PL-900 Manage the Microsoft Power Platform environment — 40 Questions

Question 1

Refer to the exhibit. You run the Azure CLI command to create a DLP policy. The command fails with an error that the resource type is invalid. What is the most likely cause?

Accepted Answer

The resource type should be 'Microsoft.PowerPlatform/dlpPolicies'.. The Azure CLI command for creating a DLP policy in Power Platform requires the correct Azure Resource Manager (ARM) resource type. The error 'resource type is invalid' indicates that the resource type specified in the command is not recognized. The correct resource type for Power Platform DLP policies is 'Microsoft.PowerPlatform/dlpPolicies'. Option C correctly identifies that the resource type should be exactly this, and the other options are less likely causes such as location, naming prefix, or properties format.

Answer

The --location parameter should be 'global' instead of 'eastus'.

Answer

The --name parameter is missing the policy prefix.

Answer

The --properties parameter should reference a URL instead of a file.

Question 2

A company is migrating their Power Platform environments from one tenant to another. They need to ensure that all solution components, including Canvas apps and flows, are moved. Which tool should be used?

Accepted Answer

Manual export and import of solutions. Manual export and import of solutions is the correct approach for moving solution components like Canvas apps and flows across tenants. The Configuration Migration tool is designed for moving configuration data (e.g., entity records) but not solution components. The Power Platform CLI is used for automation and development tasks, not for tenant-to-tenant migration. Solution Checker is a validation tool, not a migration tool.

Answer

Power Platform CLI

Answer

Configuration Migration tool

Answer

Solution Checker

Question 3

Refer to the exhibit. The JSON shows Power Platform tenant settings. A user tries to create a new environment with a capacity of 8 GB. What will happen?

Accepted Answer

The environment will be created successfully with 8 GB capacity.. The JSON shows that the tenant settings have 'DisableEnvironmentCreationByNonAdminUsers' set to false, meaning non-admin users can create environments, and 'EnvironmentCapacityAllocationMode' is set to 'UserAllocation', which allows users to allocate capacity from their own user licenses. Each Power Apps per user license provides 2 GB of database capacity. Since the user is trying to create an environment with 8 GB, this is possible if the user has at least 4 Power Apps licenses (or a combination of licenses) to provide the required capacity. Therefore, the environment creation will succeed.

Answer

The environment creation will fail because 8 GB exceeds the default environment capacity of 5 GB.

Answer

The environment will be created but the user must have a Power Apps license assigned.

Answer

The environment creation will fail because UserAllocation mode requires at least 15 GB.

Question 4

A Power Platform admin receives a request to allow a group of developers to create and manage environments within a tenant. What is the minimum role assignment required?

Accepted Answer

Assign the Dynamics 365 Administrator role.. The Dynamics 365 Administrator role (also known as Power Platform Administrator) is the minimum role required to create and manage environments at the tenant level. This role has the necessary permissions to provision new environments, modify existing ones, and manage environment settings across the tenant. The Environment Admin role, in contrast, is a per-environment role and cannot create new environments; it only allows management within an already existing environment.

Answer

Assign the System Administrator role in each environment.

Answer

Assign the Global Administrator role in Microsoft Entra ID.

Answer

Assign the Environment Admin role in the Power Platform admin center.

Question 5

An organization uses Power Apps portals to allow external customers to submit support tickets. The portal uses Microsoft Entra ID for authentication. The security team wants to require multi-factor authentication (MFA) for external portal users. What is the best approach?

Accepted Answer

Create a Conditional Access policy in Microsoft Entra ID that requires MFA for the portal application. A Conditional Access policy in Microsoft Entra ID can be created to require MFA specifically for the Power Apps portal application, providing granular enforcement without affecting internal users. Option B is incorrect because enabling MFA for all Entra ID users would impose MFA on internal users unnecessarily. Option C is incorrect because while a third-party identity provider could support MFA, it adds complexity and is not the best approach when Conditional Access is available. Option D is incorrect because Power Apps portal authentication settings do not include MFA enforcement capabilities.

Answer

Enable MFA for all Microsoft Entra ID users

Answer

Use a third-party identity provider that supports MFA

Answer

Configure MFA in the Power Apps portal authentication settings

Question 6

A Power Platform administrator needs to ensure that any maker can create environments in the default tenant, but only for development purposes. The administrator wants to enforce a policy that automatically deletes unused environments after 30 days. Which feature should the administrator use?

