PL-900 Practice Question: Describe the business value of Microsoft Power Platform
An organization is deploying Power Apps to external customers for a self-service portal. They need to ensure that customer data is isolated from internal employee data. What is the best approach?
⚠ Common exam trap
Watch out — candidates often confuse security roles and DLP policies with true data isolation, assuming that permissions or data loss prevention rules can achieve the same level of separation as dedicated environments, but only separate environments provide the required physical and logical data boundaries.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create separate environments for internal and external users
Creating separate environments for internal and external users provides full tenant-level isolation of customer data from employee data. Each environment in Power Platform has its own databases, security settings, and data storage, ensuring that external customers cannot access internal resources even if security roles are misconfigured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Data Loss Prevention (DLP) policies in the same environment
Why it's wrong here
DLP policies restrict which connectors can share data across services; they do not partition customer records from employee records within one environment. They are tempting because DLP genuinely governs connector and data-flow boundaries, and would be the right choice when the requirement is preventing Power Apps from mixing business data with consumer connectors.
- ✗
Add external customers as B2B guests in the same environment
Why it's wrong here
B2B guest access grants sign-in to the same environment, so guests still see any app or data shared with them; it provides no data boundary. Guest invitations are tempting because they are the standard way to collaborate with external partners, and would be correct when customers need access to shared resources rather than isolation.
- ✓
Create separate environments for internal and external users
Why this is correct
Separate environments give each audience its own Dataverse instance, security roles and data boundaries, so external customers cannot access internal employee records. This isolation satisfies the requirement to keep customer data segregated from internal data.
- ✗
Use the same environment with security role-based access
Why it's wrong here
Security roles within one environment control record access, but all customers and employees share the same Dataverse instance, so isolation depends on role configuration rather than a hard boundary. A separate environment is correct when tenants require physical data separation, distinct capacity or independent lifecycle management.
Go deeper
Related to this question
About these practice questions
Courseiva writes every PL-900 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PL-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-900 exam.