1
00:00:00,040 --> 00:00:02,480
Your tenant gets one default
environment and every licensed
2
00:00:02,480 --> 00:00:03,839
user can build inside it.
3
00:00:03,839 --> 00:00:06,040
That is also the environment
Microsoft says not to run
4
00:00:06,040 --> 00:00:07,120
production work in.
5
00:00:07,120 --> 00:00:10,480
Welcome to the M365 FM podcast,
where we explore the people,
6
00:00:10,480 --> 00:00:12,720
ideas, and technologies shaping
the future of work.
7
00:00:12,720 --> 00:00:15,560
Today we're talking about power
platform environments and why
8
00:00:15,560 --> 00:00:18,280
the container you build in
decides what your app can do.
9
00:00:18,280 --> 00:00:20,940
Each environment keeps its own
data, and apps can't reach
10
00:00:20,940 --> 00:00:21,719
across that line.
11
00:00:21,719 --> 00:00:23,019
By the end, you'll know which
12
00:00:23,019 --> 00:00:24,399
environment to reach for and
13
00:00:24,399 --> 00:00:25,640
why.
14
00:00:25,640 --> 00:00:27,719
What an environment actually is.
15
00:00:27,719 --> 00:00:29,199
A power platform environment is
16
00:00:29,199 --> 00:00:30,199
a space where your business
17
00:00:30,199 --> 00:00:31,579
data, your apps, your chatbots
18
00:00:31,579 --> 00:00:32,740
and your flows all live
19
00:00:32,740 --> 00:00:33,479
together.
20
00:00:33,479 --> 00:00:34,600
Microsoft built it as a
21
00:00:34,600 --> 00:00:35,840
container, and the job of a
22
00:00:35,840 --> 00:00:36,960
container is to keep things
23
00:00:36,960 --> 00:00:38,259
apart that don't belong
24
00:00:38,259 --> 00:00:38,960
together.
25
00:00:38,960 --> 00:00:40,280
Everything you create inside it,
26
00:00:40,280 --> 00:00:41,799
from a simple canvas app to an
27
00:00:41,799 --> 00:00:43,679
automated flow, stays attached
28
00:00:43,679 --> 00:00:44,960
to that environment for its
29
00:00:44,960 --> 00:00:45,399
whole life.
30
00:00:45,399 --> 00:00:47,479
Think about how your company
stores documents.
31
00:00:47,479 --> 00:00:50,359
You wouldn't throw every file
from every team into one shared
32
00:00:50,359 --> 00:00:52,920
folder and hand the whole
company the same key.
33
00:00:52,920 --> 00:00:54,520
Yet that's exactly what a single
34
00:00:54,520 --> 00:00:56,119
shared workspace does to your
35
00:00:56,119 --> 00:00:56,679
apps.
36
00:00:56,679 --> 00:00:58,159
An environment exists, so you
37
00:00:58,159 --> 00:00:59,679
never have to work that way, and
38
00:00:59,679 --> 00:01:00,929
it separates apps that have
39
00:01:00,929 --> 00:01:01,929
different roles, different
40
00:01:01,929 --> 00:01:03,490
security needs, or different
41
00:01:03,490 --> 00:01:04,329
audiences.
42
00:01:04,329 --> 00:01:06,090
This matters more as a company
grows.
43
00:01:06,090 --> 00:01:09,209
One shared space works fine for
a handful of small tools, and
44
00:01:09,209 --> 00:01:10,010
then it doesn't.
45
00:01:10,010 --> 00:01:11,890
A change for one team can ripple
into another.
46
00:01:11,890 --> 00:01:13,250
Team's work environments give
47
00:01:13,250 --> 00:01:14,370
you a way to keep those worlds
48
00:01:14,370 --> 00:01:15,969
separate on purpose, so a small
49
00:01:15,969 --> 00:01:17,370
experiment in one corner won't
50
00:01:17,370 --> 00:01:18,450
quietly break something in
51
00:01:18,450 --> 00:01:18,849
another.
52
00:01:18,849 --> 00:01:21,530
You can see the idea in how
teams actually use them.
53
00:01:21,530 --> 00:01:22,769
One organization gives each
54
00:01:22,769 --> 00:01:24,370
department its own environment,
55
00:01:24,370 --> 00:01:25,849
so marketing's data never mixes
56
00:01:25,849 --> 00:01:26,769
with finances.
57
00:01:26,769 --> 00:01:28,769
Another runs a production
environment for the apps
58
00:01:28,769 --> 00:01:31,409
everyone uses, with a sandbox
sitting beside it for the
59
00:01:31,409 --> 00:01:33,010
changes nobody should see yet.
60
00:01:33,010 --> 00:01:34,489
Microsoft even suggests separate
61
00:01:34,489 --> 00:01:35,409
environments for different
62
00:01:35,409 --> 00:01:36,930
global branches of a company,
63
00:01:36,930 --> 00:01:38,170
which tells you how central this
64
00:01:38,170 --> 00:01:38,650
idea is.
65
00:01:38,650 --> 00:01:39,969
Every environment also sits
66
00:01:39,969 --> 00:01:41,409
inside your Microsoft Entra
67
00:01:41,409 --> 00:01:42,689
Tenant, which is the directory
68
00:01:42,689 --> 00:01:44,090
that holds your company's users
69
00:01:44,090 --> 00:01:44,890
and groups.
70
00:01:44,890 --> 00:01:46,489
Only people inside that tenant
71
00:01:46,489 --> 00:01:47,609
can reach the environment's
72
00:01:47,609 --> 00:01:49,329
resources, so an outsider can't
73
00:01:49,329 --> 00:01:50,010
wander in.
74
00:01:50,010 --> 00:01:52,569
The environment is bound to a
region, to anything you build
75
00:01:52,569 --> 00:01:55,450
there, including connections,
gateways, and flows, runs in
76
00:01:55,450 --> 00:01:57,209
data centers near that location.
77
00:01:57,209 --> 00:02:00,109
There's one rule that catches
almost everyone An app can only
78
00:02:00,109 --> 00:02:02,750
connect to data sources that
live in the same environment.
79
00:02:02,750 --> 00:02:05,069
If you build an app in one
environment and the data sits in
80
00:02:05,069 --> 00:02:06,430
another, the app can't see it.
81
00:02:06,430 --> 00:02:07,989
No matter how correct your logic
looks.
82
00:02:07,989 --> 00:02:11,229
That single restriction explains
a lot of beginner frustration.
83
00:02:11,229 --> 00:02:13,710
A broken connection often looks
like a bug when it's really a
84
00:02:13,710 --> 00:02:14,710
boundary doing its job.
85
00:02:14,710 --> 00:02:16,909
It's a real boundary that
decides where your app lives and
86
00:02:16,909 --> 00:02:17,550
what it can reach.
87
00:02:17,550 --> 00:02:20,349
And it isn't a label you attach
to a project at the end.
88
00:02:20,349 --> 00:02:22,069
Once that idea clicks, the rest
89
00:02:22,069 --> 00:02:23,550
of power platform starts to feel
90
00:02:23,550 --> 00:02:24,590
less random.
91
00:02:24,590 --> 00:02:26,610
The next question is which kind
of environment you should
92
00:02:26,610 --> 00:02:27,949
actually be in.
93
00:02:27,949 --> 00:02:30,949
The environment types in plain
words, environments come in a
94
00:02:30,949 --> 00:02:33,270
few types and the type tells you
what the space is for.
95
00:02:33,270 --> 00:02:35,629
You don't need to memorize the
whole list, because you only
96
00:02:35,629 --> 00:02:37,590
need to recognize which one
you're standing in.
97
00:02:37,590 --> 00:02:40,069
By the end of this section,
you'll be able to name it.
98
00:02:40,069 --> 00:02:42,270
The first one you meet is the
default environment.
99
00:02:42,270 --> 00:02:43,710
Every tenant gets exactly one.
100
00:02:43,710 --> 00:02:46,310
Microsoft creates it for you,
and anyone with a license can
101
00:02:46,310 --> 00:02:48,729
start building their new users
are dropped straight into the
102
00:02:48,729 --> 00:02:51,189
maker role, so they can start
creating apps on day one.
103
00:02:51,189 --> 00:02:53,430
That's why the default feels
welcoming, and it's also why it
104
00:02:53,430 --> 00:02:55,990
fills up so fast that
convenience has a cost.
105
00:02:55,990 --> 00:02:58,520
The default environment is
shared with your whole company.
106
00:02:58,520 --> 00:02:59,919
It can't be deleted, and
107
00:02:59,919 --> 00:03:01,360
Microsoft gives it no backup
108
00:03:01,360 --> 00:03:02,039
guarantees.
109
00:03:02,039 --> 00:03:03,319
It's meant for experiments and
110
00:03:03,319 --> 00:03:05,039
small personal tools, not for
111
00:03:05,039 --> 00:03:06,199
the apps your business depends
112
00:03:06,199 --> 00:03:06,680
on.
113
00:03:06,680 --> 00:03:09,199
It also has a ceiling of one
terabyte, and it opens with a
114
00:03:09,199 --> 00:03:11,439
small slice of that spread
across its database.
115
00:03:11,439 --> 00:03:12,879
Its files and its logs.
116
00:03:12,879 --> 00:03:14,680
Remember that shared no backup
117
00:03:14,680 --> 00:03:16,080
default because it comes back in
118
00:03:16,080 --> 00:03:17,159
the habits we'll cover at the
119
00:03:17,159 --> 00:03:18,159
end.
120
00:03:18,159 --> 00:03:19,759
Production is the opposite, and
121
00:03:19,759 --> 00:03:21,000
it's the environment you depend
122
00:03:21,000 --> 00:03:21,439
on.
123
00:03:21,439 --> 00:03:24,300
Permanent work lives there, and
the apps people use every day
124
00:03:24,300 --> 00:03:25,199
should run there.
125
00:03:25,199 --> 00:03:26,599
If something has to stay up, it
126
00:03:26,599 --> 00:03:27,479
belongs in a production
127
00:03:27,479 --> 00:03:28,319
environment.
128
00:03:28,319 --> 00:03:30,240
Sandbox environments are the
safe rooms.
129
00:03:30,240 --> 00:03:33,520
A sandbox is any non-production
environment, and it comes with
130
00:03:33,520 --> 00:03:36,280
abilities that would be reckless
in production, like resetting,
131
00:03:36,280 --> 00:03:37,639
copying and deleting.
132
00:03:37,639 --> 00:03:39,639
That's the point, because you
want to break things in a
133
00:03:39,639 --> 00:03:41,599
sandbox and never in production.
