What flipping 'managed' on gives you
Managed Environments is a set of governance features you enable per environment (a toggle, not a separate environment type). Turning it on unlocks:
| Feature | What it controls |
|---|---|
| Sharing limits | Cap canvas-app sharing — no sharing, limited count, or no sharing with security groups |
| Usage insights | A weekly digest of the most-used and inactive apps/flows |
| Data policies view | Which DLP policies apply, surfaced in context |
| Solution checker enforcement | Block imports that fail static analysis |
| Maker welcome & onboarding | Guidance content shown to makers |
| IP firewall / customer-managed keys | Network and encryption controls (advanced) |
| Pipelines | Governed dev→test→prod deployment (ALM concept) |
The licensing reality
Managed Environments is not free: every user of an app or flow in a managed environment must hold a standalone premium Power Apps / Power Automate licence (or the app must be covered by a pay-as-you-go plan) — the Microsoft 365 seeded use rights do not cover managed environments. That is the deliberate trade: the governance features are gated behind premium licensing.
Failure modes
- Sharing limits are per-environment, not tenant-wide by default. Enabling them on production but leaving the default environment unmanaged leaves the worst sprawl untouched.
- Assuming 'managed' means 'governed'. The toggle enables controls; someone still has to configure sharing limits and act on the weekly digest. On with defaults is barely different from off.
- Licensing shock. Flipping managed on can retroactively make previously seeded-licence apps require premium — audit coverage before enabling.
What to watch (proofs)
- Which environments are managed:
Get-AdminPowerAppEnvironmentreturns the governance configuration /Get-AdminPowerAppEnvironmentGovernanceConfiguration— an unmanaged production or default environment is the finding. - Sharing-limit configuration per managed env (admin center → environment → Settings) — 'no limit' defeats the feature.
- The weekly usage digest: inactive apps/flows and top sharers — the cleanup and over-sharing queue.
- Licence coverage vs managed-env membership (
Get-MgUserLicenseDetail) — users in a managed env without premium are broken-app or cost risk.