Lab Tenant Manager — Automate Power Platform Workshop Tenants

Features

Everything you need to run a workshop

No build step. No Kubernetes. Just deploy and go.

🏢

Multi-tenant onboarding

Add any Microsoft 365 tenant as a lab tenant via a one-time global-admin consent URL. No recurring access required.

⚡

Automated provisioning

Creates one personal Power Platform Developer environment (with Dataverse) per participant, routed to the Maker Welcome experience.

🎟

Workshop code system

Generate shareable codes with optional expiry and usage limits. Participants self-serve at a public redemption portal.

📧

Credential email delivery

Sends username, password, Power Apps URL, and Copilot Studio URL from your operator-tenant mailbox. Resend at any time.

✅

Pre-flight checks

Verify tenant licenses, Power Platform token availability, and security group membership before starting provisioning.

🧹

Lab cleanup

Removes all labadmin* users and their environments to reset the tenant between workshops.

🔄

Token re-authorization

Refresh an expired delegated Power Platform token without repeating the full onboarding flow.

🔒

Zero standing credentials

Managed identity for Azure resource access. Delegated tokens stored encrypted in Key Vault. No long-lived secrets in env vars.

📋

Audit trail

Every provisioning action, email send, and cleanup is logged per tenant for full visibility.

Product Gallery

See the experience in action

Admin and participant flows from onboarding through environment management.

Lab Tenants list view with onboarded tenant and management actions.

Tenant overview

View onboarded lab tenants, current status, and jump directly into tenant management.

Account management

Create or update tenant admin credentials and share access with additional tenant admins.

Tenant detail page showing codes, users, environments, and delegated token re-authorization.

Tenant operations

Run cleanup, manage codes and users, and trigger delegated token re-authorization when needed.

Environment management

Track user and admin environments, view Dataverse role assignments, and open environments directly.

Lab users page with licenses, claim status, participant email, and role information.

User management

Inspect provisioned users, licenses, claim details, and Dataverse role mappings per participant.

Participant claim screen for redeeming workshop code and receiving personal environment.

Participant claim flow

Participants redeem a workshop code and receive their personal Power Platform environment.

Architecture

How it works

Runs entirely in your Azure subscription. No shared infrastructure.

Architecture: Container App in operator tenant connects to App Registration, Cosmos DB, and Key Vault; calls MS Graph and Power Platform BAP APIs to provision per-user environments in lab tenants.

Deployment

Deploy in 4 steps

Everything runs with Azure CLI. No build tools required.

1

Create an App Registration

Create a multi-tenant Entra ID app registration in your operator tenant, grant the required Microsoft Graph application permissions (User.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All, LicenseAssignment.ReadWrite.All, Mail.Send) plus the Power Platform delegated scope, then note the client ID and secret. Add redirect URIs after Step 2 once the Container App FQDN is known.

az ad app create \
  --display-name "Lab Tenant Manager" \
  --sign-in-audience AzureADMultipleOrgs

Full App Registration guide with CLI commands →

2

Deploy Azure Infrastructure

Click the button or use the CLI. Provisions Container App, Cosmos DB, Key Vault, and role assignments in one step. Once deployed, note the Container App FQDN and add the redirect URIs back to the app registration.

Prerequisites are required before deploying. See README Prerequisites and Step 1 — App Registration.

or via CLI

az group create \
  --name rg-lab-tenant-manager \
  --location northeurope

az deployment group create \
  --resource-group rg-lab-tenant-manager \
  --template-uri https://raw.githubusercontent.com/holgerimbery/lab-tenantmanager/main/deploy/azuredeploy.json \
  --parameters baseName=ltm kvAdminObjectId=<your-object-id>

3

Configure the Container App

Set environment variables and secrets for your app registration, tenant IDs, and email sender.

az containerapp secret set -n ca-ltm -g rg-lab-tenant-manager \
  --secrets \
    "ad-client-secret=<your-client-secret>" \
    "nextauth-secret=$(openssl rand -base64 32)" \
    "auth-secret=$(openssl rand -base64 32)"

az containerapp update -n ca-ltm -g rg-lab-tenant-manager \
  --set-env-vars \
    "AZURE_AD_CLIENT_ID=<client-id>" \
    "OPERATOR_TENANT_ID=<tenant-id>" \
    "NEXTAUTH_URL=https://<your-fqdn>" \
    "MAIL_SENDER_UPN=noreply@yourdomain.com" \
    "PP_DEFAULT_REGION=europe" \
    "PP_DEFAULT_CURRENCY=EUR" \
    "PP_DEFAULT_LANGUAGE=1033" \
    "USAGE_LOCATION=DE"

4

Sign in & onboard your first lab tenant

Open the app URL, sign in with your operator tenant account, and add a lab tenant. Share the onboarding URL with the lab tenant's Global Admin — they consent once, and you're ready to run workshops.

Full documentation →