Task 03: Integrate governance and observability
01: Configure access and governance controls
Set up the roles, permissions, and environment-level governance needed to ensure secure and compliant operations across Dev, UAT, and PRD. This includes assigning appropriate access to deployment pipelines, and enforcing operational policies such as sharing limits, environment guardrails, and access control configurations.
Grant team members access to deployment pipelines Assign appropriate user roles and permissions so authorized users can access, run, and manage the deployment pipeline securely.
| Role to assign | When to Use / Assign | Purpose |
|---|---|---|
| Deployment Pipeline Administrator | Configure, modify, or manage pipelines | Grants full control over pipeline configuration and access to the Deployment Pipeline Configuration app. |
| Deployment Pipeline User | Only run or trigger deployments | Allows a user to run pipelines that have been shared with them. |
| Deployment Pipeline Default | Use this when defining your standard or baseline pipeline governance model | Serves as a naming or documentation label for your standard baseline configuration related to pipeline access. |
-
From the browser tab bar, navigate to the Power Platform admin center - **Environments Power Platform admin** tab. -
Select the Zava Retail Store - Dev environment.
-
On the right side of the page, in the Access section, under Users, select See all.
-
From the users list, select Irvin Sayers.
-
Under Direct Assigned Roles, select Manage roles.
-
For the demo purpose, let us assign Deployment Pipeline Administrator and Deployment Pipeline User to user Irvin Sayers.
In a real environment, you would assign roles based on the company policies to teams.
- Select Save twice.
The goal of this step was to ensure each team member receives only the required level of pipeline access - Administrator for configuring and managing pipelines, User for running deployments - so the deployment process remains controlled, secure, and aligned with organizational ALM standards.
Share records, manage visibility, and access permissions for your record.
-
From the browser tab bar, go to the Deployments Pipeline Active tab.
-
Select the checkbox on the left of Dev → UAT → PRD.
-
On the top action menu, select Share.
-
Under Add user/team, search for
Irvin, press Enter, and then select the result. -
Under Manage share access, check the radio button in front of Irvin Sayers, then review the granular list of permissions available to be granted.
-
Check the Write box. Notice the user automatically gets Read rights as well.
The goal here is to demonstrate how you can control granular access levels on your deployment pipeline records.
Disable Guest access: Manage whether people who are designated in Microsoft Entra as guests in this tenant can access tenant content.
-
In the browser tab bar, go to the Users Power Platform admin center tab.
-
From the left side menu, select Security, then select Identity and access.
-
Open Guest access, then from the list of environments, choose Zava Retail Store - Dev.
-
Select Manage guest access.
-
Disable Block guest user access for this environment, then Save.
-
Repeat the same steps for Zava Retail Store - PRD and Zava Retail Store - UAT.
Enable Microsoft Defender for Copilot Studio AI Agents: Protect AI agents by monitoring for unsafe actions, detecting threats, and safeguarding data through built-in security and compliance controls.
-
From the left side menu, select Threat detection, and then Microsoft Defender - Copilot Studio AI Agents.
-
Make sure Enable Microsoft Defender - Copilot Studio AI Agents is enabled.
-
Select Manage, then choose Zava Retail Store - Dev.
-
Select Set up, then enable the Allow Copilot Studio to share data with a threat detection partner checkbox.
-
On the lower side of the page, choose Block the query, then disable the Allow Copilot Studio to share data with a threat detection partner checkbox.
To keep the demo simple, we are bypassing the security-partner layer so we don’t have to create an Azure Entra App ID.
-
Select Save, then close (X) the blade window.
In a real environment, you’d need to wait until the confirmation message “Connection is on for environment” appears, and then select Close.
02: Enable monitoring and traceability
Activate auditing, logging, and observability settings to track user activity, configuration changes, and deployment behavior across environments. Ensure all pipeline executions, solution movements, and agent actions are captured for full ALM traceability.
Configure Set retention policy for system jobs deletion (Preview): Retention rules help meet regulatory expectations by controlling how long system-generated operational logs are stored, preventing unnecessary data accumulation while still preserving required audit history.
-
From the left side menu, select Manage.
-
Select the ellipses (…) next to Zava Retail Store - Dev, then select Settings.
-
Select Audit and logs, then select Set retention policy for system jobs deletion (Preview).
- Make sure Allow deletion service to delete system jobs is enabled, then perform the following steps:
- Set Successful Jobs to 60.
- Set Failed Jobs to 90.
- Set Cancelled Jobs to Custom (days) and type 7.
- To confirm, select Save.
Configure environment audit logging for Dataverse data: Enable tracking of data operations and configuration changes to support traceability, compliance, and troubleshooting.
-
From the Settings menu, select Audit settings.
-
Under Auditing, enable Start Auditing.
-
Select enable Log access and Read logs and set Retain these logs for to One year (365).
Option Purpose When to Enable Start Auditing Tracks data changes & operations Dev (optional), Test/Prod (recommended) Log Access Tracks who views data Prod (recommended), Test (conditional), Dev (rarely) Read Logs Tracks who views audit logs Prod (recommended), Test/Dev (optional) Retention Controls how long audit logs remain Based on compliance policy -
Select Save.