Almanac
Microsoft/power-automatePower Platform

Consultant KB for Microsoft Power Automate end to end: cloud flows, desktop flows and RPA, connectors and integration, AI and agent flows, process and task mining, approvals and human-in-the-loop, ALM and solutions, governance and security, licensing and capacity, monitoring and troubleshooting, plus cross-cutting decision guides. Implementation notes, configuration decisions and the gotchas that bite on real projects. Populated by the daily author agent from the Power Automate release plans, docs repo and product blog, plus the author's own consultant notes.

power-automate/08-governance-and-security/feature-managed-environments.md
feature-managed-environments.mdv1 · history
CurrentApplies to AllUpdated last monthSource Microsoft Learn ↗

What it does

Managed Environments is a switch on an individual environment that turns on a set of premium admin controls — sharing limits, weekly usage digests, solution checker enforcement, IP firewall, pipelines and more. It works on any environment type, and once an environment is managed, further platform features become available to it.

Key facts

  • Turned on per environment from the admin centre, not tenant-wide. You choose which environments get it.
  • Limit sharing controls how far makers can share canvas apps, solution-aware cloud flows and agents. For cloud flows it's a blunt on/off — either makers can share solution-aware flows with anyone, or they can't share them at all.
  • Weekly usage insights email a digest of environment activity to admins.
  • Solution checker enforcement can warn on, or outright block, solution imports that fail the checker.
  • IP firewall restricts which IP ranges can reach the environment, with IP cookie binding available alongside it to blunt cookie replay.
  • Pipelines in Power Platform, maker welcome content, default environment routing, catalog administration, virtual network support, customer-managed keys, Lockbox and extended backup all sit behind the managed flag.
  • Exporting Power Automate telemetry to Application Insights is a Managed Environments feature.
  • It's included as an entitlement with standalone Power Apps, Power Automate, Copilot Studio, Power Pages and Dynamics 365 licences. Every user of a managed environment needs a qualifying licence.
  • The Developer Plan doesn't include the Managed Environments entitlement when users run their assets.
  • Sharing rules take up to an hour to start being enforced after you set them.

When to use / skip

Turn it on for production environments where you already know who the makers are and what's running. The sharing limits and solution checker enforcement are the two features that change behaviour rather than just reporting on it, and they're the ones worth the argument. Leave sandbox and personal-productivity environments unmanaged unless the client is happy to pay for every user who touches them. The awkward middle case is the default environment — it usually holds the most ungoverned flows and the largest user population, which is exactly why managing it costs the most.

Configuration decisions

  • Which environments get managed, and whether the licence entitlement actually covers everyone in them.
  • Whether solution checker enforcement warns or blocks, and who has the override.
  • Whether solution-aware cloud flow sharing is on or off, given there's no middle setting for flows the way there is for canvas apps.
  • Whether IP firewall is in audit mode first or straight to enforce, and whether your gateway and service account traffic is in the allowed ranges.
  • Who receives the weekly usage insights, and whether anyone will actually read them.

Gotchas

  • Existing shares aren't retrospectively removed when you apply sharing rules. Anything already out of compliance can only be un-shared until it's back within the rules.
  • Cloud flow sharing limits only apply to solution-aware flows. Non-solution flows sit outside this control entirely, which quietly undermines the policy if your estate is mostly non-solution.
  • Licence enforcement is real. Turning on Managed Environments on an environment full of users on seeded licences is a procurement conversation you want to have before, not after.
  • Solution checker enforcement set to block will stop deployments on the day you turn it on, not the day someone writes bad code. Run the checker across existing solutions first.
  • IP firewall applies to the environment, so anything calling in — gateways, service principals, external integrations — needs its egress addresses accounted for.

Consultant notes

  • Sell it as the control plane for environments you've already decided matter. Clients who turn it on everywhere find the licence bill first and the value second.
  • The weekly digest is the cheapest way to give a client's platform owner a sense of ownership. Set it up early even if nothing else is enforced yet.
  • Managed Environments is a moving target — Microsoft keeps adding features behind the flag. Check the current feature list at the start of every engagement rather than trusting a slide from last year.
  • If the client wants app-level or flow-level sharing control finer than what's offered, set expectations early. The cloud flow control is on or off.

Check the feature list again each release wave — Microsoft keeps moving capabilities behind this flag.

Was this accurate?
Related
Deployment patterns and environment strategy07-alm-and-solutionsEnvironment and ALM strategy11-decision-guidesPower Platform admin center08-governance-and-securityCoE Starter Kit08-governance-and-securityApplication Insights integration10-monitoring-and-troubleshootingFlow analytics10-monitoring-and-troubleshooting