Restrict production and sandbox environment creation to administrators

Description

The Power Platform tenant setting Production environment assignments is set to Only specific admins. Only Global Administrators, Dynamics 365 Administrators and Power Platform Administrators can then create production and sandbox environments; users request new environments through the platform team.

Rationale

An environment created by a maker is outside the review of the platform team: data policies scoped to listed environments do not cover it, its security roles and sharing are set by the creator, and it can hold a Dataverse database with business data that nobody inventories. Restricting creation keeps every production or sandbox environment known, assigned to an owner and covered by data policies.

Impact

Makers can no longer create production or sandbox environments themselves. Provide a request process (for example a form handled by the platform team, or environment groups with rules). Environments created before the change remain manageable by their creators.

Setting

Audit

1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at least a Global Reader.
2. Browse to Manage > Tenant settings and open Production environment assignments.
3. Check that it is set to Only specific admins.
4. Alternative, read only (Power Platform Administrator): with the Microsoft.PowerApps.Administration.PowerShell module, run Add-PowerAppsAccount, then (Get-TenantSettings).disableEnvironmentCreationByNonAdminUsers.
5. Fail if the setting is Everyone (disableEnvironmentCreationByNonAdminUsers is False).

Remediation

1. In the Power Platform admin center, browse to Manage > Tenant settings > Production environment assignments. Role: Power Platform Administrator.
2. Select Only specific admins and Save.
3. PowerShell equivalent: Set-TenantSettings -RequestBody @{ disableEnvironmentCreationByNonAdminUsers = $true }.
4. Review the existing environments (Manage > Environments) and assign an owner and a data policy to each.

Rollback

Set Production environment assignments back to Everyone.

References

• Control environment creation and management Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-002 Restrict trial environment creation to administrators
• related CB-M365-POWER-004 Cover every non-default Power Platform environment with a data policy
• related CB-M365-POWER-008 Restrict Power Pages site creation to administrators

People and lifecycle