134
00:03:41,599 --> 00:03:43,520
Developer environments are
personal.
135
00:03:43,520 --> 00:03:44,879
A developer environment belongs
136
00:03:44,879 --> 00:03:46,400
to one person, and it's meant
137
00:03:46,400 --> 00:03:47,680
for building and testing rather
138
00:03:47,680 --> 00:03:48,759
than for running or sharing
139
00:03:48,759 --> 00:03:49,800
production apps.
140
00:03:49,800 --> 00:03:51,280
Each user can have one managed
141
00:03:51,280 --> 00:03:52,639
developer environment, and it
142
00:03:52,639 --> 00:03:53,560
doesn't count against your
143
00:03:53,560 --> 00:03:54,520
company's capacity.
144
00:03:54,520 --> 00:03:56,900
If you're learning the platform,
this is the space that's yours
145
00:03:56,900 --> 00:03:57,860
to mess up.
146
00:03:57,860 --> 00:03:59,219
Trial environments are short
lived.
147
00:03:59,219 --> 00:04:00,259
You get one per user.
148
00:04:00,259 --> 00:04:02,599
It's built for quick tests and
proofs of concept, and it
149
00:04:02,599 --> 00:04:04,099
expires after thirty days.
150
00:04:04,099 --> 00:04:05,419
When it's gone, it's gone.
151
00:04:05,419 --> 00:04:07,219
So don't park anything important
there.
152
00:04:07,219 --> 00:04:08,300
One thing is worth knowing in
153
00:04:08,300 --> 00:04:09,840
plain words, the older kind of
154
00:04:09,840 --> 00:04:11,020
developer environment called
155
00:04:11,020 --> 00:04:12,659
unmanaged is being retired and
156
00:04:12,659 --> 00:04:14,099
so is the Dataverse for teams
157
00:04:14,099 --> 00:04:14,819
environment.
158
00:04:14,819 --> 00:04:16,500
The developer type still exists,
159
00:04:16,500 --> 00:04:17,860
but it now means a managed
160
00:04:17,860 --> 00:04:18,860
developer environment.
161
00:04:18,860 --> 00:04:20,139
There's no need to panic about
that.
162
00:04:20,139 --> 00:04:21,980
And you do need to know the
names have shifted.
163
00:04:21,980 --> 00:04:23,939
Not every type is open to
everyone either.
164
00:04:23,939 --> 00:04:25,220
An admin can restrict who is
165
00:04:25,220 --> 00:04:27,060
allowed to create sandbox trial
166
00:04:27,060 --> 00:04:28,620
and developer environments, so
167
00:04:28,620 --> 00:04:29,720
the choice isn't always yours to
168
00:04:29,720 --> 00:04:30,339
make.
169
00:04:30,339 --> 00:04:33,019
If a button is grayed out,
that's usually why the names
170
00:04:33,019 --> 00:04:35,100
matter less than the purpose
behind each one.
171
00:04:35,100 --> 00:04:37,220
You pick a default to
experiment, a developer
172
00:04:37,220 --> 00:04:40,500
environment to build in private,
a sandbox to test changes, and a
173
00:04:40,500 --> 00:04:42,939
production environment to serve
the people who depend on you.
174
00:04:42,939 --> 00:04:44,379
That's the whole decision, and
175
00:04:44,379 --> 00:04:45,459
it's smaller than it first
176
00:04:45,459 --> 00:04:46,500
looks.
177
00:04:46,500 --> 00:04:48,899
Dataverse one database per
environment.
178
00:04:48,899 --> 00:04:50,060
Every environment can have a
179
00:04:50,060 --> 00:04:51,300
database, and that database is
180
00:04:51,300 --> 00:04:52,500
called Dataverse.
181
00:04:52,500 --> 00:04:54,100
The rule around it surprises
people.
182
00:04:54,100 --> 00:04:56,545
An environment can hold a single
Dataverse database or no
183
00:04:56,545 --> 00:04:58,949
database at all, and it can
never hold two.
184
00:04:58,949 --> 00:04:59,550
That's the ceiling.
185
00:04:59,550 --> 00:05:00,470
And there's no version of the
186
00:05:00,470 --> 00:05:01,589
setup where you get a second
187
00:05:01,589 --> 00:05:02,189
one.
188
00:05:02,189 --> 00:05:03,790
Because of that rule, your data
189
00:05:03,790 --> 00:05:05,310
doesn't quietly flow between
190
00:05:05,310 --> 00:05:06,269
environments.
191
00:05:06,269 --> 00:05:07,709
Each one keeps its own database.
192
00:05:07,709 --> 00:05:10,310
So a copy of an environment can
exist for testing without ever
193
00:05:10,310 --> 00:05:11,670
touching the real records.
194
00:05:11,670 --> 00:05:13,750
Microsoft even lets you copy a
sandbox.
195
00:05:13,750 --> 00:05:16,629
That way, you can try a change
against realistic data before it
196
00:05:16,629 --> 00:05:18,829
goes anywhere near a live app.
197
00:05:18,829 --> 00:05:21,189
Dataverse is also where your
structure lives, meaning your
198
00:05:21,189 --> 00:05:23,829
tables, your columns, and the
relationships between them.
199
00:05:23,829 --> 00:05:25,089
When you build a model driven
200
00:05:25,089 --> 00:05:26,269
app, that structure is the
201
00:05:26,269 --> 00:05:26,990
backbone.
202
00:05:26,990 --> 00:05:28,069
The app runs on.
203
00:05:28,069 --> 00:05:30,269
That's why Dataverse and
environments get talked about
204
00:05:30,269 --> 00:05:31,509
together so often.
205
00:05:31,509 --> 00:05:34,670
A canvas app can reach plenty of
other data sources, and a model
206
00:05:34,670 --> 00:05:37,230
driven app leans hard on
Dataverse for its shape.
207
00:05:37,230 --> 00:05:38,629
So think of Dataverse as the
208
00:05:38,629 --> 00:05:40,050
filing cabinet that belongs to
209
00:05:40,050 --> 00:05:40,670
one room.
210
00:05:40,670 --> 00:05:43,649
It holds the records for that
room and nothing else, and it
211
00:05:43,649 --> 00:05:45,589
stays behind when you walk into
a different one.
212
00:05:45,589 --> 00:05:46,889
That picture is simple, and it's
213
00:05:46,889 --> 00:05:47,949
accurate enough to keep you out
214
00:05:47,949 --> 00:05:48,949
of trouble.
215
00:05:48,949 --> 00:05:50,910
Who gets in and what they can
touch.
216
00:05:50,910 --> 00:05:51,949
Environments have built in
217
00:05:51,949 --> 00:05:53,269
roles, and the two you'll hear
218
00:05:53,269 --> 00:05:54,829
most are environment admin and
219
00:05:54,829 --> 00:05:56,000
environment maker and
220
00:05:56,000 --> 00:05:57,209
environment admin runs the
221
00:05:57,209 --> 00:05:58,649
environment, can create its
222
00:05:58,649 --> 00:05:59,649
database and sets the
223
00:05:59,649 --> 00:06:00,490
guardrails.
224
00:06:00,490 --> 00:06:01,870
An environment maker can create
225
00:06:01,870 --> 00:06:03,790
apps, connections and flows, but
226
00:06:03,790 --> 00:06:05,089
has no rights to the data
227
00:06:05,089 --> 00:06:06,370
itself.
228
00:06:06,370 --> 00:06:07,730
That last part confuses people,
229
00:06:07,730 --> 00:06:08,610
so it's worth saying in a
230
00:06:08,610 --> 00:06:09,410
different way.
231
00:06:09,410 --> 00:06:10,569
Being allowed to build in an
232
00:06:10,569 --> 00:06:11,769
environment isn't the same as
233
00:06:11,769 --> 00:06:13,370
being allowed to read its data,
234
00:06:13,370 --> 00:06:14,649
and those are two separate
235
00:06:14,649 --> 00:06:15,290
doors.
236
00:06:15,290 --> 00:06:17,769
You can hold the key to the
workshop and still not hold the
237
00:06:17,769 --> 00:06:19,209
key to the filing cabinet.
238
00:06:19,209 --> 00:06:20,129
Here's how that plays out.
239
00:06:20,129 --> 00:06:21,290
In practice, you might be able
240
00:06:21,290 --> 00:06:22,649
to open an app in the maker
241
00:06:22,649 --> 00:06:24,250
portal and still see empty
242
00:06:24,250 --> 00:06:25,129
screens.
243
00:06:25,129 --> 00:06:27,490
The app is fine, and you're
simply missing a security role
244
00:06:27,490 --> 00:06:28,610
on the data side.
245
00:06:28,610 --> 00:06:30,129
That mismatch is common, and
246
00:06:30,129 --> 00:06:31,370
it's the single biggest source
247
00:06:31,370 --> 00:06:31,970
of it.
248
00:06:31,970 --> 00:06:33,529
Works for my colleague, but not
for me.
249
00:06:33,529 --> 00:06:34,370
Confusion.
250
00:06:34,370 --> 00:06:36,889
The rules also shift depending
on whether the environment has a
251
00:06:36,889 --> 00:06:38,449
database without one.
252
00:06:38,449 --> 00:06:41,050
Environment, admin and
environment maker are the only
253
00:06:41,050 --> 00:06:42,930
two roles that matter with one.
254
00:06:42,930 --> 00:06:45,290
The system administrator role
takes the top spot.
255
00:06:45,290 --> 00:06:47,930
The list of predefined roles
grows to include names like
256
00:06:47,930 --> 00:06:50,769
basic User and System
Customizer, along with app
257
00:06:50,769 --> 00:06:53,889
specific roles that arrive when
you add a product like dynamics
258
00:06:53,889 --> 00:06:55,050
three hundred sixty five.
259
00:06:55,050 --> 00:06:56,220
There are also bigger roles that
260
00:06:56,220 --> 00:06:57,220
live above any single
261
00:06:57,220 --> 00:06:57,860
environment.
262
00:06:57,860 --> 00:07:00,980
Tenant level admins like the
Power Platform administrator or
263
00:07:00,980 --> 00:07:03,620
the global administrator manage
the whole tenant.
264
00:07:03,620 --> 00:07:04,800
They don't automatically get
265
00:07:04,800 --> 00:07:06,180
access to the data inside a
266
00:07:06,180 --> 00:07:07,180
given environment.
267
00:07:07,180 --> 00:07:08,860
In an environment with a
database.
