Description

Many enterprise organizations rely on Security Groups to control access to Power Platform environments and align platform usage with governance, compliance, billing, and lifecycle management requirements.

Currently, the Default Environment does not support Security Group restrictions, which makes it impossible for administrators to prevent specific users from creating apps, flows, agents, and other Power Platform resources.

This creates significant governance challenges for large organizations, especially educational institutions, government agencies, and enterprises that:

• Need centralized control over resource creation.
• Require departmental ownership and chargeback models.
• Must prevent students or unmanaged users from creating resources.
• Manage application lifecycle through dedicated managed environments.
• Need visibility into who can create and host platform resources.

Although environment routing, DLP policies, Managed Environments, Conditional Access, and other governance features can help reduce risk, they do not fully address the core requirement: preventing unauthorized creation in the Default Environment.

Requested Enhancement

Please restore the ability to assign a Microsoft Entra Security Group to the Default Environment, similar to other Power Platform environments.

Alternatively, provide one or more of the following:

1. An administrator-controlled option to disable implicit Environment Maker permissions in the Default Environment.
2. A tenant-level setting to block creation of Power Platform resources in the Default Environment for selected users or groups.
3. A licensing option that allows users to consume applications in managed environments without automatically granting creation capabilities in the Default Environment.

Business Impact

Without this capability, organizations face:

• Governance and compliance risks.
• Uncontrolled AI and platform consumption.
• Unauthorized application and agent creation.
• Orphaned resources with no clear ownership.
• Increased administration and support overhead.
• Challenges implementing departmental billing and accountability.



Providing Security Group support for the Default Environment would significantly improve enterprise governance while remaining fully compatible with organizations that prefer the current default behavior.