PL-900 Practice Question: Manage the Microsoft Power Platform environment
You are a Power Platform administrator for a non-profit organization. The organization has a single environment used by volunteers and staff. A new volunteer needs to be able to run a specific Power App that manages event registrations, but should not be able to modify the app or access any other resources in the environment. The volunteer has a valid Power Apps license. You need to provide the volunteer with the minimum permissions necessary. What should you do?
⚠ Common exam trap
PL-900 often tests the misconception that environment-level roles are needed to run an app, when in fact direct app sharing with run-only permission is the least-privilege approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Share the app directly with the volunteer
Sharing the app directly with the volunteer grants run-only access to that specific app without granting environment-wide privileges. The volunteer can use the app but cannot modify it or access other resources, satisfying the least-privilege requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Share the app directly with the volunteer
Why this is correct
Sharing the app directly grants the volunteer run-only access to that single app, satisfying least privilege. It avoids assigning environment-level roles or maker permissions, so the volunteer cannot edit the app or reach other environment resources.
- ✗
Create a new environment and add the volunteer there
Why it's wrong here
A separate environment isolates resources but grants the volunteer no access to the existing app, and the requirement is running one app in the current environment. It tempts because environment separation is the standard boundary for full isolation, correct when a user must be kept entirely apart from production data.
- ✗
Assign the volunteer the Environment Maker role and share the app
Why it's wrong here
Environment Maker lets the volunteer create and modify apps and connections across the environment, exceeding the run-only requirement. It tempts because Maker is the usual role for someone who must build or edit Power Apps, which is correct when app development, not consumption, is the task.
- ✗
Add the volunteer to the System Administrator role
Why it's wrong here
System Administrator grants full control over the environment, including every app, flow and data source, far beyond running one app. It tempts because administrators do need broad rights to manage environments, which is correct for IT staff maintaining the platform rather than a volunteer consuming a single app.
About these practice questions
One of 701 original PL-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This PL-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PL-900 exam.