268
00:07:08,860 --> 00:07:12,019
Full admin access comes from the
system administrator role, not
269
00:07:12,019 --> 00:07:13,379
from being a tenant admin.
270
00:07:13,379 --> 00:07:16,620
That surprises a lot of people
and it's there on purpose.
271
00:07:16,620 --> 00:07:17,899
Then the Dataverse security
272
00:07:17,899 --> 00:07:19,259
roles decide what a person can
273
00:07:19,259 --> 00:07:20,339
see and change once they're
274
00:07:20,339 --> 00:07:21,220
inside.
275
00:07:21,220 --> 00:07:22,579
Names like System Administrator,
276
00:07:22,579 --> 00:07:23,959
System Customizer, and Basic
277
00:07:23,959 --> 00:07:25,339
User describe how much reach
278
00:07:25,339 --> 00:07:25,860
someone has.
279
00:07:25,860 --> 00:07:27,040
Microsoft's rule of thumb is to
280
00:07:27,040 --> 00:07:28,100
give each person the least
281
00:07:28,100 --> 00:07:29,220
access they need to do their
282
00:07:29,220 --> 00:07:29,699
job.
283
00:07:29,699 --> 00:07:30,920
A maker who needs to update
284
00:07:30,920 --> 00:07:32,620
tables usually needs the system
285
00:07:32,620 --> 00:07:34,180
customizer role on top of
286
00:07:34,180 --> 00:07:35,060
environment maker.
287
00:07:35,060 --> 00:07:38,180
That's why two roles are
sometimes required for one job.
288
00:07:38,180 --> 00:07:39,339
Finally, security groups and
289
00:07:39,339 --> 00:07:40,660
licenses decide who can even see
290
00:07:40,660 --> 00:07:41,660
an environment in the first
291
00:07:41,660 --> 00:07:41,939
place.
292
00:07:41,939 --> 00:07:44,139
That's why a colleague can work
at your company and still have
293
00:07:44,139 --> 00:07:45,300
no idea your app exists.
294
00:07:45,300 --> 00:07:49,100
Because access is granted on
purpose and never by accident.
295
00:07:49,100 --> 00:07:50,220
Environment groups.
296
00:07:50,220 --> 00:07:51,540
Folders for environments.
297
00:07:51,540 --> 00:07:54,139
As a company grows, the number
of environments can climb into
298
00:07:54,139 --> 00:07:57,240
the hundreds and managing them
one at a time stops working.
299
00:07:57,240 --> 00:07:58,319
Microsoft's answer is the
300
00:07:58,319 --> 00:07:59,680
environment Group, which it
301
00:07:59,680 --> 00:08:00,920
describes as a folder for your
302
00:08:00,920 --> 00:08:01,959
environments.
303
00:08:01,959 --> 00:08:02,959
A group collects related
304
00:08:02,959 --> 00:08:04,240
environments and applies the
305
00:08:04,240 --> 00:08:05,480
same rules to all of them at
306
00:08:05,480 --> 00:08:06,160
once.
307
00:08:06,160 --> 00:08:08,360
Only managed environments can
join a group.
308
00:08:08,360 --> 00:08:09,620
Each environment can belong to
309
00:08:09,620 --> 00:08:11,360
just one group, and groups can't
310
00:08:11,360 --> 00:08:13,019
overlap or nest inside each
311
00:08:13,019 --> 00:08:13,399
other.
312
00:08:13,399 --> 00:08:14,680
Those limits keep the structure
313
00:08:14,680 --> 00:08:16,079
predictable, which is the whole
314
00:08:16,079 --> 00:08:17,040
point when you're trying to
315
00:08:17,040 --> 00:08:18,240
bring order to a sprawling
316
00:08:18,240 --> 00:08:18,839
setup.
317
00:08:18,839 --> 00:08:21,279
The useful part is what a rule
actually does.
318
00:08:21,279 --> 00:08:23,839
When you publish a rule at the
group level, that's setting
319
00:08:23,839 --> 00:08:26,680
locks inside every member
environment, so a local admin
320
00:08:26,680 --> 00:08:27,639
can't quietly change it.
321
00:08:27,639 --> 00:08:30,240
Remove an environment from the
group and it keeps the last
322
00:08:30,240 --> 00:08:31,279
settings it received.
323
00:08:31,279 --> 00:08:32,379
Those settings unlock though,
324
00:08:32,379 --> 00:08:33,480
which lets someone manage it
325
00:08:33,480 --> 00:08:34,039
again.
326
00:08:34,039 --> 00:08:35,639
A group is also a natural home
327
00:08:35,639 --> 00:08:37,080
for similar spaces, and
328
00:08:37,080 --> 00:08:38,879
Microsoft's own examples show
329
00:08:38,879 --> 00:08:39,679
the range.
330
00:08:39,679 --> 00:08:42,100
One company keeps a personal
productivity group for every
331
00:08:42,100 --> 00:08:43,360
maker's private space.
332
00:08:43,360 --> 00:08:46,240
Another builds a copilot pilot
group, so AI features can be
333
00:08:46,240 --> 00:08:49,080
tested in sandboxes before
anyone touches production.
334
00:08:49,080 --> 00:08:52,080
A global business splits its
environments by region, so each
335
00:08:52,080 --> 00:08:53,809
one follows local rules.
336
00:08:53,809 --> 00:08:56,769
A careful team keeps a relaxed
development group beside a
337
00:08:56,769 --> 00:08:58,649
stricter production group.
338
00:08:58,649 --> 00:08:59,970
Managed environments.
339
00:08:59,970 --> 00:09:02,649
The premium switch groups and
rules only work on managed
340
00:09:02,649 --> 00:09:05,690
environments, so that phrase
deserves a plain explanation.
341
00:09:05,690 --> 00:09:06,970
An environment is either managed
342
00:09:06,970 --> 00:09:08,210
or it isn't, and turning the
343
00:09:08,210 --> 00:09:10,009
managed switch on unlocks a set
344
00:09:10,009 --> 00:09:11,570
of premium capabilities aimed at
345
00:09:11,570 --> 00:09:12,009
admins.
346
00:09:12,009 --> 00:09:14,529
Microsoft groups those
capabilities into three ideas,
347
00:09:14,529 --> 00:09:17,090
which are more visibility, more
control, and less effort.
348
00:09:17,090 --> 00:09:18,490
In practice, that means usage
349
00:09:18,490 --> 00:09:19,649
reports that show which apps
350
00:09:19,649 --> 00:09:21,250
people actually open and sharing
351
00:09:21,250 --> 00:09:21,769
limits.
352
00:09:21,769 --> 00:09:24,490
So a maker can't send an app to
the entire company.
353
00:09:24,490 --> 00:09:27,570
It also means solution checking
before a change goes live, and
354
00:09:27,570 --> 00:09:30,450
extended backups that stretch
from seven days to twenty eight.
355
00:09:30,450 --> 00:09:31,610
None of this is something a
356
00:09:31,610 --> 00:09:32,850
beginner switches on, and that's
357
00:09:32,850 --> 00:09:33,570
fine.
358
00:09:33,570 --> 00:09:36,049
The reason it matters is simpler
than the feature list, because
359
00:09:36,049 --> 00:09:38,850
it explains why a setting you
expect it to change is locked.
360
00:09:38,850 --> 00:09:41,690
If an environment is managed and
a rule covers that setting.
361
00:09:41,690 --> 00:09:44,169
The answer is that someone at
the group level owns it now.
362
00:09:44,169 --> 00:09:45,570
Managed environments also let an
363
00:09:45,570 --> 00:09:46,809
admin root new makers into a
364
00:09:46,809 --> 00:09:48,049
personal environment and govern
365
00:09:48,049 --> 00:09:49,009
it automatically.
366
00:09:49,009 --> 00:09:51,629
That's how a company scales from
a handful of environments to
367
00:09:51,629 --> 00:09:53,950
hundreds without losing control
of any of them.
368
00:09:53,950 --> 00:09:54,870
Moving work safely.
369
00:09:54,870 --> 00:09:58,070
Arm and solutions environments
hold your work, but work still
370
00:09:58,070 --> 00:09:58,629
has to move.
371
00:09:58,629 --> 00:10:01,110
And that movement is where
things get interesting.
372
00:10:01,110 --> 00:10:02,429
The practice of managing an app
373
00:10:02,429 --> 00:10:03,549
through development, then
374
00:10:03,549 --> 00:10:05,149
testing, then production is
375
00:10:05,149 --> 00:10:06,590
called application lifecycle
376
00:10:06,590 --> 00:10:09,029
management or ARM environments
377
00:10:09,029 --> 00:10:09,950
are the containers in this
378
00:10:09,950 --> 00:10:11,549
picture and solutions are the
379
00:10:11,549 --> 00:10:11,909
boxes.
380
00:10:11,909 --> 00:10:13,230
You move the pieces in.
381
00:10:13,230 --> 00:10:14,509
A solution packages your apps
382
00:10:14,509 --> 00:10:15,750
and components so they can
383
00:10:15,750 --> 00:10:17,090
travel from one environment to
384
00:10:17,090 --> 00:10:17,710
another.
385
00:10:17,710 --> 00:10:19,070
Here's the detail that matters.
386
00:10:19,070 --> 00:10:20,350
A solution carries the structure
387
00:10:20,350 --> 00:10:21,590
of your app and not your
388
00:10:21,590 --> 00:10:23,110
business data, so your records
389
00:10:23,110 --> 00:10:24,070
stay behind in their own
390
00:10:24,070 --> 00:10:25,230
environment.
391
00:10:25,230 --> 00:10:26,470
Solutions come in two flavors
392
00:10:26,470 --> 00:10:27,509
and the names are almost too
393
00:10:27,509 --> 00:10:28,110
simple.
394
00:10:28,110 --> 00:10:30,509
You edit an unmanaged solution
while you're building and it
395
00:10:30,509 --> 00:10:32,110
lives in your development space.
396
00:10:32,110 --> 00:10:33,389
You ship a managed solution, and
397
00:10:33,389 --> 00:10:34,470
that's the version that belongs
398
00:10:34,470 --> 00:10:35,950
in a test, acceptance or
399
00:10:35,950 --> 00:10:36,909
production environment.
400
00:10:36,909 --> 00:10:39,549
Microsoft's guidance is that
production should hold managed
401
00:10:39,549 --> 00:10:43,149
solutions, ideally ones built by
an automated process rather than
402
00:10:43,149 --> 00:10:44,309
assembled by hand.
