Power Platform environments: dev, test and prod

1Step 1: Create the three environments

Open the Power Platform admin center, then Manage > Environments > New. Create one environment per lifecycle stage: for example App-Dev and App-Test as Sandbox, and App-Prod as Production.

For each one, answer Yes to Add a Dataverse data store: solutions, environment variables and pipelines require it. This choice cannot be undone. Pick the same region for all three and assign a security group.

A Developer environment is still an option for development. Starting November 15, 2026, only managed developer environments can be created, limited to one per user, and running apps and flows in them requires a premium license.

Check: The Environments page lists all three environments with their type, region and a Dataverse URL.

2Step 2: Create the publisher and solution in the dev environment

In Power Apps, select the dev environment, then Solutions > New solution. Under Publisher, choose New publisher and fill in Display Name, Name and Prefix (for example nmr). The prefix is added to the name of every table and column you create.

Set the prefix before you create any component: the name of a metadata item can't be changed once it's created. Use a single publisher for all your solutions.

Select Set as your preferred solution. Components created outside a solution context will land there instead of in the default solution.

Check: Under Solutions, the new solution appears as unmanaged with your publisher, and a table created in it carries your prefix.

3Step 3: Isolate configuration: connection references and variables

Create apps and flows from within the solution. A solution flow is bound to a connection reference, not directly to a connection. To add one manually: New > More > Connection Reference.

For any value that differs between environments (SharePoint site URL, list, email address), create an environment variable: New > More > Environment variable. Available data types: Decimal number, Text, JSON, Two options, Data source, Secret.

Before exporting, remove the current value from the solution: Current Value > ... > Remove from this solution. The value stays in dev, but a new value will be requested on import.

Check: The solution's component pane lists your connection references and variable definitions, with no current value exported.

4Step 4: Export the solution

In the UI: select the solution, Export, select Publish all changes, then choose Managed under Export as. Only published components are exported.

Also export an unmanaged version: it's your source, to keep in a version control system. A managed solution can't be exported.

From the command line, sign in to the dev environment, then export both variants. --managed is a switch with no value.

pac auth create --name Dev --environment "App-Dev"
pac solution export --name MaSolution --path .\out\MaSolution.zip --overwrite
pac solution export --name MaSolution --path .\out\MaSolution_managed.zip --managed --overwrite

Check: The out folder contains two .zip files, and pac solution list shows the exported version.

5Step 5: Prepare the deployment settings file

Generate a JSON file from the managed .zip. It lists the environment variables and connection references to fill in.

Create one file per target environment. Fill in Value for each variable and ConnectionId for each reference. The connection ID appears in the connection's URL, under Connections, in the target environment.

pac solution create-settings --solution-zip .\out\MaSolution_managed.zip --settings-file .\settings.test.json

# Expected content (values to fill in)
# {
#   "EnvironmentVariables": [
#     { "SchemaName": "nmr_SiteUrl", "Value": "" }
#   ],
#   "ConnectionReferences": [
#     { "LogicalName": "nmr_sharepoint", "ConnectionId": "",
#       "ConnectorId": "/providers/Microsoft.PowerApps/apis/shared_sharepointonline" }
#   ]
# }

Check: Every entry in settings.test.json has a non-empty value or ConnectionId.

6Step 6: Import into test, then production

A managed solution can't be imported into the environment that holds the original unmanaged solution: you do need a separate test environment.

In the UI, the import asks for a connection for each reference and a value for each variable that has none. From the command line, pass the settings file.

Whoever turns on a flow must own the connections it uses, or have access to them through sharing. Validate in test, then repeat the import in production with settings.prod.json.

pac auth create --name Test --environment "App-Test"
pac solution import --path .\out\MaSolution_managed.zip --settings-file .\settings.test.json --publish-changes --activate-plugins

Check: In the test environment, the solution appears as managed, with the correct version, and its flows are turned on.

7Step 7: Automate deployment with pipelines

Pipelines deploy managed solutions, with connections and variables, from the dev environment. Open the unmanaged solution, go to the Pipelines page, and select Create pipeline.

Prerequisites: all environments have Dataverse, and every target environment is a Managed Environment. Default environments and environments without Dataverse can't be targets of a personal pipeline.

A personal pipeline links at most three environments: one dev and two targets. For more stages, approvals or sharing, an admin sets up a dedicated host in the Deployment Pipeline Configuration app.

Check: From the solution in dev, the deploy button offers the test stage, and the run history shows a successful deployment.

8Step 8: Set up a baseline data policy (DLP)

In the admin center: Security > Data and privacy > Data policy > New Policy. Sort connectors into three groups: Business, Non-business, Blocked.

A single app or flow can't combine connectors from different groups. Put business data connectors (SharePoint, Dataverse, Office 365 Outlook) in Business. Block the ones that have no place in your organization.

Keep Non-business as the default group for new connectors, as Microsoft recommends. Apply the policy to production, then check that your apps and flows remain compliant in test.

Check: The policy appears in the Data policy list with the correct scope, and a flow mixing a Business and a Non-business connector can no longer be saved.