PRODUCTION GROUP         |         |  |
|  |   | - Solution Checker: WARN |         | - Solution Checker: BLOCK|         |  |
|  |   | - Sharing Limit: Max 10  |         | - Sharing Limit: Sec Group|        |  |
|  |   | - Weekly Usage Digest    |         | - IP Firewall Enforced   |         |  |
|  |   +--------------------------+         +--------------------------+         |  |
|  +-----------------------------------------------------------------------------+  |
+-----------------------------------------------------------------------------------+

Environment Groups

• Logical Containers: Environment Groups allow administrators to organize multiple individual environments into structured containers (e.g., Development, Testing, Production, or Regional business units).
• Rule Inheritance: Group rules automatically cascade to all member environments. When an environment is moved into a group, it immediately inherits all group policies, such as:
  • Managed Environments Activation: Automatically enforces managed governance across all group members.
  • Sharing Limits: Caps the maximum number of users with whom canvas apps can be shared, or enforces sharing only with security groups.
  • Solution Checker Enforcement: Automatically inspects solutions during import and either issues warnings or blocks the import if critical security or performance violations are detected.
  • Backup Retention & Cadence: Establishes uniform backup and governance settings.

Environment Routing

• The Citizen Developer Dilemma: When new makers access make.powerapps.com, they historically landed in the Default environment, leading to massive sprawl of test apps, temporary tables, and unmanaged connections in the tenant's primary container.
• Routing Mechanics: When Environment Routing is enabled in PPAC, the platform automatically intercepts new makers on their first visit to Power Apps Studio and provisions a personal, dedicated Developer environment for them.
• Maker Experience: The maker is automatically granted the System Administrator role in their personal sandbox, enabling them to explore Dataverse, build canvas apps, and test flows freely. Meanwhile, the Default environment remains protected from citizen-developer clutter.

Managed Environments Overview

Managed Environments is a premium governance suite that elevates administrative control across Power Platform environments (requiring standalone Power Apps/Automate licenses for active users):

• Maker Welcome Content: Custom onboarding markdown and links displayed to makers when they enter the environment.
• Usage Insights: Automated weekly email digests summarizing active apps, inactive flows, and license consumption.
• Extended Security: Enables Customer-Managed Keys (CMK), IP Firewall restrictions, and Virtual Network (VNet) support.

---

3. Dataverse Storage Capacity Architecture

Microsoft Dataverse utilizes a tiered, cloud-scale storage model that separates relational data, binary files, and operational logs into three distinct physical storage engines. Storage capacity is pooled at the tenant level.

+-----------------------------------------------------------------------------------+
|                       DATAVERSE STORAGE POOL ARCHITECTURE                         |
|                                                                                   |
|  [1. DATABASE CAPACITY]          [2. FILE CAPACITY]         [3. LOG CAPACITY]     |
|  - Relational table data         - Document attachments     - Audit log history   |
|  - Column metadata & schema      - PDF, Word, Excel files   - Plug-in trace logs  |
|  - System jobs & workflows       - Photos & video media     - API telemetry data  |
|  - Security roles & privileges   - App canvas images        - System event logs   |
|                                                                                   |
|  Accrual: Base + Per User        Accrual: Base + Per User   Accrual: Base Only    |
|  (10 GB Base + 250 MB/User)      (20 GB Base + 2 GB/User)   (2 GB Base Tenant)    |
+-----------------------------------------------------------------------------------+

The Three Storage Capacity Types

1. Database Capacity:
   • Stores: Relational table records, schema definitions, custom column metadata, entity relationship mappings, security role configurations, business process flows, and asynchronous system job records.
   • Engine: Azure SQL Database and Cosmos DB relational backends.
   • Accrual: Standard tenant allocation (e.g., 10 GB base) plus accrued capacity per paid user license (e.g., +250 MB per Power Apps Premium user).
2. File Capacity:
   • Stores: Binary attachments, document uploads (PDFs, Word documents, spreadsheets), high-resolution images, signatures, and media files associated with records.
   • Engine: Azure Blob Storage.
   • Accrual: Standard tenant allocation (e.g., 20 GB base) plus generous accrued capacity per paid user license (e.g., +2 GB per Power Apps Premium user).
3. Log Capacity:
   • Stores: Dataverse record audit history (record creations, updates, deletions, and access timestamps), plug-in trace logs (plugintracelog), and system telemetry.
   • Engine: Azure Cosmos DB and Azure Log Analytics storage.
   • Accrual: Fixed base tenant allocation (e.g., 2 GB base) with no per-user license accrual; additional capacity must be acquired via add-on packs.

---

4. Capacity Over-Quota Enforcement & Remediation

Understanding what happens when a tenant exceeds its allocated storage capacity is an essential operational skill frequently evaluated on the PL-200 exam.

+-----------------------------------------------------------------------------------+
|                     TENANT OVER-QUOTA ENFORCEMENT SEMANTICS                       |
|                                                                                   |
|  [OPERATIONS BLOCKED]                       [OPERATIONS PERMITTED (NO OUTAGE)]    |
|  - Creating new environments                - Existing apps continue working      |
|  - Copying existing environments            - End users can read/write data       |
|  - Restoring environment backups            - Creating new rows and records       |
|  - Resetting existing environments          - Power Automate flows continue run   |
|  - Converting Sandbox to Production         - End users experience zero downtime  |
+-----------------------------------------------------------------------------------+

Over-Quota Enforcement Boundaries

When an organization exceeds its total entitled capacity in any of the three storage categories (Database, File, or Log):

• Administrative Operations are BLOCKED:
  • You cannot provision any new environments (Sandbox, Production, or Trial).
  • You cannot execute environment Copy, Restore, or Reset operations.
  • You cannot convert a Sandbox environment into a Production environment.
• End-User Runtime is NOT BLOCKED:
  • Existing model-driven apps, canvas apps, and Power Pages sites remain 100% operational.
  • Users can freely create, read, update, and delete table records.
  • Power Automate cloud flows and background automations continue to trigger and execute normally.
  • Microsoft never causes sudden operational business outages due to storage capacity overages.

Minimum Creation Threshold

• To create any new Dataverse environment or enable a database in an existing environment, the tenant must have at least 1 GB of available Database capacity.

Capacity Remediation Strategies

If a tenant is over quota, administrators have four primary remediation paths:

1. Purchase Capacity Add-Ons: Buy additional 1 GB Database, File, or Log Capacity add-on subscriptions through the Microsoft 365 Admin Center.
2. Purge Audit Logs: Delete historical audit partitions or disable auditing on high-frequency tables.
3. Clean Asynchronous Jobs & Traces: Bulk-delete completed system jobs, workflow execution histories, and plug-in trace logs using Dataverse Bulk Deletion jobs.
4. Offload File Storage: Re-architect solutions to store large document attachments in SharePoint or Azure Blob Storage rather than directly inside Dataverse file columns.