403
00:10:44,309 --> 00:10:46,309
The flow, then, is short and
repeatable.
404
00:10:46,309 --> 00:10:48,909
You build in a development or
sandbox environment, you test
405
00:10:48,909 --> 00:10:52,080
the change and you promote a
managed solution to production.
406
00:10:52,080 --> 00:10:54,799
Nobody edits the live app
directly, which is exactly how
407
00:10:54,799 --> 00:10:57,080
you avoid breaking the thing
people depend on.
408
00:10:57,080 --> 00:10:59,960
Managed solutions also behave
well when it's time to update.
409
00:10:59,960 --> 00:11:03,120
You can upgrade or remove one
cleanly without dragging down
410
00:11:03,120 --> 00:11:05,559
the other solutions that share
the same environment.
411
00:11:05,559 --> 00:11:06,720
That's exactly what you want.
412
00:11:06,720 --> 00:11:10,120
When several teams ship side by
side, two ideas sit underneath
413
00:11:10,120 --> 00:11:10,720
all of this.
414
00:11:10,720 --> 00:11:13,679
The first is source control,
where each solution source code
415
00:11:13,679 --> 00:11:16,759
is stored and tracked so changes
can be reviewed and undone.
416
00:11:16,759 --> 00:11:19,559
The second is pipelines, a power
platform feature that gives
417
00:11:19,559 --> 00:11:22,360
makers a simple path to push an
app from development to test,
418
00:11:22,360 --> 00:11:23,639
and then to production.
419
00:11:23,639 --> 00:11:25,100
That removes the need to hand
420
00:11:25,100 --> 00:11:25,919
carry files between
421
00:11:25,919 --> 00:11:28,200
environments, data, policies,
422
00:11:28,200 --> 00:11:29,320
the guardrails.
423
00:11:29,320 --> 00:11:31,799
There's one more layer, and this
one keeps data from leaking
424
00:11:31,799 --> 00:11:32,759
where it shouldn't.
425
00:11:32,759 --> 00:11:34,279
A data policy is a guardrail
426
00:11:34,279 --> 00:11:35,759
that lowers the risk of someone
427
00:11:35,759 --> 00:11:37,120
accidentally exposing company
428
00:11:37,120 --> 00:11:38,399
data, and it works by
429
00:11:38,399 --> 00:11:39,679
controlling connectors.
430
00:11:39,679 --> 00:11:42,279
A connector is the bridge your
app uses to reach another
431
00:11:42,279 --> 00:11:45,279
service, like SharePoint,
outlook or teams.
432
00:11:45,279 --> 00:11:48,360
A data policy source connectors
into three groups business,
433
00:11:48,360 --> 00:11:51,820
non-business and blocked and the
rule underneath is elegant.
434
00:11:51,820 --> 00:11:55,100
Connectors in the same group can
share data and connectors in
435
00:11:55,100 --> 00:11:56,299
different groups can't.
436
00:11:56,299 --> 00:11:58,580
That's what stops a personal
account from quietly pulling
437
00:11:58,580 --> 00:11:59,980
from a business system.
438
00:11:59,980 --> 00:12:01,259
Some connectors can't be blocked
439
00:12:01,259 --> 00:12:02,659
at all because too much depends
440
00:12:02,659 --> 00:12:03,299
on them.
441
00:12:03,299 --> 00:12:06,500
Data versus one and so are
SharePoint, outlook and teams.
442
00:12:06,500 --> 00:12:08,860
A policy change also isn't
instant since it has to reach
443
00:12:08,860 --> 00:12:11,340
every environment and every
resource inside them.
444
00:12:11,340 --> 00:12:13,779
In most cases, it takes effect
within the hour, and in the
445
00:12:13,779 --> 00:12:16,299
heaviest cases, it can take up
to a day.
446
00:12:16,299 --> 00:12:17,500
The default setting matters too.
447
00:12:17,500 --> 00:12:18,620
When an admin creates a new
448
00:12:18,620 --> 00:12:19,940
policy, every connector starts
449
00:12:19,940 --> 00:12:21,059
out in the non-business group
450
00:12:21,059 --> 00:12:22,220
and they move the ones that
451
00:12:22,220 --> 00:12:23,019
belong elsewhere.
452
00:12:23,019 --> 00:12:25,419
That default is deliberate,
because it's safer to loosen a
453
00:12:25,419 --> 00:12:27,779
rule on purpose than to discover
one was never tight.
454
00:12:27,779 --> 00:12:29,100
A data policy bites in two
455
00:12:29,100 --> 00:12:31,139
different places at design time,
456
00:12:31,139 --> 00:12:32,580
when someone is building a
457
00:12:32,580 --> 00:12:33,779
blocked connector, simply can't
458
00:12:33,779 --> 00:12:35,539
be saved into a new app or flow
459
00:12:35,539 --> 00:12:36,259
at runtime.
460
00:12:36,259 --> 00:12:37,700
When an app is running or a flow
461
00:12:37,700 --> 00:12:39,340
fires on a schedule, a blocked
462
00:12:39,340 --> 00:12:40,379
connection fails.
463
00:12:40,379 --> 00:12:43,220
It shows up as a broken step
that needs attention.
464
00:12:43,220 --> 00:12:46,179
A policy change can even suspend
or quarantine a resource that
465
00:12:46,179 --> 00:12:49,039
breaks the rules, which is why
admins think twice before
466
00:12:49,039 --> 00:12:50,139
flipping a switch.
467
00:12:50,139 --> 00:12:52,830
You don't set these up as a
beginner and you don't need to.
468
00:12:52,830 --> 00:12:56,110
What matters is knowing they
exist because they explain why a
469
00:12:56,110 --> 00:12:59,629
connector that worked yesterday
can be blocked today.
470
00:12:59,629 --> 00:13:01,029
How to tell where you are.
471
00:13:01,029 --> 00:13:03,509
All of this sounds like a lot,
so let's make it practical.
472
00:13:03,509 --> 00:13:04,990
If you're an admin, the full
473
00:13:04,990 --> 00:13:06,509
list lives in the Power Platform
474
00:13:06,509 --> 00:13:08,370
Admin Center under Manage then
475
00:13:08,370 --> 00:13:09,110
Environments.
476
00:13:09,110 --> 00:13:11,990
Each one shows its type, its
region, and its current state.
477
00:13:11,990 --> 00:13:14,389
If you're a maker, know the name
of the environment you're in
478
00:13:14,389 --> 00:13:17,389
before you start building, that
name tells you its purpose.
479
00:13:17,389 --> 00:13:20,070
Many organizations now use
environment routing, which
480
00:13:20,070 --> 00:13:22,549
quietly gives each maker their
own personal developer
481
00:13:22,549 --> 00:13:25,509
environment instead of letting
everyone pile into the default.
482
00:13:25,509 --> 00:13:27,950
That's a good thing because it
means your first app lands in a
483
00:13:27,950 --> 00:13:30,629
space that's yours and not in
the shared room the whole
484
00:13:30,629 --> 00:13:31,909
company can see.
485
00:13:31,909 --> 00:13:33,210
When in doubt, ask which
486
00:13:33,210 --> 00:13:34,429
environment is meant for your
487
00:13:34,429 --> 00:13:36,070
work because guessing is how
488
00:13:36,070 --> 00:13:37,190
projects end up in the wrong
489
00:13:37,190 --> 00:13:37,789
place.
490
00:13:38,950 --> 00:13:40,750
Best practices in plain words.
491
00:13:40,750 --> 00:13:43,549
Let me pull this into a few
habits you can actually use.
492
00:13:43,549 --> 00:13:45,990
The biggest one is to stop
treating the default environment
493
00:13:45,990 --> 00:13:47,509
as your production home.
494
00:13:47,509 --> 00:13:48,669
Rename it until its name says
495
00:13:48,669 --> 00:13:50,210
what it is and keep it for quick
496
00:13:50,210 --> 00:13:51,769
personal experiments.
497
00:13:51,769 --> 00:13:53,289
From there, build in your own
498
00:13:53,289 --> 00:13:55,210
developer or sandbox environment
499
00:13:55,210 --> 00:13:56,210
and ship to a production
500
00:13:56,210 --> 00:13:57,490
environment that people depend
501
00:13:57,490 --> 00:13:57,970
on.
502
00:13:57,970 --> 00:14:01,009
Keep your sandbox for testing so
you never test something risky
503
00:14:01,009 --> 00:14:02,250
against live data.
504
00:14:02,250 --> 00:14:03,970
Keep the tenant tidy as well by
505
00:14:03,970 --> 00:14:05,289
deleting the apps, flows, and
506
00:14:05,289 --> 00:14:06,929
environments you no longer use,
507
00:14:06,929 --> 00:14:08,370
and by sharing carefully rather
508
00:14:08,370 --> 00:14:09,370
than broadly.
509
00:14:09,370 --> 00:14:10,529
A clean tenant is easier for
510
00:14:10,529 --> 00:14:12,009
everyone to trust, including
511
00:14:12,009 --> 00:14:12,529
you.
512
00:14:12,529 --> 00:14:15,409
There's also a habit that pays
off for everyone around you.
513
00:14:15,409 --> 00:14:17,610
Tell people which environment
you built in and why.
514
00:14:17,610 --> 00:14:20,049
A strategy nobody understands
looks like a restriction, and a
515
00:14:20,049 --> 00:14:22,409
restriction people resent is one
they'll work around.
516
00:14:22,409 --> 00:14:24,610
None of these habits require you
to be an admin.
517
00:14:24,610 --> 00:14:25,649
They just keep your work from
518
00:14:25,649 --> 00:14:26,970
becoming someone else's clean up
519
00:14:26,970 --> 00:14:27,450
job.
520
00:14:27,450 --> 00:14:30,289
An environment is a container
for your apps, your flows, your
521
00:14:30,289 --> 00:14:32,289
data, and your connections.
522
00:14:32,289 --> 00:14:34,610
Everyone holds at most a single
database.
523
00:14:34,610 --> 00:14:37,690
The type you choose sets its
purpose and roles, groups and
524
00:14:37,690 --> 00:14:38,690
policies keep it safe.
525
00:14:38,690 --> 00:14:39,889
Here's my question for you.
526
00:14:39,889 --> 00:14:42,669
The next time you open power
platform, will you know which
527
00:14:42,669 --> 00:14:45,409
environment you're building in
and whether it's the right one?
528
00:14:45,409 --> 00:14:48,330
Subscribe to M365 FM to master
the tools and the mindset
529
00:14:48,330 --> 00:14:49,730
shaping the future of work.
