Default environment Set to Managed Environment Impact

[byrnep]

We're want to set the Default environment to Managed to ensure that we control what gets made and where.

What is the impact of setting Default as a managed environment? 

We have identified the below so far.  Is there anything else?

1 M365 Apps/Automate created from 'Integate' menu will be blocked.  However we know we can set a new 'default' for canvas apps, but is there a similar option for automate flows?

Manage the default environment - Power Platform | Microsoft Learn

2 Premium licensed users will still be able to access Default

[Velegandla]

@byrnep 

My recommendation is not to enable default to a managed environment.

The starter kit is good enough to know what is made in the environment and who builds the solutions.

Managed environment will be cost-effective when you leverage most of the features.

You need licenses for all the people (Power apps and Power Automate, etc) who are building solutions using managed environments. That will become expensive. 

https://learn.microsoft.com/en-us/power-platform/admin/managed-environment-licensing 

Default environment should be personal productivity only. 

Once environment routing is available, you can enable the developer environments and then leverage the managed environment capabilities. 

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/ 

[byrnep]

@Velegandla  Thanks, however we are not allowing people to build whatever they want due to support issues.

We are going to implement an intake process, that supports work that creates value only.  I know this is counter to MS approach.

As an organization, we also focus almost exclusively on funded projects, in the pro dev area. 

Unfortunately the standard MS approach of build anything and then elevate anything with value is a support challenge and we don't have the capacity.

So, are there any issues beyond what I listed for making Default managed?

[Velegandla]

@byrnep 

How is enabling a managed environment going to stop people from building solutions?

The only option I can think of is limit sharing. 

A managed environment does not stop people from building solutions in any environment, and it would be the same for a default environment. 

Another thing to consider is the current state of your default env. Do you have a lot of solutions?

Then, making a managed environment means you need premium licenses for all users using those apps/flows.

(I assume you don't have both Power Apps and Power Automate licenses for all users). 

Also, did you limit the number of connectors? If not that is something to focus on. 

For now, the best option is to update the security roles to disable Canvas apps and Model-driven app-sharing capabilities. 

Also, the guidelines on what people can or can't do in the default environment should be created and published.

Monitor via starter kit and then take appropriate action based on guidelines.

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/ 

[byrnep]

@Velegandla Everyone has Office E5 licenses only, except Pro teams have premium.  Managed environments require premium licenses. That will block the vast majority of people from using default.

Managed environments themselves don't stop people but the licensing does. 

Also, by default behaviour user have the Maker role assigned.  Being able to turn that off would work but you can't.

What do you mean by ' update the security roles to disable Canvas apps and Model-driven app-sharing capabilities'?

[Velegandla]

@byrnep 

Interesting approach.

What happens to the existing applications in the default environment? 

You let them die, or are you planning to migrate them?

Below are the default settings for canvas App permissions within the maker role.

You can update it to disable the sharing.

This will stop people sharing the apps. 

You can do the same for model-driven apps if Dataverse is enabled in the default environment.

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/ 

[byrnep]

@Velegandla Do the changes persist? We removed the role from the environment in the past and it was readded next day.

Likely the issue with Default is that is the backing store for M365, and if you mess with it it will break M365.

[Velegandla]

@byrnep 

It does persists. 

Don't remove the role rather update the role.

What impact did you see on M 365 when you update the role?

====================================================

If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

https://www.linkedin.com/in/devendravelegandla/