… 10 unchanged lines …
  - Some settings are PowerShell-only in practice — the tenant's **preferred environment location**, set through `Set-TenantSettings`, is a good example.
  - Backup retention for production Managed Environments is settable through `Set-AdminPowerAppEnvironmentBackupRetentionPeriod` and readable through `Get-AdminPowerAppEnvironment`.
  - Deleted environments can be recovered with `Recover-AdminPowerAppEnvironment` within seven days, or up to 28 days for production environments carrying Dynamics 365 applications.
+ - **RBAC in the admin centre doesn't cover the whole API yet.** As of September 2026 role-based access control applies to all Power Pages endpoints, all environment-management endpoints except *List Environments for User* and *Get Environment by ID for User*, and all governance endpoints except the cross-tenant connection report endpoints. Everything else still falls back to the tenant-wide admin roles.
+ - Environment lifecycle endpoints — copy, backup, restore, failover — went GA in the public cloud in August 2026. Sovereign clouds are scheduled for 1 December 2026, not before.
  - The CLI covers environment lifecycle, authentication, solution packaging, Power Pages and code components — it's the developer-side tool rather than the tenant-governance one.
  
  ## When to use / skip
    … 12 unchanged lines …
  - Environment history is deleted with the environment, so scripted deletions need to log what they did somewhere durable if you ever want to answer "who removed this".
  - Setting backup retention through PowerShell on anything other than a production Managed Environment silently has no effect — the value is accepted and the seven-day default still applies.
  - Environment group rules override environment-level settings. A script that sets a value directly can be quietly outranked.
+ - Scoping the automation identity with RBAC instead of a tenant-wide admin role sounds like the right answer in a security review, and then you find the specific endpoint your script needs is one of the ones RBAC doesn't cover yet. Check the supported-endpoint list before you promise least privilege — the gaps are named, not implied.
+ - A sovereign-cloud client can't have the scripted copy/backup/restore pipeline the public-cloud client just got. Worth saying out loud in December 2026 planning rather than discovering it during the build.
  
  ## Consultant notes
  - Deliver the inventory script before the governance workshop. Nothing moves a tenant governance conversation faster than a spreadsheet of every environment, owner, region and capacity figure.
    … 3 unchanged lines …
  
  ---
  
- *Worth revisiting once more management-plane capability lands in the Power Platform API, or if the PowerShell modules are consolidated again.*
+ *Worth revisiting once more management-plane capability lands in the Power Platform API, when RBAC endpoint coverage widens, or after the 1 December 2026 sovereign-cloud date.*