Exercise - Configure a tenant and environment security baseline

  • 30 minutes

In this exercise, you configure a security baseline for Zava's Power Platform tenant. You restrict environment creation to prevent sprawl, configure sharing limits through Managed Environments to protect Zava Pay's regulated environment, set up an IP firewall in audit mode, and associate a security group to control environment access.

This exercise should take approximately 30 minutes to complete.

Prerequisites

  • Access to a Power Platform tenant with Global Administrator or Power Platform Administrator role
  • At least two environments (one simulating a regulated production environment, one simulating a development environment)
  • Managed Environments enabled on the production environment
  • One or more Entra ID security groups available for assignment

Note

If Managed Environments isn't already enabled on your production environment, go to the environment in the Power Platform admin center, select Overview, and then select Enable Managed Environments. Follow the prompts to accept the terms and enable the feature. This process might take a few minutes.

Restrict environment creation

Lock down environment creation to prevent uncontrolled environment sprawl across the tenant:

  1. Sign in to the Power Platform admin center.
  2. Go to Manage > Tenant settings.
  3. Under Production environment assignments, select Only specific admins.
  4. Under Developer environment assignments, decide based on your governance posture:
    • Select Everyone if you want makers to have personal development spaces.
    • Select Only specific admins if you require all environments to be centrally provisioned.
  5. Under Trial environment assignments, select Everyone (or restrict if needed).
  6. Select Save.
  7. Verify the settings saved successfully by refreshing the page and confirming your selections persist.

Tip

For Zava's governance model, restricting production and sandbox creation to admins while allowing developer environments for all makers is a common balanced approach.

Configure sharing limits

Set sharing governance on the regulated environment to limit how broadly apps and flows can be shared. This control is key for PCI-DSS compliance in Zava Pay:

  1. In the Power Platform admin center, select Environments and then select your production or regulated environment.
  2. Select Edit Managed Environments on the environment overview page.
  3. Under Sharing limits, configure canvas app sharing:
    • Enable Exclude sharing with security groups.
    • Set the maximum number of individuals who can share a canvas app to 20.
  4. Under Solution-aware cloud flows, disable sharing if appropriate for your regulated scenario.
  5. Select Save.
  6. Confirm the settings by returning to the environment overview and verifying the sharing limits appear under the Managed Environments configuration.

Note

Sharing limits only apply to canvas apps and solution-aware cloud flows. Model-driven app access is controlled through security roles, not sharing limits.

Enable IP firewall in audit mode

Configure network-based access control for the regulated environment. Start in audit-only mode to observe which traffic would be blocked before enforcing restrictions.

Find your public IP address

Before configuring the IP firewall, you need your current public IP address:

  1. Open a browser and go to https://www.bing.com/search?q=what+is+my+ip.
  2. Note the public IP address displayed in the search results (for example, 203.0.113.45).

Tip

If you're on a corporate network, your public IP might differ from your local machine's IP. Use the publicly visible IP address returned by the preceding search - this is the address that Power Platform sees when you connect.

Configure the IP firewall rule

  1. Select your production environment in the Power Platform admin center.
  2. Go to Security > Identity and access > IP firewall.
  3. Select + New rule.
  4. Enter your public IP address in CIDR format. If your IP is a single address, add /32 (for example, 203.0.113.45/32). If you have a range from your organization, enter the full CIDR block (for example, 203.0.113.0/24).
  5. Under advanced settings:
    • Verify Allow Microsoft trusted services is enabled.
    • Verify Allow application users is enabled.
  6. Enable Audit-only mode - don't switch to enforcement yet.
  7. Select Save.

Note

Keep IP firewall in audit-only mode for at least one week in a real deployment. Review the audit logs to identify legitimate traffic that the firewall would block before switching to enforcement. For this exercise, audit mode allows you to observe the behavior without locking yourself out.

Associate a security group

Restrict environment access to authorized users by associating an Entra ID security group with the regulated environment:

  1. Select your production environment in the Power Platform admin center.
  2. Select Edit on the environment details page.
  3. Under Security group, search for the security group you want to associate with this environment.
  4. Select the appropriate group and select Save.
  5. Wait a few moments for the change to propagate.
  6. Verify access restrictions are applied:
    • Confirm a user who is a member of the group can access the environment.
    • Confirm a user who isn't in the group receives an access denied message when attempting to access the environment.

Note

When you associate a security group with an environment, only members of that group (and users with Global Administrator or Power Platform Administrator roles) can access the environment. Existing users who aren't in the group lose access.

Success criteria

  • Production and sandbox environment creation is restricted to admins
  • Canvas app sharing is limited (security groups excluded, individual cap set to 20)
  • IP firewall is configured in audit-only mode with your public IP address allowed
  • A security group is associated with the regulated environment
  • Access is verified (group member can access, non-member can't)