# Power Platform Administration and Governance

> Chapter 17 of the Courseiva PL-900 curriculum — https://courseiva.com/learn/pl-900/power-platform-administration

**Official objective:** 2.4 — Describe Power Platform administration and governance

## Introduction

How do you stop someone from accidentally deleting a critical company database while still letting them build useful apps? Power Platform administration and governance is the set of tools and rules that keep the platform safe, organised, and under control — especially when dozens or hundreds of people in an organisation are creating apps, chatbots, and automated workflows. For the PL-900 exam, you need to know who can do what, how policies are enforced, and where you go to manage it all.

## The House Party Permission Slip Analogy

Your friend's sprawling house with a backyard pool, a game room, and a fancy kitchen.

You decide to throw a party for your course classmates. You need to control who comes in the front door, what rooms they can use, and what they can touch. You give one friend a key to the front gate but not the wine cabinet. Another friend gets access to the game room but not the study where your friend keeps their laptop. You also set a rule: nobody can use the pool after 10pm. If someone breaks a lamp, you can see exactly who was in that room because you checked IDs at the door. This is exactly what Power Platform administration and governance does. The 'front door' is the admin portal. The 'room permissions' are role-based security. The 'pool rule' is a data loss prevention policy. The 'ID check' is audit logging. You are the admin who sets the rules, watches the logs, and revokes a troublemaker's access without cancelling the whole party.

## Core explanation

Power Platform administration and governance is the system of controls that an organisation sets up to manage how its users build and use Power Apps, Power Automate, Power Pages, and Power Virtual Agents. Think of it as the rulebook, the security guards, and the CCTV system for a digital workplace.

The central tool for all this is the Power Platform admin centre. This is a single web-based dashboard where authorised admins can see everything happening across their organisation's Power Platform environment. An 'admin' is a person with special permissions to manage settings, users, and resources. An 'environment' is a container that holds all the apps, flows, data connections, and permissions for a specific purpose — for example, you might have a 'Production' environment for live apps and a 'Test' environment for trying out new ideas. Each environment can have its own security settings and data storage.

The key concepts you need to know for governance are:

- Data Loss Prevention (DLP) policies: These are rules that control how data can move between different services. For example, a DLP policy can block a Power Automate flow from sending customer data from a company database straight to a personal Gmail account. This prevents accidental data leaks.

- Microsoft Entra ID: This is Microsoft's cloud-based identity and access management service. It is the master list of every user in the organisation and what they are allowed to do. When you assign a role like 'Environment Admin' or 'Maker' to someone in the Power Platform admin centre, you are actually granting a permission that is backed by Microsoft Entra ID.

- Role-based access control (RBAC): This is the principle that permissions are assigned based on a person's job function (their 'role'), not based on who they are as an individual. Common roles include 'System Administrator' (full control), 'Environment Maker' (can create resources inside an environment), and 'Basic User' (can only run apps).

- Audit logging: Every action taken in the Power Platform — creating an app, changing a permission, deleting a flow — can be recorded in an audit log. An admin can review these logs to investigate problems or check who did what.

- Tenant and environment strategies: A 'tenant' is the whole organisation's Microsoft 365 subscription (like the entire apartment building). You can create multiple environments inside that tenant (like individual apartments). A common governance practice is to have separate environments for development, testing, and production. This prevents people from accidentally breaking live apps while experimenting.

Governance also involves setting default data policies, managing capacity and storage limits, and using 'Solutions' to package apps and flows for deployment from one environment to another. For the PL-900 exam, remember that the admin centre is where almost all governance actions start. The purpose of governance is never to block creativity — it is to enable safe, responsible building at scale.

Before Power Platform governance existed, IT teams often locked down all data access, forcing users to submit requests for every small change. Or, the opposite happened: chaos, with no rules at all, leading to data breaches and broken processes. Governance gives a middle path: you set the boundaries, and then let makers innovate within them.

## Real-world context

Meet Priya. She is the Power Platform Administrator for a mid-sized insurance company called 'SafeGuard Insurance'. The company has 500 employees, and about 30 of them have started building small Power Apps for their teams. Priya's job is to keep the platform safe while still letting these 'makers' be productive.

