Environment and DLP Policy management

Watch a walk-through of how the environment and DLP request process works.

Process description

Problem statement: When a development project requires a new Environment, and non-admins are restricted from creating Environments, the only way for non-admins to access new Environments is for admins to provision the Environment and grant permissions to users. Admins can become the bottleneck of development if volume of demand for environments is high because multiple steps are involved. New environments may also require new connectors or DLP policies.

Solution: The below process can be used by non-admins to request new environments and changes to DLP policies for their environments.

Developers (non-admins) can:

• Submit requests for new environments.
• Submit requests for DLP policies to be applied to their environments.

Admins can:

• Provision new environments for developers using the app.
• See how new environments will be affected by data loss prevention policies.
• Approve or reject DLP policy requests.

Developer: Request an environment

Developers (non-admins) can request new environments for their admin to triage.

1. Open Maker – Environment Request app.

2. Select + New

3. In the fly-out menu, choose the desired connectors that will be needed in the new environment. Then select Next.

4. Choose the user accounts who will need environment administrator access.

5. Provide basic details about the desired environment, including the display name, region, type, purpose.

6. Indicate if the environment can be automatically cleaned up after a certain period of time.

   1. If yes, then provide a duration (in days) from the dropdown that appears. Do this if you only need the environment for a short term project.
   2. If no, the environment will not be deleted automatically. Do this if you need to keep the environment for a long time.

7. Indicate whether to provision a Dataverse database.

8. If a database is needed (toggle=yes), provide the required language and currency values. Optionally provide a security group to restrict access to the environment.

9. Submit the form when done by clicking the Save button.

📧 An email will be sent to notify the CoE Starter Kit admins to review the new request.

View any of your submitted requests in the canvas app.

Admin: Approve or deny an environment request

As the admin, you can view and triage requests for new environments.

1. Open the canvas app called Admin - Environment Request.

2. View the pending environment creation requests in the home screen.

   Note

   By default, pending requests are displayed first. Change the request state filter using the dropdown in the right side of the ribbon.

3. Select a request in the table to view more detail.

4. Read details requested for the new environment:

   1. Environment information, justification.

   2. Admins requested.

   3. View the requested security group, or add one if none was selected.

   4. Connectors.

   5. Impacting policies.

   6. Add comments about the decision in the Notes panel.

      

   Note

   A banner on the top of the page indicates how the new environment will be impacted based on the existing policies in the tenant. The impact analysis will change when policies are modified.

5. Modify data loss prevention policies in the Impacted Policies table by clicking on the suggested actions (if any are available).

   Warning

   Only certain types of policies can be added (Organization-level environments that are not "All Environments" type policies).

6. Select "View and modify policies" to see all policies and their impact on the requested connectors. You can add or remove policies to the modify list that will be changed upon approval by selecting a policy and choosing the actions that appear in the ribbon.

7. Select a policy and click on the Details action in the ribbon to view the impact on connectors.

8. Approve or reject the request in the top left ribbon.

Approved path

Once the request is approved, the environment will be created with the requested configurations. The users are granted environment admin access.

⏳ Expiration

If the environment has an expiration date, it will be automatically deleted after the duration indicated. Warning emails are sent out weekly to the admins to remind them to save work in source control or other locations outside of the environment.

If no expiration is set the environment will never be cleaned up automatically. The environment must be deleted manually in the Power Platform admin center.

DLP recommendation logic

The admin app uses the below logic to provide guidance on how to configure the DLP policies to allow requested connectors.

Decision matrix: Warning banner

This is the banner displayed in the admin app when viewing the request's details page.

Decision matrix: Policy-level recommended actions

Matrix for recommended action based on the policy and the requested connectors. Horizontal columns show each policy type, and vertical rows of the matrix show the impact that policy has on the requested connectors based on its rules.

Developer: Request a DLP Policy Change

Makers can use the DLP Policy Change Request system to modify the DLP Policy applied to environments where they are the administrator. If approved, this will enable the connectors you need in the environments you work in.

1. Open Maker – Environment Request app.
2. Navigate to the Data Policy Change Requests page using the left navigation.
3. Select + New
4. In the "Action Requested" field, choose the "Apply Policy to Environment" option.
5. In the "Policy" field, select the desired policy.
   1. Confirm if the connectors required by your environment are in the policy by clicking the information icon next to the field header.
6. Choose the environment to apply this policy to. You will only be select environments you are an administrator of.
   1. If you do not see any environments in the drop-down, then you do not have an environment administrator role to any environments.
   2. Provide a reason for the request. For example, it helps to specify your project details and the connectors you require.
7. Select Save to submit the request.
8. If the administrator approves the request, the policy will be applied to the environment.

Admin: Approve or deny a DLP policy change request

Configure Shared Policies

Configure data policies in the Power Platform Admin Center.

Example set of shared DLP Policies that can address different levels of groups:

• Productivity (Apply to all environments except) – This policy is intended to cover the Default environment, trial environments, and all other environments that are not covered by the other environments. It has the most restrictive rules.
• Power User (Apply to multiple environments) – Available for individual environments with slightly less restrictive rules than Productivity.
• Pro Dev (Apply to multiple environments) – Available for individual environments with access to most connectors compared to Power User and is intended for users who are well trained and agree to company data security policies that should be defined with an acknowledgement of liability for use.

Sync shared Policies

Since makers cannot see all data policies, the request system makes it easy to display that information to the makers via Dataverse. The system syncs the indicated policies from the Power Platform service to a Dataverse table, and makers can see the policies an admin allow them to view. Makers can then request to apply those shared policies to their environments.

To make a Shared DLP Policy visible to makers, the policy needs to be created as a record in Dataverse.

• Open the Admin – Environment Request app.
• Navigate to the Data policies page in the left navigation.
• Select the policy you want to make visible to makers, then select the Make visible option in the ribbon

Share app and instructions with makers

• Grant your makers access to the Maker – Environment Request canvas app and assign them the Power Platform Maker SR security role. Use a Microsoft Entra group to make assignment easier.
• Provide users with instructions on how to use the request system.

Approve or Reject requests

Once users have access and begin making requests, admins can see those requests in the Admin – Environment Request canvas app.

To view and respond to the DLP Policy Change requests:

1. Open the Admin – Environment Request app.
2. Navigate to the Policy Change Requests page using the left navigation.
3. View the list of requests. You can filter the request by status using the status filter in the right side of the ribbon.
4. To view the request in more detail, select one of the requests and click the Details action in the ribbon.
5. To approve or deny a request, filter the status to “Pending” and select one of the requests. Only requests with pending status can be responded to in the app.
6. Once a request is selected, you can choose to “approve” or “reject” the request using the actions in the ribbon.
   1. If a request is approved, it will update the status to “Approved”, which will trigger a flow that automatically applies the selected policy to the indicated environment. It will also remove the environment from all other policies that have an “include” environment scope and add the environment to all policies with an “exclude” environment scope. Make sure this behavior fits with your company’s security requirements before continuing. Once the automation completes, the request status is set to “Fulfilled” and the record is deactivated.
   2. If the request is rejected, the status is set to “Rejected” and the record is deactivated.