PL-900 Manage the Microsoft Power Platform environment — 20 Questions

Question 1

You are the Power Platform administrator for your organization. A user reports that they cannot create a new environment. What is the most likely cause?

Accepted Answer

The user does not have the appropriate license or role to create environments.. Creating environments in the Power Platform requires either a Power Apps, Power Automate, or Dynamics 365 license, and the user must be assigned the Environment Admin or Global Admin role. Without the appropriate license or role, the 'New environment' button is disabled, and the user cannot proceed with environment creation.

Answer

The environment creation feature is disabled in the tenant settings.

Answer

The user is trying to create a production environment without a valid default environment.

Answer

The tenant has reached its maximum number of environments.

Question 2

Your organization has a Power Platform environment that contains several canvas apps and flows. You need to ensure that only users from your Microsoft Entra ID tenant can access the environment. What should you configure?

Accepted Answer

Assign a security group to the environment in the Power Platform admin center.. Assigning a security group to the environment in the Power Platform admin center restricts access to only members of that group, who must be from your Microsoft Entra ID tenant. This ensures that only authenticated users within your tenant can access the environment, effectively blocking external users.

Answer

Change the environment URL to include the tenant name.

Answer

Modify the tenant-level environment creation settings.

Answer

Configure a data loss prevention (DLP) policy for the environment.

Question 3

Your organization uses Power Platform environments for development, test, and production. A developer accidentally deleted a managed solution from the production environment. You need to restore the solution without affecting other components. What should you do?

Accepted Answer

Restore the environment from a backup taken before the deletion.. Restoring the production environment from a backup taken before the deletion is the only supported method in Power Platform to recover a deleted managed solution without affecting other components. Managed solutions are sealed and cannot be partially restored; environment backup restore returns the entire environment to a previous point in time, ensuring the solution is recovered along with its dependencies and without impacting unrelated customizations.

Answer

Reimport the solution from the source-controlled repository using Azure DevOps.

Answer

Use the Power Platform admin center to recover the solution from the recycle bin.

Answer

Reimport the managed solution from a backup file.

Question 4

You are a Power Platform administrator. A user reports that they are unable to share a canvas app with external users. What is the most likely cause?

Accepted Answer

The environment is not enabled for external sharing.. External sharing of canvas apps is controlled at the environment level in the Power Platform admin center. By default, external sharing is disabled for environments, and an administrator must explicitly enable it under the environment's settings. Without this setting enabled, users cannot share canvas apps with external users, even if they have the appropriate permissions.

Answer

The environment is a sandbox environment, which does not support external sharing.

Answer

The environment has a data loss prevention (DLP) policy that blocks sharing.

Answer

External users must have a Power Apps license to access the app.

Question 5

You need to grant a user the ability to manage environments in the Power Platform admin center, but not to manage other aspects of the tenant. Which role should you assign?

Accepted Answer

Power Platform administrator. The Power Platform administrator role grants full administrative access to Power Platform environments, including the ability to manage environments in the admin center, without granting broader tenant-level permissions like user management or directory settings. This role is scoped specifically to Power Platform resources, making it the correct choice for the described requirement.

Answer

Environment administrator

Answer

Global administrator

Answer

Dynamics 365 administrator

Question 6

Which TWO settings can you configure in a Power Platform environment to control data loss prevention?

Accepted Answer

Default action for connectors. The 'Default action for connectors' setting in a Power Platform environment allows administrators to define the default behavior (e.g., Block, Allow, or Audit) for connectors that are not explicitly covered by a DLP policy. This setting directly controls data loss prevention by preventing data from being shared with unmanaged or risky connectors. Option E is correct because environment-specific DLP policies enable granular control over which connectors can be used together, preventing data from flowing between business and non-business connectors within that environment.

Answer

Connector sharing settings

Answer

Environment security roles

Answer

Audit logging configuration

Question 7

Refer to the exhibit. The JSON policy shown fails to apply to the production environment. What is the most likely reason?

Accepted Answer

The JSON uses 'environment' as a key instead of 'environments'.. The JSON policy uses 'environment' as a key, but the correct key in Microsoft Power Platform DLP (Data Loss Prevention) policy JSON schema is 'environments' (plural). This mismatch causes the policy to fail validation and not apply to the production environment, as the platform expects an array of environment IDs under the 'environments' key.

Answer

The connector IDs should include the full path with 'shared_twitter' and 'shared_facebook', which they do.

Answer

The action value should be 'Block' with a capital B, but the JSON uses 'Block' which is correct.

Answer

The policy name is missing a required prefix.