Step 1: Priya logs into the Power Platform admin centre. She sees a dashboard showing all environments in the tenant. She notices that a few makers have created apps in the default 'Production' environment by accident. That is dangerous because any mistake could disrupt live business operations.

Step 2: Priya creates two new environments. She names one 'Development' and one 'Test'. She sets the 'Production' environment to allow only admins to create new resources. She then tells all makers to only build new apps in the Development environment.

Step 3: Priya creates a Data Loss Prevention policy. She wants to stop any flow from sending sensitive client information (stored in a SQL database in the company network) to personal email addresses. In the admin centre, she uses the DLP policy builder to put the company SQL connector in the 'Business data only' group and puts Gmail and Yahoo Mail in the 'Blocked' group. Now, any flow that tries to connect the company database to a personal email will automatically fail to save.

Step 4: A manager reports that someone created a Power Automate flow that sends all customer claims to a third-party vendor without approval. Priya goes to the audit log section in the admin centre. She searches for the date range and finds the exact user who created the flow. She learns the person's name and the flow's name. Priya can now disable that flow and have a conversation with the maker about proper procedures.

Step 5: Priya sets up role-based access for her team. She assigns the 'System Administrator' role to herself and one backup admin. She assigns the 'Environment Maker' role to all 30 makers but only for the Development environment. She assigns the 'Basic User' role to everyone else, so they can run apps but cannot create or modify them.

Step 6: Every quarter, Priya reviews the list of unused environments and deletes them. She also checks for flows or apps that have not been used in 90 days. This keeps the tenant clean and reduces licensing costs because some environments consume capacity.

This scenario shows the daily reality: an administrator is not a developer. They are a guardian. They set the rules, monitor activity, and clean up messes. They rarely build apps themselves. Their goal is to empower builders without losing control.

## Exam focus

The PL-900 exam tests your understanding of Power Platform administration and governance in several specific ways. You will not be asked to configure the admin centre — you will be asked to identify what it is used for, what the key roles are, and what policies do.

Exam topics you must know:

- Purpose of the Power Platform admin centre: Know that it is the single location for managing environments, DLP policies, capacity, and user permissions. Traps: They might show you the Power Apps maker portal (make.powerapps.com) and ask if it is the admin centre. It is not. The maker portal is for building apps. The admin centre is admin.microsoft.com (or the dedicated Power Platform admin centre).

- Roles and permissions: They love to test the difference between 'System Administrator', 'Environment Maker', and 'Basic User'. Memorise this: Sys Admin = full control. Environment Maker = can create resources in that environment. Basic User = can only run apps and flows. Trap: They might call an 'Environment Admin' a 'Global Admin' — a Global Admin is a higher-level role in Microsoft 365 that does not give the same granular control inside an environment.

- Data Loss Prevention (DLP) policies: Expect a question where you choose the correct action to stop data from flowing to an external service. Remember: DLP policies are grouped by connector type: Business, Non-business, and Blocked. They do not stop human users from copying data manually — only automated flows and apps. Trap: They might say DLP policies apply to individual users. They apply to environments, not individual users.

- Environments: Know that an environment is a container with its own data, security, and apps. Know the common strategy of separate environments for Dev, Test, and Production. Trap: They might claim that an environment can only be used by one person — false. Many users can share an environment.

- Microsoft Entra ID: They may refer to identity management. Remember that it is the directory that stores user accounts, and it is where you assign roles. Trap: They might use the old name 'Azure AD' — the exam uses 'Microsoft Entra ID'.

- Audit logs: They might ask how you find out who deleted an app. The answer: check the audit log in the Power Platform admin centre. Trap: They might suggest checking the maker's computer logs — wrong. The auditing is cloud-based and centralised.

- Capacity and licensing: They might ask about 'add-on capacity' or 'per-app plans'. You need to know that if a user runs out of capacity (e.g., database storage), an admin can purchase more or free up space. Trap: They might say you can delete apps to increase capacity — partially true, but the right answer is usually 'manage capacity in the admin centre'.