Accepted Answer

Environment Lifecycle Policies in the Power Platform admin center.. The Environment Lifecycle Policies in the Power Platform admin center, which allow setting deletion policies based on inactivity. Option B is incorrect because the Power Platform API can be used but is not the built-in policy feature. Option C is incorrect because capacity management does not delete environments. Option D is incorrect because Data Loss Prevention (DLP) policies control connectors, not environment lifecycle.

Answer

Power Platform API to schedule deletion scripts.

Answer

Capacity management in the Power Platform admin center.

Answer

Data Loss Prevention (DLP) policies.

Question 7

An organization uses Microsoft Power Platform and wants to implement a governance strategy that automatically blocks the creation of environments in specific regions to comply with company policy. What should the administrator do?

Accepted Answer

Use the Power Platform admin center to define allowed data locations for environment creation.. The Power Platform admin center allows administrators to define allowed data locations for environment creation, effectively blocking regions that are not allowed. Option A is incorrect because creating a support ticket is not the standard method for this governance control; the admin center provides the capability. Option B is incorrect because capacity limits control the number of environments or storage, not geographic restrictions. Option D is incorrect because setting the default environment region only affects the default region for new environments but does not block creation in other regions; it is not a restriction.

Answer

Create a support ticket with Microsoft to block regions.

Answer

Implement capacity limits that prevent creation in disallowed regions.

Answer

Set the default environment region in tenant settings to the allowed region.

Question 8

An organization has multiple Power Platform environments and wants to enforce consistent data loss prevention (DLP) policies across all environments. Which THREE steps should the administrator take?

Accepted Answer

Create a DLP policy at the tenant level with the desired default rules.. To enforce consistent DLP policies across multiple environments, the administrator should create a DLP policy at the tenant level (C) to set default rules, assign policies explicitly to each environment (D) to override any conflicting defaults, and use DLP policy profiles (E) to define different policies for various environment types (e.g., production, development). Option A is incorrect because removing existing environment-level policies is not necessary; they can be overridden by explicit assignments. Option B is incorrect because audit logging tracks violations but does not enforce policies.

Answer

Remove all existing environment-level DLP policies.

Answer

Enable audit logging to track DLP policy violations.

Question 9

Which TWO are valid methods to create a new Power Platform environment?

Accepted Answer

Using the Power Platform admin center web interface.. Environments can be created through the Power Platform admin center (option A) and via the Power Platform API (option B). The Microsoft Teams admin center (option C), Power Apps mobile app (option D), and SharePoint admin center (option E) do not provide the functionality to create Power Platform environments.

Answer

Using the Microsoft Teams admin center.

Answer

Using the Power Apps mobile app.

Answer

Using the SharePoint admin center.

Question 10

You are the Power Platform administrator for a large multinational corporation. The company has a single Microsoft Entra ID tenant with users in North America, Europe, and Asia. Due to data residency regulations, each region must store its data within its geographic boundaries. The company has three production environments: NA-Prod (East US), EU-Prod (West Europe), and ASIA-Prod (Southeast Asia). Each production environment has a corresponding sandbox environment for development. Recently, the security team discovered that a developer in Europe accidentally accessed customer data from the NA-Prod environment by using a connection reference that pointed to the North American Dataverse instance. To prevent cross-region data access, you need to implement a solution that blocks any Power Automate flow or Power Apps canvas app from connecting to Dataverse instances in other regions. You must also ensure that developers can still use non-Dataverse connectors (e.g., SharePoint, Office 365) that may be global. What should you do?

Accepted Answer

Create environment-level DLP policies that block the Dataverse connector in each environment, then add the Dataverse connector back as a business connector only for the local instance using endpoint filtering.. Environment-level DLP policies can block the Dataverse connector, and using endpoint filtering allows you to whitelist only the local Dataverse instance, preventing cross-region connections while still enabling non-Dataverse connectors. Option B is incorrect because Microsoft Entra ID Conditional Access policies control user authentication and access to applications, not the connections used by Power Automate flows or Power Apps. Option C is incorrect because a tenant-level DLP policy that blocks the Dataverse connector would prevent all environments from using Dataverse entirely, including legitimate local usage. Option D is incorrect because audit logging and notification flows only detect and report cross-region access after it occurs; they do not block it.