Question 8

Refer to the exhibit. The environment 'Contoso Production' was created on January 15, 2023. You need to restore this environment to a state from January 20, 2023. What is the first step you must take?

Accepted Answer

Check if a backup from January 20, 2023, exists in the environment's backup list.. The first step in restoring a Power Platform environment to a specific past date is to verify that a backup exists for that date. Microsoft Power Platform automatically creates daily backups for production environments, but you must check the backup list to confirm that a backup from January 20, 2023, is available before proceeding with the restore operation.

Answer

Enable point-in-time restore in the environment settings.

Answer

Convert the environment to a sandbox environment.

Answer

Copy the environment to a new environment using the date parameter.

Question 9

Refer to the exhibit. You run the Azure CLI command to create a DLP policy. The command fails with an error that the resource type is invalid. What is the most likely cause?

Accepted Answer

The resource type should be 'Microsoft.PowerPlatform/dlpPolicies'.. The Azure CLI command for creating a DLP policy in Power Platform requires the correct Azure Resource Manager (ARM) resource type. The error 'resource type is invalid' indicates that the resource type specified in the command is not recognized. The correct resource type for Power Platform DLP policies is 'Microsoft.PowerPlatform/dlpPolicies'. Option C correctly identifies that the resource type should be exactly this, and the other options are less likely causes such as location, naming prefix, or properties format.

Answer

The --location parameter should be 'global' instead of 'eastus'.

Answer

The --name parameter is missing the policy prefix.

Answer

The --properties parameter should reference a URL instead of a file.

Question 10

A company plans to deploy Power Apps for field service technicians. The IT department requires that all users authenticate using their corporate credentials and that access to the Power Apps environment is restricted to users from the company's tenant only. Which configuration should the administrator use?

Accepted Answer

Set the environment security group to 'Only internal users' and disable external sharing. Setting the environment security group to 'Only internal users' and disabling external sharing ensures that only authenticated users from the company's own Microsoft Entra ID (formerly Azure AD) tenant can access the Power Apps environment. This meets the IT requirement of restricting access to corporate credentials and the company's tenant only, preventing any external guest or user from another tenant from signing in.

Answer

Enable 'Allow users from other tenants' in environment settings

Answer

Set the environment security group to 'All users' and enable external sharing

Answer

Assign a security group that includes only specific technicians

Question 11

An organization uses Power Automate flows that connect to Microsoft SharePoint Online and Microsoft Dataverse. The security team requires that all connections to Dataverse use service principal authentication instead of user credentials. The administrator needs to ensure that flows relying on Dataverse connections continue to work after the change. What should the administrator do?

Accepted Answer

Register a service principal in Microsoft Entra ID and update connection references in the flows' solution. Service principal authentication in Power Automate requires registering an application in Microsoft Entra ID (formerly Azure AD) and using its credentials to authenticate to Dataverse. Updating the connection references in the flows' solution to point to a service principal-based connection ensures all flows continue to work without requiring user credentials, meeting the security team's requirement.

Answer

Create a new environment and migrate flows there

Answer

Recreate all flows with a shared connection using a service principal

Answer

Delete existing connections and ask users to create new ones

Question 12

A company uses Power BI to create reports from Dataverse data. The administrator needs to ensure that report creators can only see data from tables they have access to in Dataverse. Which security feature should the administrator configure?

Accepted Answer

Define row-level security (RLS) roles in Power BI and map them to Dataverse roles. Row-level security (RLS) in Power BI can be used to restrict data access at the row level, and by mapping Power BI RLS roles to Dataverse roles, report creators will only see data from tables they have access to in Dataverse. Option A is wrong because environment security group controls access to the environment, not data within reports. Option B is wrong because table-level permissions in Dataverse control access to the table itself, but when using Power BI to report on Dataverse data, the data is imported or queried; RLS in Power BI is needed to enforce row-level restrictions. Option D is wrong because the Environment Maker role allows creating resources in the environment but does not restrict data visibility in reports.

Answer

Set environment security group to include only report creators

Answer

Configure table-level permissions in Dataverse

Answer

Assign the 'Environment Maker' role to report creators

Question 13

A Power Platform administrator needs to monitor usage and performance of environments. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Enable audit logging in Microsoft Purview compliance portal. Enabling audit logging in the Microsoft Purview compliance portal captures user and admin activities across Power Platform environments, which is essential for monitoring usage and performance. Audit logs provide a detailed record of events such as environment creation, solution imports, and data access, enabling administrators to track changes and diagnose performance issues. This aligns with the requirement to monitor usage and performance, as audit data can be analyzed to identify patterns and anomalies.