Correct answer pattern: When you see a question about controlling who can create apps, the answer will involve assigning a 'role' like Environment Maker. When the question is about blocking data transfer to an external service, the answer is a 'DLP policy'. When the question is about seeing who did what, the answer is 'audit logs' in the admin centre.

Key definitions to memorise:
- Power Platform admin centre: The hub for management and governance.
- Environment: A container for apps, flows, and data.
- DLP policy: A rule that controls data movement between connectors.
- Microsoft Entra ID: The identity and access management system.
- Role-based access control (RBAC): Assigning permissions based on job role.

## Step by step

1. **Log into the Power Platform admin centre** — Use your admin credentials to access admin.powerplatform.microsoft.com. This is the starting point for all governance tasks. If you do not have admin privileges, you will see an error.
2. **Review existing environments** — Look at the list of environments. Identify which ones are used for development, testing, and live production. Check who has access to each environment. This helps you spot security risks.
3. **Create or modify a Data Loss Prevention policy** — Go to the 'Data Policies' section. Click 'New policy'. Choose which connectors are allowed to share business data and which are blocked. This prevents sensitive data from leaking to personal services like Gmail or Dropbox.
4. **Assign user roles** — In the admin centre, select an environment. Under 'Users', add people and assign them a role such as 'Environment Maker' or 'System Administrator'. This controls who can build, manage, or simply use apps.
5. **Configure audit logging and review logs** — Ensure audit logging is turned on (it is on by default for most tenants). When you need to investigate an incident, go to 'Audit logs', filter by date and user, and see a chronological list of actions taken. This is your evidence trail.
6. **Monitor capacity and storage** — Check the 'Capacity' section to see how much database, file, and log storage you have used. If you are running low, you can delete old apps or purchase add-on capacity. This ensures your platform stays performant.

## Comparisons

### Power Platform Admin Centre vs Power Apps Maker Portal

**Power Platform Admin Centre:**
- Used for administration and governance tasks.
- Manages environments, policies, and user roles.
- Accessed via admin.powerplatform.microsoft.com.

**Power Apps Maker Portal:**
- Used for building and editing apps.
- Focuses on app design and flow creation.
- Accessed via make.powerapps.com.

### Tenant vs Environment

**Tenant:**
- The entire Microsoft 365 subscription for an organisation.
- Contains all environments.
- Has its own global admin roles.

**Environment:**
- A container inside a tenant for apps, data, and users.
- Can be dedicated to a specific project (e.g., Test).
- Has its own set of roles and permissions separate from the tenant.

### System Administrator vs Environment Maker

**System Administrator:**
- Has full control over an environment.
- Can change settings, assign roles, and delete resources.
- Typically only a few people hold this role.

**Environment Maker:**
- Can create and edit apps, flows, and chatbots.
- Cannot change admin settings or delete environments.
- Is a common role for developers and business analysts.

### Data Loss Prevention (DLP) Policy vs Audit Log

**Data Loss Prevention (DLP) Policy:**
- Prevents data from moving to certain connectors.
- Is a proactive control that blocks actions before they happen.
- Configured by grouping connectors into Business, Non-business, or Blocked.

**Audit Log:**
- Records actions that have already happened.
- Is a reactive tool for investigating incidents.
- Shows who did what and when, but does not stop anything.

## Diagram

_This diagram shows the key functions of the Power Platform admin centre and how they connect to environments, roles, and policies._

```mermaid
flowchart TD
    A[Power Platform Admin Centre] --> B[Manage Environments]
    A --> C[Data Loss Prevention Policies]
    A --> D[User Roles & Permissions]
    A --> E[Audit Logs]
    A --> F[Capacity & Storage]
    B --> G[Development]
    B --> H[Test]
    B --> I[Production]
    D --> J[System Admin]
    D --> K[Environment Maker]
    D --> L[Basic User]
```