00:00:00,040 --> 00:00:02,480
Your tenant gets one default
environment and every licensed
2
00:00:02,480 --> 00:00:03,839
user can build inside it.
3
00:00:03,839 --> 00:00:06,040
That is also the environment
Microsoft says not to run
4
00:00:06,040 --> 00:00:07,120
production work in.
5
00:00:07,120 --> 00:00:10,480
Welcome to the M365 FM podcast,
where we explore the people,
6
00:00:10,480 --> 00:00:12,720
ideas, and technologies shaping
the future of work.
7
00:00:12,720 --> 00:00:15,560
Today we're talking about power
platform environments and why
8
00:00:15,560 --> 00:00:18,280
the container you build in
decides what your app can do.
9
00:00:18,280 --> 00:00:20,940
Each environment keeps its own
data, and apps can't reach
10
00:00:20,940 --> 00:00:21,719
across that line.
11
00:00:21,719 --> 00:00:23,019
By the end, you'll know which
12
00:00:23,019 --> 00:00:24,399
environment to reach for and
13
00:00:24,399 --> 00:00:25,640
why.
14
00:00:25,640 --> 00:00:27,719
What an environment actually is.
15
00:00:27,719 --> 00:00:29,199
A power platform environment is
16
00:00:29,199 --> 00:00:30,199
a space where your business
17
00:00:30,199 --> 00:00:31,579
data, your apps, your chatbots
18
00:00:31,579 --> 00:00:32,740
and your flows all live
19
00:00:32,740 --> 00:00:33,479
together.
20
00:00:33,479 --> 00:00:34,600
Microsoft built it as a
21
00:00:34,600 --> 00:00:35,840
container, and the job of a
22
00:00:35,840 --> 00:00:36,960
container is to keep things
23
00:00:36,960 --> 00:00:38,259
apart that don't belong
24
00:00:38,259 --> 00:00:38,960
together.
25
00:00:38,960 --> 00:00:40,280
Everything you create inside it,
26
00:00:40,280 --> 00:00:41,799
from a simple canvas app to an
27
00:00:41,799 --> 00:00:43,679
automated flow, stays attached
28
00:00:43,679 --> 00:00:44,960
to that environment for its
29
00:00:44,960 --> 00:00:45,399
whole life.
30
00:00:45,399 --> 00:00:47,479
Think about how your company
stores documents.
31
00:00:47,479 --> 00:00:50,359
You wouldn't throw every file
from every team into one shared
32
00:00:50,359 --> 00:00:52,920
folder and hand the whole
company the same key.
33
00:00:52,920 --> 00:00:54,520
Yet that's exactly what a single
34
00:00:54,520 --> 00:00:56,119
shared workspace does to your
35
00:00:56,119 --> 00:00:56,679
apps.
36
00:00:56,679 --> 00:00:58,159
An environment exists, so you
37
00:00:58,159 --> 00:00:59,679
never have to work that way, and
38
00:00:59,679 --> 00:01:00,929
it separates apps that have
39
00:01:00,929 --> 00:01:01,929
different roles, different
40
00:01:01,929 --> 00:01:03,490
security needs, or different
41
00:01:03,490 --> 00:01:04,329
audiences.
42
00:01:04,329 --> 00:01:06,090
This matters more as a company
grows.
43
00:01:06,090 --> 00:01:09,209
One shared space works fine for
a handful of small tools, and
44
00:01:09,209 --> 00:01:10,010
then it doesn't.
45
00:01:10,010 --> 00:01:11,890
A change for one team can ripple
into another.
46
00:01:11,890 --> 00:01:13,250
Team's work environments give
47
00:01:13,250 --> 00:01:14,370
you a way to keep those worlds
48
00:01:14,370 --> 00:01:15,969
separate on purpose, so a small
49
00:01:15,969 --> 00:01:17,370
experiment in one corner won't
50
00:01:17,370 --> 00:01:18,450
quietly break something in
51
00:01:18,450 --> 00:01:18,849
another.
52
00:01:18,849 --> 00:01:21,530
You can see the idea in how
teams actually use them.
53
00:01:21,530 --> 00:01:22,769
One organization gives each
54
00:01:22,769 --> 00:01:24,370
department its own environment,
55
00:01:24,370 --> 00:01:25,849
so marketing's data never mixes
56
00:01:25,849 --> 00:01:26,769
with finances.
57
00:01:26,769 --> 00:01:28,769
Another runs a production
environment for the apps
58
00:01:28,769 --> 00:01:31,409
everyone uses, with a sandbox
sitting beside it for the
59
00:01:31,409 --> 00:01:33,010
changes nobody should see yet.
60
00:01:33,010 --> 00:01:34,489
Microsoft even suggests separate
61
00:01:34,489 --> 00:01:35,409
environments for different
62
00:01:35,409 --> 00:01:36,930
global branches of a company,
63
00:01:36,930 --> 00:01:38,170
which tells you how central this
64
00:01:38,170 --> 00:01:38,650
idea is.
65
00:01:38,650 --> 00:01:39,969
Every environment also sits
66
00:01:39,969 --> 00:01:41,409
inside your Microsoft Entra
67
00:01:41,409 --> 00:01:42,689
Tenant, which is the directory
68
00:01:42,689 --> 00:01:44,090
that holds your company's users
69
00:01:44,090 --> 00:01:44,890
and groups.
70
00:01:44,890 --> 00:01:46,489
Only people inside that tenant
71
00:01:46,489 --> 00:01:47,609
can reach the environment's
72
00:01:47,609 --> 00:01:49,329
resources, so an outsider can't
73
00:01:49,329 --> 00:01:50,010
wander in.
74
00:01:50,010 --> 00:01:52,569
The environment is bound to a
region, to anything you build
75
00:01:52,569 --> 00:01:55,450
there, including connections,
gateways, and flows, runs in
76
00:01:55,450 --> 00:01:57,209
data centers near that location.
77
00:01:57,209 --> 00:02:00,109
There's one rule that catches
almost everyone An app can only
78
00:02:00,109 --> 00:02:02,750
connect to data sources that
live in the same environment.
79
00:02:02,750 --> 00:02:05,069
If you build an app in one
environment and the data sits in
80
00:02:05,069 --> 00:02:06,430
another, the app can't see it.
81
00:02:06,430 --> 00:02:07,989
No matter how correct your logic
looks.
82
00:02:07,989 --> 00:02:11,229
That single restriction explains
a lot of beginner frustration.
83
00:02:11,229 --> 00:02:13,710
A broken connection often looks
like a bug when it's really a
84
00:02:13,710 --> 00:02:14,710
boundary doing its job.
85
00:02:14,710 --> 00:02:16,909
It's a real boundary that
decides where your app lives and
86
00:02:16,909 --> 00:02:17,550
what it can reach.
87
00:02:17,550 --> 00:02:20,349
And it isn't a label you attach
to a project at the end.
88
00:02:20,349 --> 00:02:22,069
Once that idea clicks, the rest
89
00:02:22,069 --> 00:02:23,550
of power platform starts to feel
90
00:02:23,550 --> 00:02:24,590
less random.
91
00:02:24,590 --> 00:02:26,610
The next question is which kind
of environment you should
92
00:02:26,610 --> 00:02:27,949
actually be in.
93
00:02:27,949 --> 00:02:30,949
The environment types in plain
words, environments come in a
94
00:02:30,949 --> 00:02:33,270
few types and the type tells you
what the space is for.
95
00:02:33,270 --> 00:02:35,629
You don't need to memorize the
whole list, because you only
96
00:02:35,629 --> 00:02:37,590
need to recognize which one
you're standing in.
97
00:02:37,590 --> 00:02:40,069
By the end of this section,
you'll be able to name it.
98
00:02:40,069 --> 00:02:42,270
The first one you meet is the
default environment.
99
00:02:42,270 --> 00:02:43,710
Every tenant gets exactly one.
100
00:02:43,710 --> 00:02:46,310
Microsoft creates it for you,
and anyone with a license can
101
00:02:46,310 --> 00:02:48,729
start building their new users
are dropped straight into the
102
00:02:48,729 --> 00:02:51,189
maker role, so they can start
creating apps on day one.
103
00:02:51,189 --> 00:02:53,430
That's why the default feels
welcoming, and it's also why it
104
00:02:53,430 --> 00:02:55,990
fills up so fast that
convenience has a cost.
105
00:02:55,990 --> 00:02:58,520
The default environment is
shared with your whole company.
106
00:02:58,520 --> 00:02:59,919
It can't be deleted, and
107
00:02:59,919 --> 00:03:01,360
Microsoft gives it no backup
108
00:03:01,360 --> 00:03:02,039
guarantees.
109
00:03:02,039 --> 00:03:03,319
It's meant for experiments and
110
00:03:03,319 --> 00:03:05,039
small personal tools, not for
111
00:03:05,039 --> 00:03:06,199
the apps your business depends
112
00:03:06,199 --> 00:03:06,680
on.
113
00:03:06,680 --> 00:03:09,199
It also has a ceiling of one
terabyte, and it opens with a
114
00:03:09,199 --> 00:03:11,439
small slice of that spread
across its database.
115
00:03:11,439 --> 00:03:12,879
Its files and its logs.
116
00:03:12,879 --> 00:03:14,680
Remember that shared no backup
117
00:03:14,680 --> 00:03:16,080
default because it comes back in
118
00:03:16,080 --> 00:03:17,159
the habits we'll cover at the
119
00:03:17,159 --> 00:03:18,159
end.
120
00:03:18,159 --> 00:03:19,759
Production is the opposite, and
121
00:03:19,759 --> 00:03:21,000
it's the environment you depend
122
00:03:21,000 --> 00:03:21,439
on.
123
00:03:21,439 --> 00:03:24,300
Permanent work lives there, and
the apps people use every day
124
00:03:24,300 --> 00:03:25,199
should run there.
125
00:03:25,199 --> 00:03:26,599
If something has to stay up, it
126
00:03:26,599 --> 00:03:27,479
belongs in a production
127
00:03:27,479 --> 00:03:28,319
environment.
128
00:03:28,319 --> 00:03:30,240
Sandbox environments are the
safe rooms.
129
00:03:30,240 --> 00:03:33,520
A sandbox is any non-production
environment, and it comes with
130
00:03:33,520 --> 00:03:36,280
abilities that would be reckless
in production, like resetting,
131
00:03:36,280 --> 00:03:37,639
copying and deleting.
132
00:03:37,639 --> 00:03:39,639
That's the point, because you
want to break things in a
133
00:03:39,639 --> 00:03:41,599
sandbox and never in production.
