What it does

A single page in the Power Platform admin centre (Manage > Tenant settings) holding the switches that apply across every environment in the tenant — who can create environments, whether makers get Copilot features, whether canvas app insights work, auto-claim licence policies, and a couple of dozen others. It's the first place to look when a maker says "I can't do X" and the second place to look when something works that shouldn't.

Key facts

• Access needs Global Administrator, Power Platform Administrator or Dynamics 365 Administrator. There's no read-only view of this page for anyone else.
• Environment creation is split into three separate settings: Production environment assignments, Trial environment assignments and Developer environment assignments. Each can be set to Only specific admins.
• Restricting creation is not retroactive. Environments created before the restriction stay manageable by whoever created them.
• Under the current provisioning model, any suitably licensed user can create an environment as long as 1 GB of capacity is free — that's the default you're overriding.
• Developer environments are single-user by design and can't be shared. Creation can also be blocked via disableDeveloperEnvironmentCreationByNonAdminUsers in tenant settings.
• PowerShell equivalents exist for all three: DisableEnvironmentCreationByNonAdminUsers, DisableTrialEnvironmentCreationByNonAdminUsers, and the developer setting above.
• Canvas app insights is a tenant toggle. Application Insights instrumentation in canvas apps produces nothing visible until an admin turns it on.
• Auto-claim policies for Power Apps control where licences get assigned automatically to users who need them — the practical mitigation for managed environment licence gaps.
• Four settings on the page apply only to managed environments: Customer Lockbox, Environment routing, Weekly digest, and the desktop-flow-in-data-policies visibility setting sits adjacent to them.
• Environment routing automatically sends new or existing makers into their own personal developer environment instead of the default one.
• Tenant capacity summary and tenant licensing summary visibility are each their own setting, controlling whether environment admins can see them or only tenant admins.

When to use / skip

Lock down production and trial environment creation on day one of any engagement — uncontrolled trial environments are how a tenant ends up with forty environments and no capacity. Developer environments are a genuinely finer judgment: blocking them stops the personal sandbox that makes the platform learnable, so the better move on most projects is to allow them, turn on environment routing so makers land somewhere sensible instead of the default environment, and accept the sprawl as the price of not having everything built in default. Leave the Copilot and feedback toggles to the client's own policy — they're not your call and they change often.

Configuration decisions

• Whether production, trial and developer environment creation are each restricted to admins, and whether that's a permanent position or a phase.
• Whether environment routing is on, which is the single most effective way to keep the default environment clean.
• Whether canvas app insights is on, because the telemetry workstream depends on it and nobody thinks to check.
• Whether auto-claim policies handle premium licence assignment, or whether that stays a manual admin process.
• Who can see tenant capacity and licensing summaries — environment admins or tenant admins only.
• Who can allocate add-on capacity to environments, which is its own setting and matters once per app plans are in play.

Gotchas

• The retroactive gap catches everyone. You restrict creation, everyone relaxes, and the twelve environments someone spun up last quarter are still theirs to manage.
• The default environment can't be deleted, has 3 GB database, 3 GB file and 1 GB log capacity included, and every user in the tenant is a maker in it. Restricting environment creation without a story for the default environment just concentrates the sprawl.
• Trial environments and developer environments don't count against tenant storage capacity, which sounds like good news and is actually why they proliferate unnoticed.
• Turning off environment creation doesn't stop self-service licence purchase, which is a separate setting in the Microsoft 365 admin centre.
• Some settings are only reachable through PowerShell or the tenant settings API, and the UI list isn't the complete list. Get-TenantSettings is worth running to see the full object.

Consultant notes

• Ask for a screenshot or an export of tenant settings during discovery. Half the surprises on a Power Platform project are on this one page and nobody volunteers them.
• Frame environment creation restriction as capacity management rather than control. Clients accept "we'd run out of storage" faster than "we don't trust makers".
• Warn that changing environment routing mid-programme will move where makers' personal apps live. Do it before you onboard the maker community, not after.
• Get a named owner for tenant settings. These are the settings that get changed by whoever had a ticket that week, and there's no change history anyone routinely reviews.

---

Worth another pass each release wave — Microsoft adds settings to this page more often than it documents them clearly.