## Common misconceptions

- **Misconception:** Only one person in the entire company can be a Power Platform admin. **Reality:** Multiple people can hold the System Administrator role. It is common to have two or more admins for redundancy and shared responsibility. (People often think of IT access as being like a 'king' with one crown, but in modern cloud platforms, shared admin roles prevent single points of failure.)
- **Misconception:** A DLP policy prevents a human user from manually copying data out of an app and pasting it into an email. **Reality:** DLP policies only apply to automated flows, connectors, and app connections. They cannot stop a user from manually copying and pasting data. (The word 'prevention' sounds absolute, but DLP is a technical restriction on machine-to-machine data movement, not a human behaviour blocker.)
- **Misconception:** If you are an admin for the Power Platform, you automatically have full control over all environments in the tenant. **Reality:** Being a Power Platform admin does not automatically give you full control over every environment. You need to be assigned as a System Administrator or have the appropriate role specifically for each environment. (People confuse the broad 'tenant-level' admin role with environment-level roles. The roles are nested and separate.)
- **Misconception:** You need to be a developer to use the Power Platform admin centre. **Reality:** The admin centre is designed for IT professionals and managers, not developers. You do not need to write any code or build apps to use it. (The word 'platform' sounds technical, but administration is mostly about clicking options, setting policies, and reading reports — not programming.)
- **Misconception:** Environments and tenants are exactly the same thing. **Reality:** A tenant is the entire organisation's Microsoft 365 subscription. An environment is a container inside that tenant. You can have many environments inside one tenant. (People often think 'big container' versus 'small container' is the same concept. The exam tests the distinction between tenant-level and environment-level management.)

## Key takeaways

- The Power Platform admin centre is the single hub where all governance settings are managed, including environments, roles, and DLP policies.
- Data Loss Prevention (DLP) policies control how data can move between connectors in Power Automate and Power Apps, blocking unauthorised data transfers.
- There are three core roles to remember: System Administrator (full control), Environment Maker (can create resources), and Basic User (can only run apps).
- Environments are separate, logical containers for apps, flows, and data, and best practice is to use Dev, Test, and Production environments.
- Microsoft Entra ID is the identity and access management service that powers all user roles and permissions across Power Platform.
- Audit logs in the admin centre record all actions and allow admins to investigate who did what, when, and where.

## FAQ

**What is the difference between a tenant and an environment in Power Platform?**

A tenant is the entire organisation's Microsoft 365 subscription, like an apartment building. An environment is a single container inside that building for a specific purpose, like an individual flat. You can have many environments inside one tenant.

**Can I be an admin for Power Platform without knowing how to build apps?**

Yes. The admin centre is purely for management — setting policies, assigning roles, and monitoring usage. You never need to write code or create a flow to be an effective admin.

**How do I stop someone from sending company data to their personal Google account via a Power Automate flow?**

Create a Data Loss Prevention (DLP) policy in the Power Platform admin centre. Block the Google connectors and keep your company database connector in the 'Business data only' group.

**Is the Power Apps maker portal the same as the admin centre?**

No. The maker portal (make.powerapps.com) is where you build and edit apps. The admin centre (admin.powerplatform.microsoft.com) is where you manage users, environments, and policies. They are separate tools.

**What happens if I assign someone the 'Environment Maker' role in the wrong environment?**

They will be able to create apps and flows only in that specific environment. If it is the production environment, they might accidentally break live apps. Always assign makers to development environments only.

**How do I find out who deleted an important app?**

Go to the Power Platform admin centre, navigate to 'Audit logs', and search for the app's name or the date. The log will show the user who deleted it and when.

## Check your understanding

1. **Which tool is used to assign the 'Environment Maker' role to a user?**

   Answer: The Power Platform admin centre, under the 'Users' section for a specific environment.

2. **What is the purpose of a Data Loss Prevention (DLP) policy in Power Platform?**

   Answer: To control how data moves between connectors in Power Automate and Power Apps, blocking unauthorised transfers to external services.

3. **What is the difference between a tenant and an environment?**

   Answer: A tenant is the entire organisation's Microsoft 365 subscription, while an environment is a container inside that tenant for specific apps, data, and users.

4. **If you need to see who deleted an app last week, where do you look?**

   Answer: In the audit logs within the Power Platform admin centre.

5. **What role gives a user full control over an environment, including changing security settings?**

   Answer: The System Administrator role.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/pl-900/power-platform-administration