Answer

Use Microsoft Entra ID Conditional Access policies to block cross-region access to Dataverse.

Answer

Create a tenant-level DLP policy that blocks the Dataverse connector for all environments.

Answer

Enable audit logging and create a Power Automate flow to notify administrators when cross-region access is detected.

Question 11

An organization has multiple Power Platform environments. The security team mandates that all environments must use Microsoft Entra ID conditional access policies to enforce multi-factor authentication. However, one environment hosts a service account that cannot perform interactive logins. What should the administrator do to comply without breaking the service account?

Accepted Answer

Exclude the service account from the conditional access policy. Excluding the service account from the conditional access policy is the correct approach because service accounts cannot perform MFA. Option A is wrong because creating a new environment does not resolve the policy conflict. Option B is wrong because changing the service account to interactive login is not feasible. Option D is wrong because disabling MFA for the entire environment weakens security.

Answer

Create a new environment for the service account

Answer

Change the service account to use interactive login

Answer

Disable MFA for that environment

Question 12

An administrator needs to manage multiple Power Platform environments across several tenants. The administrator wants to use a single tool to view environment details, apply updates, and configure settings for all environments. Which tool should the administrator use?

Accepted Answer

Power Platform Admin Center. The Power Platform Admin Center is the central web-based interface for managing environments across tenants. Option B (PowerShell cmdlets) is a scripting tool that can be used for automation but is not a single graphical tool for all tasks. Option C (Power Apps Maker Portal) is designed for creating and editing apps, not for environment management. Option D (Microsoft 365 admin center) does not provide full management of Power Platform environments.

Answer

PowerShell cmdlets

Answer

Power Apps Maker Portal

Answer

Microsoft 365 admin center

Question 13

A company has multiple Power Platform environments. The administrator notices that a production environment is running low on storage. The administrator needs to free up space without disrupting active users. What should the administrator do FIRST?

Accepted Answer

Identify large or unused solutions and remove them. Identifying large or unused solutions and removing them directly frees up storage and is the first logical step to free space without disrupting users. Option A is wrong because deleting old audit logs may not free significant space compared to solutions. Option B is wrong because disabling unused plugins may not free storage and could break functionality. Option D is wrong because adding storage is a cost-increasing measure, not a cleanup action.

Answer

Delete old audit logs

Answer

Disable unused plugins

Answer

Add more storage to the environment

Question 14

An administrator is planning the environment strategy for a large enterprise. Which TWO considerations should the administrator include to ensure proper governance?

Accepted Answer

Establish environment naming conventions. Environment naming conventions and DLP policies are key governance considerations. Option B (establish naming conventions) helps organize environments; Option D (implement DLP policies) protects data. Option A is wrong because using only the default environment is not recommended for governance. Option C is wrong because disabling environment monitoring reduces visibility and control. Option E is wrong because allowing all connectors poses a security risk.

Answer

Use only the default environment to simplify management

Answer

Disable environment monitoring to reduce overhead

Answer

Allow all connectors to maximize flexibility

Question 15

You are the Power Platform administrator for a large financial services organization. The organization has three environments: Dev, Test, and Prod. The Dev environment is used by a team of 10 developers who frequently create and test solutions. The Test environment is for quality assurance, and Prod is for live applications. Recently, the compliance team has mandated that all environments must have audit logging enabled to track changes and user activities. Additionally, the organization wants to implement a policy that prevents the use of connectors that transmit data outside the organization's Azure region. The compliance team also requires that any new environment created in the future automatically inherits these audit and DLP policies. You need to configure the environment settings to meet these requirements. What should you do?

Accepted Answer

Enable audit logging and create a tenant-level DLP policy that applies to all environments. Enabling audit logging and creating a tenant-level DLP policy ensures all environments, including new ones, inherit these settings. Option B is wrong because configuring each environment individually is inefficient and does not automatically apply to new environments. Option C is wrong because a tenant-level DLP policy with a warning does not block data transmission as required; it only warns, which does not meet the compliance requirement to prevent transmission. Option D is wrong because enabling audit only in Prod does not meet the mandate for all environments, and creating a DLP policy only for Dev and Test leaves Prod unprotected.