134
00:03:41,599 --> 00:03:43,520
Developer environments are
personal.
135
00:03:43,520 --> 00:03:44,879
A developer environment belongs
136
00:03:44,879 --> 00:03:46,400
to one person, and it's meant
137
00:03:46,400 --> 00:03:47,680
for building and testing rather
138
00:03:47,680 --> 00:03:48,759
than for running or sharing
139
00:03:48,759 --> 00:03:49,800
production apps.
140
00:03:49,800 --> 00:03:51,280
Each user can have one managed
141
00:03:51,280 --> 00:03:52,639
developer environment, and it
142
00:03:52,639 --> 00:03:53,560
doesn't count against your
143
00:03:53,560 --> 00:03:54,520
company's capacity.
144
00:03:54,520 --> 00:03:56,900
If you're learning the platform,
this is the space that's yours
145
00:03:56,900 --> 00:03:57,860
to mess up.
146
00:03:57,860 --> 00:03:59,219
Trial environments are short
lived.
147
00:03:59,219 --> 00:04:00,259
You get one per user.
148
00:04:00,259 --> 00:04:02,599
It's built for quick tests and
proofs of concept, and it
149
00:04:02,599 --> 00:04:04,099
expires after thirty days.
150
00:04:04,099 --> 00:04:05,419
When it's gone, it's gone.
151
00:04:05,419 --> 00:04:07,219
So don't park anything important
there.
152
00:04:07,219 --> 00:04:08,300
One thing is worth knowing in
153
00:04:08,300 --> 00:04:09,840
plain words, the older kind of
154
00:04:09,840 --> 00:04:11,020
developer environment called
155
00:04:11,020 --> 00:04:12,659
unmanaged is being retired and
156
00:04:12,659 --> 00:04:14,099
so is the Dataverse for teams
157
00:04:14,099 --> 00:04:14,819
environment.
158
00:04:14,819 --> 00:04:16,500
The developer type still exists,
159
00:04:16,500 --> 00:04:17,860
but it now means a managed
160
00:04:17,860 --> 00:04:18,860
developer environment.
161
00:04:18,860 --> 00:04:20,139
There's no need to panic about
that.
162
00:04:20,139 --> 00:04:21,980
And you do need to know the
names have shifted.
163
00:04:21,980 --> 00:04:23,939
Not every type is open to
everyone either.
164
00:04:23,939 --> 00:04:25,220
An admin can restrict who is
165
00:04:25,220 --> 00:04:27,060
allowed to create sandbox trial
166
00:04:27,060 --> 00:04:28,620
and developer environments, so
167
00:04:28,620 --> 00:04:29,720
the choice isn't always yours to
168
00:04:29,720 --> 00:04:30,339
make.
169
00:04:30,339 --> 00:04:33,019
If a button is grayed out,
that's usually why the names
170
00:04:33,019 --> 00:04:35,100
matter less than the purpose
behind each one.
171
00:04:35,100 --> 00:04:37,220
You pick a default to
experiment, a developer
172
00:04:37,220 --> 00:04:40,500
environment to build in private,
a sandbox to test changes, and a
173
00:04:40,500 --> 00:04:42,939
production environment to serve
the people who depend on you.
174
00:04:42,939 --> 00:04:44,379
That's the whole decision, and
175
00:04:44,379 --> 00:04:45,459
it's smaller than it first
176
00:04:45,459 --> 00:04:46,500
looks.
177
00:04:46,500 --> 00:04:48,899
Dataverse one database per
environment.
178
00:04:48,899 --> 00:04:50,060
Every environment can have a
179
00:04:50,060 --> 00:04:51,300
database, and that database is
180
00:04:51,300 --> 00:04:52,500
called Dataverse.
181
00:04:52,500 --> 00:04:54,100
The rule around it surprises
people.
182
00:04:54,100 --> 00:04:56,545
An environment can hold a single
Dataverse database or no
183
00:04:56,545 --> 00:04:58,949
database at all, and it can
never hold two.
184
00:04:58,949 --> 00:04:59,550
That's the ceiling.
185
00:04:59,550 --> 00:05:00,470
And there's no version of the
186
00:05:00,470 --> 00:05:01,589
setup where you get a second
187
00:05:01,589 --> 00:05:02,189
one.
188
00:05:02,189 --> 00:05:03,790
Because of that rule, your data
189
00:05:03,790 --> 00:05:05,310
doesn't quietly flow between
190
00:05:05,310 --> 00:05:06,269
environments.
191
00:05:06,269 --> 00:05:07,709
Each one keeps its own database.
192
00:05:07,709 --> 00:05:10,310
So a copy of an environment can
exist for testing without ever
193
00:05:10,310 --> 00:05:11,670
touching the real records.
194
00:05:11,670 --> 00:05:13,750
Microsoft even lets you copy a
sandbox.
195
00:05:13,750 --> 00:05:16,629
That way, you can try a change
against realistic data before it
196
00:05:16,629 --> 00:05:18,829
goes anywhere near a live app.
197
00:05:18,829 --> 00:05:21,189
Dataverse is also where your
structure lives, meaning your
198
00:05:21,189 --> 00:05:23,829
tables, your columns, and the
relationships between them.
199
00:05:23,829 --> 00:05:25,089
When you build a model driven
200
00:05:25,089 --> 00:05:26,269
app, that structure is the
201
00:05:26,269 --> 00:05:26,990
backbone.
202
00:05:26,990 --> 00:05:28,069
The app runs on.
203
00:05:28,069 --> 00:05:30,269
That's why Dataverse and
environments get talked about
204
00:05:30,269 --> 00:05:31,509
together so often.
205
00:05:31,509 --> 00:05:34,670
A canvas app can reach plenty of
other data sources, and a model
206
00:05:34,670 --> 00:05:37,230
driven app leans hard on
Dataverse for its shape.
207
00:05:37,230 --> 00:05:38,629
So think of Dataverse as the
208
00:05:38,629 --> 00:05:40,050
filing cabinet that belongs to
209
00:05:40,050 --> 00:05:40,670
one room.
210
00:05:40,670 --> 00:05:43,649
It holds the records for that
room and nothing else, and it
211
00:05:43,649 --> 00:05:45,589
stays behind when you walk into
a different one.
212
00:05:45,589 --> 00:05:46,889
That picture is simple, and it's
213
00:05:46,889 --> 00:05:47,949
accurate enough to keep you out
214
00:05:47,949 --> 00:05:48,949
of trouble.
215
00:05:48,949 --> 00:05:50,910
Who gets in and what they can
touch.
216
00:05:50,910 --> 00:05:51,949
Environments have built in
217
00:05:51,949 --> 00:05:53,269
roles, and the two you'll hear
218
00:05:53,269 --> 00:05:54,829
most are environment admin and
219
00:05:54,829 --> 00:05:56,000
environment maker and
220
00:05:56,000 --> 00:05:57,209
environment admin runs the
221
00:05:57,209 --> 00:05:58,649
environment, can create its
222
00:05:58,649 --> 00:05:59,649
database and sets the
223
00:05:59,649 --> 00:06:00,490
guardrails.
224
00:06:00,490 --> 00:06:01,870
An environment maker can create
225
00:06:01,870 --> 00:06:03,790
apps, connections and flows, but
226
00:06:03,790 --> 00:06:05,089
has no rights to the data
227
00:06:05,089 --> 00:06:06,370
itself.
228
00:06:06,370 --> 00:06:07,730
That last part confuses people,
229
00:06:07,730 --> 00:06:08,610
so it's worth saying in a
230
00:06:08,610 --> 00:06:09,410
different way.
231
00:06:09,410 --> 00:06:10,569
Being allowed to build in an
232
00:06:10,569 --> 00:06:11,769
environment isn't the same as
233
00:06:11,769 --> 00:06:13,370
being allowed to read its data,
234
00:06:13,370 --> 00:06:14,649
and those are two separate
235
00:06:14,649 --> 00:06:15,290
doors.
236
00:06:15,290 --> 00:06:17,769
You can hold the key to the
workshop and still not hold the
237
00:06:17,769 --> 00:06:19,209
key to the filing cabinet.
238
00:06:19,209 --> 00:06:20,129
Here's how that plays out.
239
00:06:20,129 --> 00:06:21,290
In practice, you might be able
240
00:06:21,290 --> 00:06:22,649
to open an app in the maker
241
00:06:22,649 --> 00:06:24,250
portal and still see empty
242
00:06:24,250 --> 00:06:25,129
screens.
243
00:06:25,129 --> 00:06:27,490
The app is fine, and you're
simply missing a security role
244
00:06:27,490 --> 00:06:28,610
on the data side.
245
00:06:28,610 --> 00:06:30,129
That mismatch is common, and
246
00:06:30,129 --> 00:06:31,370
it's the single biggest source
247
00:06:31,370 --> 00:06:31,970
of it.
248
00:06:31,970 --> 00:06:33,529
Works for my colleague, but not
for me.
249
00:06:33,529 --> 00:06:34,370
Confusion.
250
00:06:34,370 --> 00:06:36,889
The rules also shift depending
on whether the environment has a
251
00:06:36,889 --> 00:06:38,449
database without one.
252
00:06:38,449 --> 00:06:41,050
Environment, admin and
environment maker are the only
253
00:06:41,050 --> 00:06:42,930
two roles that matter with one.
254
00:06:42,930 --> 00:06:45,290
The system administrator role
takes the top spot.
255
00:06:45,290 --> 00:06:47,930
The list of predefined roles
grows to include names like
256
00:06:47,930 --> 00:06:50,769
basic User and System
Customizer, along with app
257
00:06:50,769 --> 00:06:53,889
specific roles that arrive when
you add a product like dynamics
258
00:06:53,889 --> 00:06:55,050
three hundred sixty five.
259
00:06:55,050 --> 00:06:56,220
There are also bigger roles that
260
00:06:56,220 --> 00:06:57,220
live above any single
261
00:06:57,220 --> 00:06:57,860
environment.
262
00:06:57,860 --> 00:07:00,980
Tenant level admins like the
Power Platform administrator or
263
00:07:00,980 --> 00:07:03,620
the global administrator manage
the whole tenant.
264
00:07:03,620 --> 00:07:04,800
They don't automatically get
265
00:07:04,800 --> 00:07:06,180
access to the data inside a
266
00:07:06,180 --> 00:07:07,180
given environment.
267
00:07:07,180 --> 00:07:08,860
In an environment with a
database.
