What Is Administration Mode?
Administration mode is an environment config setting that allows admins to restrict access to a particular environment preventing users from creating, changing or deleting any data. This is enforced because administration mode blocks access to Dataverse for all users other than admins and app makers (system customizers).
This has differing implications for model-driven apps, canvas apps, power pages sites and power automate flows.
When an environment is in administration mode, a model-driven app cannot be accessed. Because administration mode blocks access to Dataverse data, and it is Dataverse that defines a model-driven app, the app cannot be launched.
However, I’ve done quite a bit of experimentation with Admin mode, and when it comes to canvas apps or power pages site, blocking data alone doesn’t prevent access to the app or site.
Similarly, there are nuances that mean some types of flows will run in administration mode while others will not.
Read on for more info…
Why Use Administration Mode?
Use of good of application lifecycle management (ALM) means that administration mode isn’t usually necessary, but there are still occasions where it may be needed:
- App Upgrades and Testing: Sometimes, new app versions need to be tested in production thoroughly before being made available to users. Placing the environment in administration mode allows app makers to validate changes.
- Minimizing Downtime Risks: During troubleshooting or critical changes, unexpected user actions can cause further complications. Administration mode minimizes this risk by limiting the environment’s accessibility.
- When restoring an environment backup, administration mode is automatically applied. This ensures that no changes are made while the environment is being set up. Copying an environment can also result in the new environment being in administration mode, though this isn’t always the case.
How To Enable Administration Mode
Administration mode can be applied to production, sandbox or trial environments.
Turning administration mode on or off is straightforward:
- Navigate to the Power Platform Admin Center where you can see a list of all the environments of which you are an administrator.
- Choose the environment where you want to enable or disable administration mode.
- Against the ‘Details’ section, select Edit where you’ll see the option to toggle administration mode. Save the changes.
As can be seen above, when an environment is in administration mode, there is a banner indicating this when viewing the environment in the Power Platform Admin Center.
Important Note: As with most power platform administration changes, activating or deactivating administration mode can take some time to take effect. When bringing an environment out of administration mode, Microsoft warn that it can be up to 24 hours before the environment is fully reactivated, though in my experience, everything works fine after 10-15 minutes.
Who Can Access The Environment In Administration Mode?
While administration mode is enabled, only system administrators and system customizers are granted access. For users with these security roles, access to run model-driven apps, canvas apps and power pages sites, will continue as usual. Flows I’ll discuss later. The security roles also allow continued access to create and update apps, pages and flows.
Users without these security roles will experience the restrictions.
How Are Apps & Power Pages Sites Impacted By Administration Mode?
Model-driven apps are impacted differently to canvas apps and power pages sites.
Model-Driven Apps
Non-admin users get the message below informing them they don’t have access to the app.
Canvas Apps
Non-admin users can access and navigate the app but can’t see any data, just as they would if they didn’t have the necessary security roles. However, they are still able to trigger instant flows, for example by clicking a button.
Although restricting access to data protects data integrity, because the app can still be run, it has the potential to cause confusion for users. consequently, you may want to create a bespoke splash page for canvas apps. A splash page is a screen that the users will see while the environment is in administration mode. The splash screen informs that maintenance is ongoing and prevents users from navigating away from the splash page to the rest of the app.
Creating a splash page for a canvas app is beyond the scope of this article, but I’ll discuss this in a later post.
Power Pages Sites
Non-admin users can access and navigate a power pages site, but just as with a canvas app, they can’t see any data
This also has the potential to cause confusion for users so you may want to create a bespoke splash page or even make the site private. I’ll discuss creating a splash page for a power pages site in future post too.
How Are Power Automate Flows Impacted By Administration Mode?
The different types of flows are impacted differently, and their behaviour is the same irrespective of whether they are owned by an admin or non-admin user.
Instant Flows
If an instant flow is triggered, for example, via a power app, it will run. The flow can be triggered by an admin or non-admin user
Scheduled Flows
Scheduled flows continue to run.
Automated Flows
Automated flows do not run.
What If I Also Disable Background Operations?
When applying Administration Mode, there is the additional option to disable Background Operations.
According to Microsoft’s documentation, disabling background operations, stops all asynchronous operations such as workflows and synchronization with Exchange. Emails will not be sent and server-side synchronization for appointments, contacts, and tasks are disabled.
I found that disabling background operations had no impact on viewing or accessing apps, power sites, or on flows being triggered. I also had no problem using a flow to send an email, but based on Microsoft’s guidance, disabling background operations could impact the functionality contained within apps and flows.
Inconsistencies To Be Aware Of
When testing this I once had an error message in a power app stating an instant flow cannot be triggered as the environment is in Administration mode, though on all other occasions the flow was successfully triggered and executed.
I also had some anomalies in Power Pages sites where occasionally in admin mode, the sites didn’t load at all or loaded with HTML but no CSS formatting.
Additionally, when copying an existing environment to a new environment, I found that the new environment was sometimes created in administration mode and sometimes not, even if the same environment is being copied.
Summary
Administration mode is a simple yet powerful feature within the Power Platform that allows administrators to restrict users from viewing data in an environment and therefore limiting their ability to make changes.
However, it is nuanced in the sense that while users cannot access model-driven apps, they can still access canvas apps and power pages sites. Even while access to Dataverse is blocked, instant and scheduled flow will continue to run and the actions in these flows can change Dataverse data.
If your intention is to completely shut down an environment, consider creating a splash page for canvas apps, make any power pages sites private and switch off instant and scheduled flows.