# Env Strategy

> Power Platform environment strategy and topology. Use when: environment types, developer environments, sandbox, production, environment groups, environment routing, naming conventions, environment provisioning, environment topology, Managed Environments, environment lifecycle, multi-geo, environment variables across environments.

- **Type:** Skill
- **Install:** `agentstack add skill-korchard333-claude-power-platform-community-env-strategy`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [korchard333](https://agentstack.voostack.com/s/korchard333)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [korchard333](https://github.com/korchard333)
- **Source:** https://github.com/korchard333/claude-power-platform-community/tree/main/.claude/skills/env-strategy

## Install

```sh
agentstack add skill-korchard333-claude-power-platform-community-env-strategy
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Skill: Environment Strategy

## When to Use
Trigger when designing environment topology, choosing environment types, provisioning environments, setting up developer environments, configuring Managed Environments, planning multi-geo deployments, or establishing environment naming conventions.

---

## Environment Types

| Type | Purpose | Dataverse | Capacity Cost | Key Characteristics |
|---|---|---|---|---|
| **Production** | Live workloads | Yes | Counts against tenant | Full backup (up to 28 days), full control, cannot be reset |
| **Sandbox** | Dev/test/UAT | Yes | Counts against tenant | Can be copied, reset, deleted; 7-day backup default |
| **Developer** | Personal dev workspace | Yes | Free (does not count) | 1 per user (up to 3), auto-cleanup after 90 days inactive, no sharing |
| **Default** | Auto-created per tenant | Yes | Counts against tenant | All licensed users get Environment Maker role — NOT for production |
| **Trial** | Short-term evaluation | Yes | Free | 30-day expiry, 1 per user, auto-deleted |
| **Dataverse for Teams** | Team-scoped apps | Yes (Teams) | Included with M365 | Security follows Teams membership, limited to 1M rows / 2GB |

### Decision Table: Which Environment Type?

| Scenario | Use This Type | Why |
|---|---|---|
| Individual maker experimenting | **Developer** | Free, isolated, auto-cleanup |
| Team building a proof of concept | **Sandbox** | Shareable, resettable, low-risk |
| Formal testing / UAT | **Sandbox** (Managed) | Copy from prod, Managed Environment controls |
| Production workload | **Production** (Managed) | Full backup, governance, pipeline target |
| Quick demo for stakeholders | **Trial** | No capacity cost, self-service, 30 days |
| Teams-native app ( **Feb 2026 mandate:** Power Platform Pipeline target environments must be Managed Environments. Auto-enabled on pipeline targets starting February 2026.

### Key Capabilities
| Capability | What It Does |
|---|---|
| IP Firewall | Restrict access to specific IP ranges |
| IP Cookie Binding | Prevent session hijacking across IPs |
| Customer Managed Keys | Encrypt at rest with your Azure Key Vault keys |
| Lockbox | Require approval for Microsoft engineer data access |
| Weekly Digest | Usage summary emailed to admins |
| Limit Sharing | Cap how many users an app can be shared with |
| Solution Checker Enforcement | Block deployments failing quality checks |
| Export to App Insights | Telemetry to Azure Application Insights |
| Conditional Access per App | Entra ID conditional access on individual apps |
| VNet Support | Connect to your Azure Virtual Network |
| License Auto-Claim | Automatically assign licenses when users access apps |

### Licensing
Managed Environments is included with:
- Power Apps Premium (per-user)
- Power Automate Premium (per-user)
- Dynamics 365 Enterprise licenses
- Copilot Studio licenses
- Power Pages licenses

NOT included with: Developer Plan (at runtime), M365 seeded licenses, trial licenses.

---

## Environment Variable Cascading

Environment variables let you define configuration once in a solution and set different values per environment.

### Pattern
```
Solution contains:
  environmentvariabledefinition: contoso_ApiBaseUrl (type: String)
    └── environmentvariablevalue: (no default — set per environment)