Answer

Configure audit logging and DLP policies individually for each environment

Answer

Create a tenant-level DLP policy that warns users about data transmission

Answer

Enable audit logging in the Prod environment and create a DLP policy for Dev and Test only

Question 16

You are the Power Platform administrator for a retail company. The company has a single default environment that all employees use to build and run Power Apps and Power Automate flows. Recently, the IT department noticed that some users are accidentally deleting shared flows that are critical to business operations. To prevent this, you need to implement a solution that allows users to create and edit their own flows, but prevents them from deleting flows owned by others. Additionally, you want to ensure that only approved connectors are used to protect sensitive data. You have been granted permissions to manage environments and security roles. What should you do?

Accepted Answer

Create a new environment, assign users the Environment Maker role, and implement a DLP policy. Creating a new environment and assigning users the Environment Maker role allows them to create and edit their own flows but prevents them from deleting flows owned by others. Implementing a Data Loss Prevention (DLP) policy restricts the use of connectors to approved ones, protecting sensitive data. Option A is incorrect because removing the delete permission for all flows would prevent even legitimate cleanup. Option C is incorrect because audit logging only detects deletions after they occur, it does not prevent them. Option D is incorrect because sharing flows with read-only access prevents users from editing their own flows as required.

Answer

Remove the delete permission for all flows from all users

Answer

Enable audit logging and rely on manual review of deletions

Answer

Share all critical flows with read-only access to all users

Question 17

You are the Power Platform administrator for your organization. A user reports that they cannot create a new environment. What is the most likely cause?

Accepted Answer

The user does not have the appropriate license or role to create environments.. Creating environments in the Power Platform requires either a Power Apps, Power Automate, or Dynamics 365 license, and the user must be assigned the Environment Admin or Global Admin role. Without the appropriate license or role, the 'New environment' button is disabled, and the user cannot proceed with environment creation.

Answer

The environment creation feature is disabled in the tenant settings.

Answer

The user is trying to create a production environment without a valid default environment.

Answer

The tenant has reached its maximum number of environments.

Question 18

Your organization has a Power Platform environment that contains several canvas apps and flows. You need to ensure that only users from your Microsoft Entra ID tenant can access the environment. What should you configure?

Accepted Answer

Assign a security group to the environment in the Power Platform admin center.. Assigning a security group to the environment in the Power Platform admin center restricts access to only members of that group, who must be from your Microsoft Entra ID tenant. This ensures that only authenticated users within your tenant can access the environment, effectively blocking external users.

Answer

Change the environment URL to include the tenant name.

Answer

Modify the tenant-level environment creation settings.

Answer

Configure a data loss prevention (DLP) policy for the environment.

Question 19

Your organization uses Power Platform environments for development, test, and production. A developer accidentally deleted a managed solution from the production environment. You need to restore the solution without affecting other components. What should you do?

Accepted Answer

Restore the environment from a backup taken before the deletion.. Restoring the production environment from a backup taken before the deletion is the only supported method in Power Platform to recover a deleted managed solution without affecting other components. Managed solutions are sealed and cannot be partially restored; environment backup restore returns the entire environment to a previous point in time, ensuring the solution is recovered along with its dependencies and without impacting unrelated customizations.

Answer

Reimport the solution from the source-controlled repository using Azure DevOps.

Answer

Use the Power Platform admin center to recover the solution from the recycle bin.

Answer

Reimport the managed solution from a backup file.

Question 20

You are a Power Platform administrator. A user reports that they are unable to share a canvas app with external users. What is the most likely cause?

Accepted Answer

The environment is not enabled for external sharing.. External sharing of canvas apps is controlled at the environment level in the Power Platform admin center. By default, external sharing is disabled for environments, and an administrator must explicitly enable it under the environment's settings. Without this setting enabled, users cannot share canvas apps with external users, even if they have the appropriate permissions.

Answer

The environment is a sandbox environment, which does not support external sharing.

Answer

The environment has a data loss prevention (DLP) policy that blocks sharing.

Answer

External users must have a Power Apps license to access the app.