Environment creation, storage and region

What it does

An environment is the container for everything you build in Customer Insights - Data: sources, unification, segments, measures, exports. You choose its type, its Azure region, where its output data physically lands, and which Dataverse organisation it sits on top of. Three of those four are decided once, at creation, and cannot be changed afterwards.

Key facts

Two environment types: Sandbox and Production. Sandbox is for development and testing and does not run scheduled system refreshes — you refresh it by hand.
Region, storage option and the Dataverse linkage are fixed at creation. The only settings you can edit later are the display name, whether it is the default environment, and the owner.
Storage is either Microsoft-managed ("Customer Insights storage") or your own Azure Data Lake Storage Gen2 account. The bring-your-own account must be in the same region as the environment, with hierarchical namespace enabled.
For bring-your-own storage the admin doing the setup needs Storage Blob Data Contributor or Storage Blob Data Owner, either on the storage account or on the customerinsights container.
Two authentication styles for your own lake: resource-based (pick subscription, resource group, storage account) or account name plus account key. With account key you have to update the environment yourself whenever the key rotates.
Output is written per environment as customerinsights/ci_<environmentID>/ with its own model.json. The mapping between a Dataverse organisation and a storage account is one-to-one.
Bring-your-own storage carries real limits: data sharing does not work with a firewalled storage account (use the Enable private link option), and automatic linking of customer profiles into Dataverse is not supported.
Each environment needs a Dataverse environment that does not already have Customer Insights - Data installed. Anyone who is an admin in Customer Insights - Data is given System Administrator in that Dataverse environment.
Creating from a copy of an existing environment is documented as a preview capability. It brings across data sources, unification config, relationships, activities, segments, measures, the search and filter index, exports, the refresh schedule, enrichments, prediction models and role assignments — but no credentials.
Reset clears configuration and user permissions, leaves source data and your own lake alone, keeps the storage connection, and issues a new instance ID. Delete is owner-only; Microsoft points you at Uninstall in the Power Platform admin center instead.

When to use / skip

Take Microsoft-managed storage unless someone can articulate why not. The usual reason to bring your own lake is a data residency or custody argument from the client's legal or security team, or an existing lakehouse that wants the unified output as a first-class input rather than an export. Both are legitimate. What is not legitimate is "we want control" as a vague preference — you pay for it with the Dataverse profile-linking limitation, the firewall restriction and a key rotation job nobody will own in eighteen months.

On sandboxes: have at least one, but be honest with the client that it is not a like-for-like rehearsal environment because nothing refreshes on a schedule there. If the thing you need to test is the schedule itself, you are testing it in production or not at all.

Configuration decisions

Managed storage or your own ADLS Gen2 — and if your own, resource-based auth or account key.
Which Azure region, decided against the Dataverse environment's region and anything downstream in Azure that will read the lake.
Whether to attach an existing Dataverse environment or have one created, and who provisions it — this usually decides whether you go through the Power Platform admin center or the Customer Insights creation flow.
How many sandboxes, and whether the delivery plan tolerates manual refreshes in them.
Who owns each environment, and which second admin exists so ownership can be handed over when that person leaves.
Environment naming, since the picker is the only place most users will ever see it.

Gotchas

Region, storage and Dataverse are one-way doors. Getting the region wrong means recreating the environment, not editing it.
Do not run the Power Platform Copy Environment operation against an environment with Customer Insights - Data installed. It removes the artefacts. Copying configuration is done from inside the Customer Insights creation flow.
After a configuration copy, every data source lands in a "Credentials required" state, Common Data Model and Dataverse sources have to be recreated by hand, connections need reauthenticating and enrichments and exports need turning back on. It is a head start, not a clone.
Reset issues a new instance ID, so bookmarks, saved deep links and anything calling the environment by ID stop working.
Account-key storage authentication fails quietly at the next key rotation, and the symptom shows up as refresh failures rather than an auth error anyone recognises.
Deleting the environment from the picker leaves Customer Insights solutions behind in Dataverse. Removing those means uninstalling every solution whose name starts with msdyn_CustomerInsights, which takes a couple of hours.

Consultant notes

Provision through the Power Platform admin center where the client's governance allows it — it keeps the environment in the same inventory as everything else they run.
Get the region and storage decision signed off in writing by whoever owns Azure at the client. It is the cheapest ten minutes on the project and the most expensive thing to undo.
Demo the environment picker and the edit pane early so the client sees for themselves how little is editable later.
Check the published service limits before promising design headroom — active segments and active measures together are capped at 1,000 before performance degrades.
Before go-live, confirm there are at least two admins and that the named owner is not the contractor who is leaving in a fortnight.

Worth another look once copy-environment leaves preview, or if bring-your-own-lake picks up Dataverse profile linking.