Restrict trial environment creation to administrators

Description

The Power Platform tenant setting Trial environment assignments is set to Only specific admins. Users who want to evaluate a product ask the platform team, which creates the trial in a governed way.

Rationale

Trial environments are often created on impulse, filled with real data to test a scenario, and forgotten. They are outside the data policies scoped to known environments and outside the inventory until they expire. Restricting their creation to administrators avoids unmanaged copies of business data and connectors.

Impact

Users can no longer start trials of Power Apps, Power Automate or Dynamics 365 environments themselves. Provide a request process. Existing trial environments are not affected.

Setting

Audit

1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at least a Global Reader.
2. Browse to Manage > Tenant settings and open Trial environment assignments.
3. Check that it is set to Only specific admins.
4. Alternative, read only (Power Platform Administrator): (Get-TenantSettings).disableTrialEnvironmentCreationByNonAdminUsers after Add-PowerAppsAccount.
5. Fail if the setting is Everyone (disableTrialEnvironmentCreationByNonAdminUsers is False).

Remediation

1. In the Power Platform admin center, browse to Manage > Tenant settings > Trial environment assignments. Role: Power Platform Administrator.
2. Select Only specific admins and Save.
3. PowerShell equivalent: Set-TenantSettings -RequestBody @{ disableTrialEnvironmentCreationByNonAdminUsers = $true }.

Rollback

Set Trial environment assignments back to Everyone.

References

• Control environment creation and management Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-POWER-001 Restrict production and sandbox environment creation to administrators

People and lifecycle