Disabling self-service Trial overview
When evaluating the new adoption of Office 365 products and services within your organization, it is important to understand what governance and policies need to be in place prior to rolling out new features. One important decisions is to understand who should have the ability to utilize the Power Platform (PowerApps, Microsoft Flow, and Power BI). In some instances you make want to lock this down if you are concerned with Data Security. Disabling self-service trial licenses is a key step for administrators to be able to control this.
In some cases, sensitive business data can be secured through application permissions and Data Loss Prevention (DLP). However, with the introduction of PowerApps, Microsoft Flow, and Power BI, there may still be some situations where you will need measrures to protect data and limit the number of unmanaged applications that exist within your environment.
This article will explore and highlight important loop-holes that enable users to access these products, even after core features and licenses have been disabled.
Process for Disabling Self-Service Trial
The most important thing to understand, is that there is no way to 100% disable trial product usage within your environment. The following steps outline ways of prevention and management. Key areas to help mitigate risk and increase prevention include:
- Management of user licenses
- Management of Company Settings
Management of User Licenses
One way reduce the usage of these products is by disabling end user licensing. An Office 365 Administrator has the ability to control licenses for individual applications on a user-by-user basis. The image below reflects how to manually “uncheck” to disable this applications. You can get to these screens by navigating to:
Microsoft 365 Admin Portal > Users > (Select User) > Manage Product Licenses
There are also ways to automate licensing management by assigning licenses to those who belong to certain group memberships.
Note: If a user has already accepted a trial license, it will appear in the list of the applications they have access to (e.g. “PowerApps Trial” and “Flow Trial”). It is important to disable these applications as well.
Management of Company Settings
After the licenses have been removed from the users, they will still be presented with the option of signing up for a 90 day trial for each of these products. There are ways to limit the use of these types of licenses by disabling self-service trial licenses through the admin portal.
Microsoft 365 Admin Portal > Settings > Services & Add-Ins > User Owned Apps and Services
You will want to disable “Let users install trial apps and services” in order to further limit it’s use.
There are also ways to disable this setting through PowerShell (Run as Administrator). Below is a code snipped of how this can be achieved:
Install-Module MSOnline Connect-MsolService Set-MsolCompanySettings -AllowAdHocSubscriptions $false
Disabling Self-Service Trial User Experience
Through the disabling of licenses, you will be able to limit about 90% of the users within your organization from creating PowerApps, Flow, and Power BI resources without approval. To the end user, they will no longer see the Tile visible for these products in the Office 365 App Launcher.
There may be instances however, where users are able to directly navigate to certain URLs and begin creating these resources within your production environment. With the trial license also disabled, you will now be able to prevent about 99% of the users within your organization. If they navigate to the following URLs and select “Sign Up for Free”, they will receive an error message preventing them from signing up.
- https://powerapps.microsoft.com/en-us/
- https://flow.microsoft.com/en-us
- https://powerbi.microsoft.com/en-us
Unfortunately, there is a loop hole, where if users select the option to “Sign In” from these pages, they will still be able to move forward to with the Trial License registration from Desktop and Mobile devices. If your environment is configured properly, this may only apply to about 1% of the organization.
Considerations
- Community Plan: Individuals may still be able to sign up for a Microsoft PowerApps Community Plan. This may be acceptable however, since the resources are stored separately from your production environment.
- Common Data Service: If your solutions use the Common Data Service, administrators will be able to limit who can create applications that use production resources.
Recommendations
Although there is no way to 100% prevent users from creating PowerApps, Flows, and Power BI reports within your environment, these policies will make the management of these products easier, especially with larger organizations.
I strongly recommend setting up alerts and reporting within the Security & Compliance Center so that administrators get notified when new PowerApps and Flows get created. That way, there is an opportunity to unpublish these resources before they are broadly shared.
For the latest updates, please visit the Microsoft 365 Roadmap.
