Remove access from Default environment and all apps and flows

[GarryPope]

Hello Power Apps Community,

I have a question please, which I hope you can help with.

In our Default environment all our users have access to this.

Let's say I have a user called John and I want to deny him access into the Default environment and all the apps and flows too (personal and shared).

I checked in the Power Platform Admin Centre, selected the Default environment, found John's user record and removed two security roles he had:  "Common Data Service User"; "Environment Maker". 

Yet, when John goes to https://make.powerapps.com/ he still has access and can create Flows and edit Flows. 

Is this more to do with the Office 365 E5 license, rather than the access to the environment?

How do I completely stop John from doing anything in the Default environment, but I don't want to remove his license.

Any help would be greatly appreciated.

Thanks very much,

Garry

[Pstork1 · Accepted solution]

There is no way to remove someone's access to the default environment other than removing their license to Power Apps.  MS uses Power Apps and Power Automate for things like custom forms and workflows in SharePoint online.  So all user's are granted access to the default environment and that can't be changed.  The best you can do is audit John's access to the default environment using the Security and Compliance center.  There you can setup alerts that will fire for various activities, like John creating and sharing an app.

[jlindstrom]

In addition to @Pstork1 excellent suggestion you should also check out the cow starter kit. It has some excellent tools to audit app creation and be alerted if someone creates an app in a certain environment. 

You can also further restrict your default app environment by restricting connectors in the default environment

[Pstork1]

I think you mean the COE starter kit.  😁

[jlindstrom]

How do you start your cow?

[jamilhaddadin12]

Can you please explain more @du .
Removing the seeded license "Power Apps for Office 365" will not block the users from accessing & creating apps on the default environment.

Reference https://docs.microsoft.com/en-us/power-platform/guidance/adoption/environment-strategy

[Pstork1]

That documentation doesn't talk about what happens when you remove a user's license SKU for Power Apps.  If you try it you will find that they get an error message when they try to run any app in any environment, even the default one, if they don't have a license.  Yes, you can create apps without a license, but you can't run them in production.

[jamilhaddadin12]

Thank you @Pstork1 . I have tried it now & noticed that I can still run a power automate flow even if I don't have a license (this video is shared until 12-Mar-2022)

https://1drv.ms/v/s!AidNfyufn6iQo9RliFKvvVCotDSggw?e=sqyu0l

[Pstork1]

This thread was about running Power Apps, not Power Automate Flows. Removing the Power Apps license won't affect your ability to run Flows.

[jamilhaddadin12]

I thought the thread is about both based on the title.

Anyway, in the uploaded video; i have removed both power automate & power apps licenses, and the user still can create power automate flows.