268
00:07:08,860 --> 00:07:12,019
Full admin access comes from the
system administrator role, not
269
00:07:12,019 --> 00:07:13,379
from being a tenant admin.
270
00:07:13,379 --> 00:07:16,620
That surprises a lot of people
and it's there on purpose.
271
00:07:16,620 --> 00:07:17,899
Then the Dataverse security
272
00:07:17,899 --> 00:07:19,259
roles decide what a person can
273
00:07:19,259 --> 00:07:20,339
see and change once they're
274
00:07:20,339 --> 00:07:21,220
inside.
275
00:07:21,220 --> 00:07:22,579
Names like System Administrator,
276
00:07:22,579 --> 00:07:23,959
System Customizer, and Basic
277
00:07:23,959 --> 00:07:25,339
User describe how much reach
278
00:07:25,339 --> 00:07:25,860
someone has.
279
00:07:25,860 --> 00:07:27,040
Microsoft's rule of thumb is to
280
00:07:27,040 --> 00:07:28,100
give each person the least
281
00:07:28,100 --> 00:07:29,220
access they need to do their
282
00:07:29,220 --> 00:07:29,699
job.
283
00:07:29,699 --> 00:07:30,920
A maker who needs to update
284
00:07:30,920 --> 00:07:32,620
tables usually needs the system
285
00:07:32,620 --> 00:07:34,180
customizer role on top of
286
00:07:34,180 --> 00:07:35,060
environment maker.
287
00:07:35,060 --> 00:07:38,180
That's why two roles are
sometimes required for one job.
288
00:07:38,180 --> 00:07:39,339
Finally, security groups and
289
00:07:39,339 --> 00:07:40,660
licenses decide who can even see
290
00:07:40,660 --> 00:07:41,660
an environment in the first
291
00:07:41,660 --> 00:07:41,939
place.
292
00:07:41,939 --> 00:07:44,139
That's why a colleague can work
at your company and still have
293
00:07:44,139 --> 00:07:45,300
no idea your app exists.
294
00:07:45,300 --> 00:07:49,100
Because access is granted on
purpose and never by accident.
295
00:07:49,100 --> 00:07:50,220
Environment groups.
296
00:07:50,220 --> 00:07:51,540
Folders for environments.
297
00:07:51,540 --> 00:07:54,139
As a company grows, the number
of environments can climb into
298
00:07:54,139 --> 00:07:57,240
the hundreds and managing them
one at a time stops working.
299
00:07:57,240 --> 00:07:58,319
Microsoft's answer is the
300
00:07:58,319 --> 00:07:59,680
environment Group, which it
301
00:07:59,680 --> 00:08:00,920
describes as a folder for your
302
00:08:00,920 --> 00:08:01,959
environments.
303
00:08:01,959 --> 00:08:02,959
A group collects related
304
00:08:02,959 --> 00:08:04,240
environments and applies the
305
00:08:04,240 --> 00:08:05,480
same rules to all of them at
306
00:08:05,480 --> 00:08:06,160
once.
307
00:08:06,160 --> 00:08:08,360
Only managed environments can
join a group.
308
00:08:08,360 --> 00:08:09,620
Each environment can belong to
309
00:08:09,620 --> 00:08:11,360
just one group, and groups can't
310
00:08:11,360 --> 00:08:13,019
overlap or nest inside each
311
00:08:13,019 --> 00:08:13,399
other.
312
00:08:13,399 --> 00:08:14,680
Those limits keep the structure
313
00:08:14,680 --> 00:08:16,079
predictable, which is the whole
314
00:08:16,079 --> 00:08:17,040
point when you're trying to
315
00:08:17,040 --> 00:08:18,240
bring order to a sprawling
316
00:08:18,240 --> 00:08:18,839
setup.
317
00:08:18,839 --> 00:08:21,279
The useful part is what a rule
actually does.
318
00:08:21,279 --> 00:08:23,839
When you publish a rule at the
group level, that's setting
319
00:08:23,839 --> 00:08:26,680
locks inside every member
environment, so a local admin
320
00:08:26,680 --> 00:08:27,639
can't quietly change it.
321
00:08:27,639 --> 00:08:30,240
Remove an environment from the
group and it keeps the last
322
00:08:30,240 --> 00:08:31,279
settings it received.
323
00:08:31,279 --> 00:08:32,379
Those settings unlock though,
324
00:08:32,379 --> 00:08:33,480
which lets someone manage it
325
00:08:33,480 --> 00:08:34,039
again.
326
00:08:34,039 --> 00:08:35,639
A group is also a natural home
327
00:08:35,639 --> 00:08:37,080
for similar spaces, and
328
00:08:37,080 --> 00:08:38,879
Microsoft's own examples show
329
00:08:38,879 --> 00:08:39,679
the range.
330
00:08:39,679 --> 00:08:42,100
One company keeps a personal
productivity group for every
331
00:08:42,100 --> 00:08:43,360
maker's private space.
332
00:08:43,360 --> 00:08:46,240
Another builds a copilot pilot
group, so AI features can be
333
00:08:46,240 --> 00:08:49,080
tested in sandboxes before
anyone touches production.
334
00:08:49,080 --> 00:08:52,080
A global business splits its
environments by region, so each
335
00:08:52,080 --> 00:08:53,809
one follows local rules.
336
00:08:53,809 --> 00:08:56,769
A careful team keeps a relaxed
development group beside a
337
00:08:56,769 --> 00:08:58,649
stricter production group.
338
00:08:58,649 --> 00:08:59,970
Managed environments.
339
00:08:59,970 --> 00:09:02,649
The premium switch groups and
rules only work on managed
340
00:09:02,649 --> 00:09:05,690
environments, so that phrase
deserves a plain explanation.
341
00:09:05,690 --> 00:09:06,970
An environment is either managed
342
00:09:06,970 --> 00:09:08,210
or it isn't, and turning the
343
00:09:08,210 --> 00:09:10,009
managed switch on unlocks a set
344
00:09:10,009 --> 00:09:11,570
of premium capabilities aimed at
345
00:09:11,570 --> 00:09:12,009
admins.
346
00:09:12,009 --> 00:09:14,529
Microsoft groups those
capabilities into three ideas,
347
00:09:14,529 --> 00:09:17,090
which are more visibility, more
control, and less effort.
348
00:09:17,090 --> 00:09:18,490
In practice, that means usage
349
00:09:18,490 --> 00:09:19,649
reports that show which apps
350
00:09:19,649 --> 00:09:21,250
people actually open and sharing
351
00:09:21,250 --> 00:09:21,769
limits.
352
00:09:21,769 --> 00:09:24,490
So a maker can't send an app to
the entire company.
353
00:09:24,490 --> 00:09:27,570
It also means solution checking
before a change goes live, and
354
00:09:27,570 --> 00:09:30,450
extended backups that stretch
from seven days to twenty eight.
355
00:09:30,450 --> 00:09:31,610
None of this is something a
356
00:09:31,610 --> 00:09:32,850
beginner switches on, and that's
357
00:09:32,850 --> 00:09:33,570
fine.
358
00:09:33,570 --> 00:09:36,049
The reason it matters is simpler
than the feature list, because
359
00:09:36,049 --> 00:09:38,850
it explains why a setting you
expect it to change is locked.
360
00:09:38,850 --> 00:09:41,690
If an environment is managed and
a rule covers that setting.
361
00:09:41,690 --> 00:09:44,169
The answer is that someone at
the group level owns it now.
362
00:09:44,169 --> 00:09:45,570
Managed environments also let an
363
00:09:45,570 --> 00:09:46,809
admin root new makers into a
364
00:09:46,809 --> 00:09:48,049
personal environment and govern
365
00:09:48,049 --> 00:09:49,009
it automatically.
366
00:09:49,009 --> 00:09:51,629
That's how a company scales from
a handful of environments to
367
00:09:51,629 --> 00:09:53,950
hundreds without losing control
of any of them.
368
00:09:53,950 --> 00:09:54,870
Moving work safely.
369
00:09:54,870 --> 00:09:58,070
Arm and solutions environments
hold your work, but work still
370
00:09:58,070 --> 00:09:58,629
has to move.
371
00:09:58,629 --> 00:10:01,110
And that movement is where
things get interesting.
372
00:10:01,110 --> 00:10:02,429
The practice of managing an app
373
00:10:02,429 --> 00:10:03,549
through development, then
374
00:10:03,549 --> 00:10:05,149
testing, then production is
375
00:10:05,149 --> 00:10:06,590
called application lifecycle
376
00:10:06,590 --> 00:10:09,029
management or ARM environments
377
00:10:09,029 --> 00:10:09,950
are the containers in this
378
00:10:09,950 --> 00:10:11,549
picture and solutions are the
379
00:10:11,549 --> 00:10:11,909
boxes.
380
00:10:11,909 --> 00:10:13,230
You move the pieces in.
381
00:10:13,230 --> 00:10:14,509
A solution packages your apps
382
00:10:14,509 --> 00:10:15,750
and components so they can
383
00:10:15,750 --> 00:10:17,090
travel from one environment to
384
00:10:17,090 --> 00:10:17,710
another.
385
00:10:17,710 --> 00:10:19,070
Here's the detail that matters.
386
00:10:19,070 --> 00:10:20,350
A solution carries the structure
387
00:10:20,350 --> 00:10:21,590
of your app and not your
388
00:10:21,590 --> 00:10:23,110
business data, so your records
389
00:10:23,110 --> 00:10:24,070
stay behind in their own
390
00:10:24,070 --> 00:10:25,230
environment.
391
00:10:25,230 --> 00:10:26,470
Solutions come in two flavors
392
00:10:26,470 --> 00:10:27,509
and the names are almost too
393
00:10:27,509 --> 00:10:28,110
simple.
394
00:10:28,110 --> 00:10:30,509
You edit an unmanaged solution
while you're building and it
395
00:10:30,509 --> 00:10:32,110
lives in your development space.
396
00:10:32,110 --> 00:10:33,389
You ship a managed solution, and
397
00:10:33,389 --> 00:10:34,470
that's the version that belongs
398
00:10:34,470 --> 00:10:35,950
in a test, acceptance or
399
00:10:35,950 --> 00:10:36,909
production environment.
400
00:10:36,909 --> 00:10:39,549
Microsoft's guidance is that
production should hold managed
401
00:10:39,549 --> 00:10:43,149
solutions, ideally ones built by
an automated process rather than
402
00:10:43,149 --> 00:10:44,309
assembled by hand.