Answer

Enable capacity alerts for storage

Answer

Set up Microsoft Defender XDR for Power Platform

Answer

Configure DLP policies to block high-risk connectors

Question 14

An administrator is managing a Power Platform environment that uses Microsoft Entra ID for authentication. The company wants to enforce multi-factor authentication (MFA) for all users accessing Power Apps. Which TWO configurations should the administrator implement? (Choose two.)

Accepted Answer

Configure the environment's 'User authentication' setting to 'Require MFA' in Power Platform admin center. To enforce MFA for all users accessing Power Apps, two configurations should be implemented: enabling the 'Require MFA' setting in the Power Platform admin center (Option A) and creating a conditional access policy in Microsoft Entra ID (Option D). The admin center provides a direct setting under environment User Authentication to require MFA. Option D provides organization-wide enforcement by applying a conditional access policy to all cloud apps. Option C is incorrect because there is no separate 'Require MFA' option under environment security settings; the only built-in MFA toggle is the User Authentication setting. Options B and E are irrelevant.

Answer

Disable security group membership for the environment

Answer

Enable MFA in the environment's security settings under 'Require MFA'

Answer

Assign the 'System Administrator' role to all users

Question 15

An administrator reviews the JSON output from a Power Platform environment. What should the administrator be concerned about based on the data?

Accepted Answer

The API rate limit is approaching its maximum. The JSON output shows the 'RateLimitRemaining' field approaching zero, indicating that the API rate limit is nearly exhausted. Power Platform enforces per-tenant and per-user API limits to ensure fair resource usage, and hitting the limit will throttle or block further API calls, disrupting integrations and automated workflows.

Answer

The Dataverse URL is incorrect

Answer

The admin email is not configured

Answer

The environment is out of storage

Question 16

An administrator runs a PowerShell command to check a DLP policy. Based on the output, which connector is allowed to be used in Power Automate flows?

Accepted Answer

Microsoft Teams. The PowerShell command output indicates that the DLP policy allows the 'Microsoft Teams' connector, as it is listed in the allowed connector list. DLP policies in Power Platform control which connectors can be used in Power Automate flows, and the output explicitly shows Microsoft Teams as permitted.

Answer

Dropbox

Answer

Google Drive

Answer

Microsoft OneDrive

Question 17

An administrator is reviewing an ARM template for deploying a Power Platform environment. Based on the exhibit, what type of environment will be created?

Accepted Answer

Developer environment. In an ARM template for Power Platform environment deployment, the environment type is specified by the 'environmentType' or 'type' property. A Developer environment is identified by the value 'Developer' (or 'Sandbox' for sandbox, 'Production' for production, 'Trial' for trial). Based on the exhibit showing the Developer type value, the template will create a Developer environment.

Answer

Trial environment

Answer

Production environment

Answer

Sandbox environment

Question 18

A Power Platform administrator needs to restrict data loss prevention (DLP) policies to prevent sensitive data from being shared with non-approved connectors. Which scope should the administrator apply?

Accepted Answer

Environment-level. Environment-level DLP policies allow administrators to apply data loss prevention rules to specific environments, ensuring that sensitive data is not shared with non-approved connectors within that environment. This granular control is necessary when different environments have different compliance requirements, such as separating development from production data flows.

Answer

Group-level

Answer

Tenant-level

Answer

User-level

Question 19

A company wants to grant a user the ability to manage environments in Power Platform, including creating and deleting environments, but without full tenant admin access. Which role should be assigned?

Accepted Answer

Power Platform Administrator. The Power Platform Administrator role is a Microsoft Entra ID role that grants full management of Power Platform environments, including creating, deleting, and configuring environments, without requiring Global Administrator privileges. It is scoped specifically to Power Platform administrative tasks across the tenant, making it the least-privilege role that meets the requirement.

Answer

Global Administrator

Answer

Environment Admin

Answer

System Administrator

Question 20

A company is migrating their Power Platform environments from one tenant to another. They need to ensure that all solution components, including Canvas apps and flows, are moved. Which tool should be used?

Accepted Answer

Manual export and import of solutions. Manual export and import of solutions is the correct approach for moving solution components like Canvas apps and flows across tenants. The Configuration Migration tool is designed for moving configuration data (e.g., entity records) but not solution components. The Power Platform CLI is used for automation and development tasks, not for tenant-to-tenant migration. Solution Checker is a validation tool, not a migration tool.

Answer

Power Platform CLI

Answer

Configuration Migration tool

Answer

Solution Checker