What Managed Environment sharing rules control

Managed Environments provide sharing rules for canvas apps, solution-aware cloud flows, and agents. The available controls differ by asset type, so a single “maximum users” setting doesn’t describe the whole feature.

Canvas apps

For canvas apps, admins can choose not to limit sharing or prevent sharing with security groups, including Everyone. When group sharing is excluded, admins can also set the maximum number of individuals an app can be shared with.

Solution-aware cloud flows

For solution-aware cloud flows and agent flows, admins can allow sharing with any number of individuals or security groups, or turn off sharing. The canvas app user limit doesn’t apply to this flow setting.

Agents

Agent rules control whether owners and editors can grant Editor or Viewer access, whether viewers can be shared with security groups, and, under the individual-only option, the maximum number of viewers. These settings are separate from the canvas app and flow rules.

What happens to existing access

The rules are enforced when someone tries to share an asset. They don’t remove users who already had access before the rules were applied. If an asset no longer complies with a new rule, it can only be unshared until it meets the rule. Microsoft notes that enforcement can take up to an hour to start.

These settings aren’t an approval workflow. If a broad share needs admin approval in your organization, define that process separately and explain it to makers.

Set the rules for each environment based on who should use its apps, flows, and agents. Then test the rules before relying on them for a production rollout.

Sources

• Limit sharing, Microsoft Learn
• Control how agents are shared, Microsoft Learn