# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-POWER-001
title: Restrict production and sandbox environment creation to administrators
finding:
  title: Any licensed user can create production and sandbox Power Platform environments
  description: Users can create new environments outside the data policies and security settings administrators maintain.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [power-platform, environments, governance, least-privilege]

description: |
  The Power Platform tenant setting **Production environment assignments** is set to **Only
  specific admins**. Only Global Administrators, Dynamics 365 Administrators and Power Platform
  Administrators can then create production and sandbox environments; users request new
  environments through the platform team.
rationale: |
  An environment created by a maker is outside the review of the platform team: data policies
  scoped to listed environments do not cover it, its security roles and sharing are set by the
  creator, and it can hold a Dataverse database with business data that nobody inventories.
  Restricting creation keeps every production or sandbox environment known, assigned to an owner
  and covered by data policies.
impact: |
  Makers can no longer create production or sandbox environments themselves. Provide a request
  process (for example a form handled by the platform team, or environment groups with rules).
  Environments created before the change remain manageable by their creators.

setting:
  location: Power Platform admin center > Manage > Tenant settings > Production environment assignments
  default_value: Everyone
  recommended_value: Only specific admins

audit:
  manual: |
    1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at
       least a Global Reader.
    2. Browse to **Manage** > **Tenant settings** and open **Production environment assignments**.
    3. Check that it is set to **Only specific admins**.
    4. Alternative, read only (Power Platform Administrator): with the
       `Microsoft.PowerApps.Administration.PowerShell` module, run `Add-PowerAppsAccount`, then
       `(Get-TenantSettings).disableEnvironmentCreationByNonAdminUsers`.
    5. Fail if the setting is **Everyone** (`disableEnvironmentCreationByNonAdminUsers` is
       `False`).

remediation:
  manual: |
    1. In the Power Platform admin center, browse to **Manage** > **Tenant settings** >
       **Production environment assignments**. Role: Power Platform Administrator.
    2. Select **Only specific admins** and **Save**.
    3. PowerShell equivalent: `Set-TenantSettings -RequestBody @{
       disableEnvironmentCreationByNonAdminUsers = $true }`.
    4. Review the existing environments (**Manage** > **Environments**) and assign an owner and a
       data policy to each.
  rollback: |
    Set **Production environment assignments** back to **Everyone**.

references:
  - title: Control environment creation and management
    url: https://learn.microsoft.com/power-platform/admin/control-environment-creation
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: CISA SCuBA Power Platform baseline
    url: https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/powerplatform.md
    publisher: CISA
    kind: standard
    accessed: 2026-10-24
mappings:
  - framework: cisa-scuba-m365
    framework_version: "2.0.0"
    id: MS.POWERPLATFORM.1.1v1
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-6(10)
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: CM-5
    relation: related
threats:
  - framework: mitre-attack
    id: T1567
related_controls:
  - id: CB-M365-POWER-002
    type: related
  - id: CB-M365-POWER-004
    type: related
  - id: CB-M365-POWER-008
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24