403
00:10:44,309 --> 00:10:46,309
The flow, then, is short and
repeatable.
404
00:10:46,309 --> 00:10:48,909
You build in a development or
sandbox environment, you test
405
00:10:48,909 --> 00:10:52,080
the change and you promote a
managed solution to production.
406
00:10:52,080 --> 00:10:54,799
Nobody edits the live app
directly, which is exactly how
407
00:10:54,799 --> 00:10:57,080
you avoid breaking the thing
people depend on.
408
00:10:57,080 --> 00:10:59,960
Managed solutions also behave
well when it's time to update.
409
00:10:59,960 --> 00:11:03,120
You can upgrade or remove one
cleanly without dragging down
410
00:11:03,120 --> 00:11:05,559
the other solutions that share
the same environment.
411
00:11:05,559 --> 00:11:06,720
That's exactly what you want.
412
00:11:06,720 --> 00:11:10,120
When several teams ship side by
side, two ideas sit underneath
413
00:11:10,120 --> 00:11:10,720
all of this.
414
00:11:10,720 --> 00:11:13,679
The first is source control,
where each solution source code
415
00:11:13,679 --> 00:11:16,759
is stored and tracked so changes
can be reviewed and undone.
416
00:11:16,759 --> 00:11:19,559
The second is pipelines, a power
platform feature that gives
417
00:11:19,559 --> 00:11:22,360
makers a simple path to push an
app from development to test,
418
00:11:22,360 --> 00:11:23,639
and then to production.
419
00:11:23,639 --> 00:11:25,100
That removes the need to hand
420
00:11:25,100 --> 00:11:25,919
carry files between
421
00:11:25,919 --> 00:11:28,200
environments, data, policies,
422
00:11:28,200 --> 00:11:29,320
the guardrails.
423
00:11:29,320 --> 00:11:31,799
There's one more layer, and this
one keeps data from leaking
424
00:11:31,799 --> 00:11:32,759
where it shouldn't.
425
00:11:32,759 --> 00:11:34,279
A data policy is a guardrail
426
00:11:34,279 --> 00:11:35,759
that lowers the risk of someone
427
00:11:35,759 --> 00:11:37,120
accidentally exposing company
428
00:11:37,120 --> 00:11:38,399
data, and it works by
429
00:11:38,399 --> 00:11:39,679
controlling connectors.
430
00:11:39,679 --> 00:11:42,279
A connector is the bridge your
app uses to reach another
431
00:11:42,279 --> 00:11:45,279
service, like SharePoint,
outlook or teams.
432
00:11:45,279 --> 00:11:48,360
A data policy source connectors
into three groups business,
433
00:11:48,360 --> 00:11:51,820
non-business and blocked and the
rule underneath is elegant.
434
00:11:51,820 --> 00:11:55,100
Connectors in the same group can
share data and connectors in
435
00:11:55,100 --> 00:11:56,299
different groups can't.
436
00:11:56,299 --> 00:11:58,580
That's what stops a personal
account from quietly pulling
437
00:11:58,580 --> 00:11:59,980
from a business system.
438
00:11:59,980 --> 00:12:01,259
Some connectors can't be blocked
439
00:12:01,259 --> 00:12:02,659
at all because too much depends
440
00:12:02,659 --> 00:12:03,299
on them.
441
00:12:03,299 --> 00:12:06,500
Data versus one and so are
SharePoint, outlook and teams.
442
00:12:06,500 --> 00:12:08,860
A policy change also isn't
instant since it has to reach
443
00:12:08,860 --> 00:12:11,340
every environment and every
resource inside them.
444
00:12:11,340 --> 00:12:13,779
In most cases, it takes effect
within the hour, and in the
445
00:12:13,779 --> 00:12:16,299
heaviest cases, it can take up
to a day.
446
00:12:16,299 --> 00:12:17,500
The default setting matters too.
447
00:12:17,500 --> 00:12:18,620
When an admin creates a new
448
00:12:18,620 --> 00:12:19,940
policy, every connector starts
449
00:12:19,940 --> 00:12:21,059
out in the non-business group
450
00:12:21,059 --> 00:12:22,220
and they move the ones that
451
00:12:22,220 --> 00:12:23,019
belong elsewhere.
452
00:12:23,019 --> 00:12:25,419
That default is deliberate,
because it's safer to loosen a
453
00:12:25,419 --> 00:12:27,779
rule on purpose than to discover
one was never tight.
454
00:12:27,779 --> 00:12:29,100
A data policy bites in two
455
00:12:29,100 --> 00:12:31,139
different places at design time,
456
00:12:31,139 --> 00:12:32,580
when someone is building a
457
00:12:32,580 --> 00:12:33,779
blocked connector, simply can't
458
00:12:33,779 --> 00:12:35,539
be saved into a new app or flow
459
00:12:35,539 --> 00:12:36,259
at runtime.
460
00:12:36,259 --> 00:12:37,700
When an app is running or a flow
461
00:12:37,700 --> 00:12:39,340
fires on a schedule, a blocked
462
00:12:39,340 --> 00:12:40,379
connection fails.
463
00:12:40,379 --> 00:12:43,220
It shows up as a broken step
that needs attention.
464
00:12:43,220 --> 00:12:46,179
A policy change can even suspend
or quarantine a resource that
465
00:12:46,179 --> 00:12:49,039
breaks the rules, which is why
admins think twice before
466
00:12:49,039 --> 00:12:50,139
flipping a switch.
467
00:12:50,139 --> 00:12:52,830
You don't set these up as a
beginner and you don't need to.
468
00:12:52,830 --> 00:12:56,110
What matters is knowing they
exist because they explain why a
469
00:12:56,110 --> 00:12:59,629
connector that worked yesterday
can be blocked today.
470
00:12:59,629 --> 00:13:01,029
How to tell where you are.
471
00:13:01,029 --> 00:13:03,509
All of this sounds like a lot,
so let's make it practical.
472
00:13:03,509 --> 00:13:04,990
If you're an admin, the full
473
00:13:04,990 --> 00:13:06,509
list lives in the Power Platform
474
00:13:06,509 --> 00:13:08,370
Admin Center under Manage then
475
00:13:08,370 --> 00:13:09,110
Environments.
476
00:13:09,110 --> 00:13:11,990
Each one shows its type, its
region, and its current state.
477
00:13:11,990 --> 00:13:14,389
If you're a maker, know the name
of the environment you're in
478
00:13:14,389 --> 00:13:17,389
before you start building, that
name tells you its purpose.
479
00:13:17,389 --> 00:13:20,070
Many organizations now use
environment routing, which
480
00:13:20,070 --> 00:13:22,549
quietly gives each maker their
own personal developer
481
00:13:22,549 --> 00:13:25,509
environment instead of letting
everyone pile into the default.
482
00:13:25,509 --> 00:13:27,950
That's a good thing because it
means your first app lands in a
483
00:13:27,950 --> 00:13:30,629
space that's yours and not in
the shared room the whole
484
00:13:30,629 --> 00:13:31,909
company can see.
485
00:13:31,909 --> 00:13:33,210
When in doubt, ask which
486
00:13:33,210 --> 00:13:34,429
environment is meant for your
487
00:13:34,429 --> 00:13:36,070
work because guessing is how
488
00:13:36,070 --> 00:13:37,190
projects end up in the wrong
489
00:13:37,190 --> 00:13:37,789
place.
490
00:13:38,950 --> 00:13:40,750
Best practices in plain words.
491
00:13:40,750 --> 00:13:43,549
Let me pull this into a few
habits you can actually use.
492
00:13:43,549 --> 00:13:45,990
The biggest one is to stop
treating the default environment
493
00:13:45,990 --> 00:13:47,509
as your production home.
494
00:13:47,509 --> 00:13:48,669
Rename it until its name says
495
00:13:48,669 --> 00:13:50,210
what it is and keep it for quick
496
00:13:50,210 --> 00:13:51,769
personal experiments.
497
00:13:51,769 --> 00:13:53,289
From there, build in your own
498
00:13:53,289 --> 00:13:55,210
developer or sandbox environment
499
00:13:55,210 --> 00:13:56,210
and ship to a production
500
00:13:56,210 --> 00:13:57,490
environment that people depend
501
00:13:57,490 --> 00:13:57,970
on.
502
00:13:57,970 --> 00:14:01,009
Keep your sandbox for testing so
you never test something risky
503
00:14:01,009 --> 00:14:02,250
against live data.
504
00:14:02,250 --> 00:14:03,970
Keep the tenant tidy as well by
505
00:14:03,970 --> 00:14:05,289
deleting the apps, flows, and
506
00:14:05,289 --> 00:14:06,929
environments you no longer use,
507
00:14:06,929 --> 00:14:08,370
and by sharing carefully rather
508
00:14:08,370 --> 00:14:09,370
than broadly.
509
00:14:09,370 --> 00:14:10,529
A clean tenant is easier for
510
00:14:10,529 --> 00:14:12,009
everyone to trust, including
511
00:14:12,009 --> 00:14:12,529
you.
512
00:14:12,529 --> 00:14:15,409
There's also a habit that pays
off for everyone around you.
513
00:14:15,409 --> 00:14:17,610
Tell people which environment
you built in and why.
514
00:14:17,610 --> 00:14:20,049
A strategy nobody understands
looks like a restriction, and a
515
00:14:20,049 --> 00:14:22,409
restriction people resent is one
they'll work around.
516
00:14:22,409 --> 00:14:24,610
None of these habits require you
to be an admin.
517
00:14:24,610 --> 00:14:25,649
They just keep your work from
518
00:14:25,649 --> 00:14:26,970
becoming someone else's clean up
519
00:14:26,970 --> 00:14:27,450
job.
520
00:14:27,450 --> 00:14:30,289
An environment is a container
for your apps, your flows, your
521
00:14:30,289 --> 00:14:32,289
data, and your connections.
522
00:14:32,289 --> 00:14:34,610
Everyone holds at most a single
database.
523
00:14:34,610 --> 00:14:37,690
The type you choose sets its
purpose and roles, groups and
524
00:14:37,690 --> 00:14:38,690
policies keep it safe.
525
00:14:38,690 --> 00:14:39,889
Here's my question for you.
526
00:14:39,889 --> 00:14:42,669
The next time you open power
platform, will you know which
527
00:14:42,669 --> 00:14:45,409
environment you're building in
and whether it's the right one?
528
00:14:45,409 --> 00:14:48,330
Subscribe to M365 FM to master
the tools and the mindset
529
00:14:48,330 --> 00:14:49,730
shaping the future of work.