Dev environment:   contoso_ApiBaseUrl = "https://api-dev.contoso.com"
Test environment:  contoso_ApiBaseUrl = "https://api-test.contoso.com"
Prod environment:  contoso_ApiBaseUrl = "https://api.contoso.com"
```

### Best Practices
- **Never set default values** in the solution for environment-specific config — force explicit values per environment
- **Use deployment settings files** to automate value injection during CI/CD (see `alm` skill)
- **Secret type** environment variables reference Azure Key Vault — use for API keys, connection strings
- **JSON type** for complex configuration (feature flags, endpoint maps)

---

## Multi-Geo Considerations

| Concern | Guidance |
|---|---|
| **Data residency** | Environments store data in the geo where they're created — cannot move after creation |
| **Cross-geo pipelines** | Power Platform Pipelines support cross-geo deployment (when enabled on host) |
| **User latency** | Create environments in the geo closest to the majority of users |
| **Compliance** | Some regulations (GDPR, data sovereignty) require data to stay in specific geos |
| **Geo availability** | Not all features are available in all geos — check [availability matrix](https://learn.microsoft.com/power-platform/availability) |

### Geo Naming in Environment Names
```
Contoso-HR-Prod-AU    ← Australia
Contoso-HR-Prod-EU    ← Europe
Contoso-HR-Prod-US    ← United States
```

---

## Environment Lifecycle

```
Create → Configure (DLP, Managed Env, security) → Active
  │
  ├── Copy (sandbox → sandbox, production → sandbox)
  │
  ├── Reset (sandbox only — wipes data, keeps config)
  │
  ├── Backup → Restore (production: up to 28 days)
  │
  └── Delete (permanent — no undo)
```

### Backup & Restore Cadence
| Environment Type | System Backup | Retention | Manual Backup |
|---|---|---|---|
| Production | Continuous (every ~1 hour) | Up to 28 days | Yes |
| Sandbox | Continuous | 7 days | Yes |
| Developer | None | None | No |
| Default | Continuous | 7 days | Yes |

### Pre-Deployment Backup
Always take a manual backup before deploying to production:

```powershell
# PowerShell — backup before deployment
$envId = "00000000-0000-0000-0000-000000000000"
$backupLabel = "Pre-deploy-v2.1.0-$(Get-Date -Format 'yyyy-MM-dd')"

# Using Power Platform admin connector or Admin API
# Power Platform Admin Center → Environments → [env] → Backups → Create
```

---

## Anti-Patterns

- **Everyone builds in the default environment** — leads to ungoverned sprawl, no ALM possible, data comingled
- **No DLP on developer environments** — makers learn bad habits with unblocked connectors, then can't deploy to prod
- **Manual environment creation for each developer** — use developer environments (free, self-service, auto-cleanup) instead
- **No Managed Environments on pipeline targets** — will break after Feb 2026 mandate
- **Skipping the test/UAT stage** — deploying from dev straight to production with no intermediate validation
- **Using production environment for development** — risk of data corruption, no reset capability
- **No naming convention** — impossible to identify environment purpose at scale
- **Ignoring environment variable cascading** — hardcoding URLs/keys per environment instead of using env vars in solutions
- **Creating sandbox environments without cleanup plan** — sandbox sprawl consumes capacity
- **No environment groups** — managing 50+ environments individually instead of as governed collections

---

## Related Skills

- `alm` — CI/CD pipelines, solution promotion across environments
- `governance` — DLP policies, tenant settings applied per environment
- `licensing` — Managed Environment licensing requirements
- `security` — Security roles and access control per environment

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [korchard333](https://github.com/korchard333)
- **Source:** [korchard333/claude-power-platform-community](https://github.com/korchard333/claude-power-platform-community)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-korchard333-claude-power-platform-community-env-strategy
- Seller: https://agentstack.voostack.com/s/korchard333
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.