Lab Tenant Manager — Automate Power Platform Workshop Tenants

Features

Everything you need to run a workshop — or a dev team

No build step. No Kubernetes. Just deploy and go.

🏢

Multi-tenant onboarding

Add any Microsoft 365 tenant via a one-time global-admin consent URL. Choose Workshop lab or Development environments — the app opens the right setup page.

🛠

Development environment manager NEW

Members of a security group create, renew and delete their own developer environments in a maker portal. Quotas, region, DLP, retention and environment groups are enforced.

👥

Security-group participants NEW

Use the members of an existing Entra security group instead of created accounts. Required licenses and free seats are checked against the member count.

⚡

Automated provisioning

Creates one personal Power Platform Developer environment (with Dataverse) per participant, routed to the Maker Welcome experience.

🎟

Workshop code system

Generate shareable codes with optional expiry and usage limits. Participants self-serve at a public redemption portal.

📧

Credential email delivery

Sends username, password, Power Apps URL, and Copilot Studio URL from your operator-tenant mailbox. Resend at any time.

✅

Pre-flight checks

Verify tenant licenses, Power Platform token availability, and security group membership before starting provisioning.

🧹

Lab cleanup & safe recovery

Removes only the accounts and environments the app created. Retry a failed participant environment or Lab - Admin / Lab - Target without duplicates.

🔄

Token re-authorization

Refresh an expired delegated Power Platform token without repeating the full onboarding flow.

🔒

Least-privilege credentials

Managed identity for ACR pull and Key Vault access. Cosmos DB uses its account key and the app registration a client secret, both stored as Container App secrets. Delegated tokens stored encrypted in Key Vault.

📋

Audit trail

Every provisioning action, email send, and cleanup is logged per tenant for full visibility.

Product Gallery

See the experience in action

Admin and participant flows from onboarding through environment management.

Lab Tenants list view with onboarded tenant and management actions.

Tenant overview

View onboarded lab tenants, current status, and jump directly into tenant management.

Account management

Create or update tenant admin credentials and share access with additional tenant admins.

Tenant detail page showing codes, users, environments, and delegated token re-authorization.

Tenant operations

Run cleanup, manage codes and users, and trigger delegated token re-authorization when needed.

Environment management

Track user and admin environments, view Dataverse role assignments, and open environments directly.

Lab users page with licenses, claim status, participant email, and role information.

User management

Inspect provisioned users, licenses, claim details, and Dataverse role mappings per participant.

Participant claim screen for redeeming workshop code and receiving personal environment.

Participant claim flow

Participants redeem a workshop code and receive their personal Power Platform environment.

Architecture

How it works

Runs entirely in your Azure subscription. No shared infrastructure.

Architecture: Container App in operator tenant connects to App Registration, Cosmos DB, and Key Vault; calls MS Graph and Power Platform BAP APIs to provision per-user environments in lab tenants.

Deployment

Deploy in 4 steps

Everything runs with Azure CLI. No build tools required.

1

Create an App Registration

Create a multi-tenant Entra ID app registration in your operator tenant, grant the required Microsoft Graph application permissions (User.ReadWrite.All, Group.ReadWrite.All, Directory.ReadWrite.All, LicenseAssignment.ReadWrite.All, Mail.Send) plus the Power Platform delegated scope, then note the client ID and secret. Add redirect URIs after Step 2 once the Container App FQDN is known.

az ad app create \
  --display-name "Lab Tenant Manager" \
  --sign-in-audience AzureADMultipleOrgs

Full App Registration guide with CLI commands →

2

Deploy Azure Infrastructure

Click the button or use the CLI. Provisions Container App, Cosmos DB, Key Vault, and role assignments in one step. Once deployed, note the Container App FQDN and add the redirect URIs back to the app registration.

Prerequisites are required before deploying. See README Prerequisites and Step 1 — App Registration.

or via CLI

az group create \
  --name rg-lab-tenant-manager \
  --location northeurope

az deployment group create \
  --resource-group rg-lab-tenant-manager \
  --template-uri https://raw.githubusercontent.com/holgerimbery/lab-tenantmanager/main/deploy/azuredeploy.json \
  --parameters baseName=ltm kvAdminObjectId=<your-object-id> powerPlatformGeography=eu-efta

3

Configure the Container App

The deployment first runs a public placeholder image on port 80 — it has no secrets and no database access. Configuration turns it into the running app: it stores the secrets (including the Cosmos account key as COSMOS_KEY), sets the environment variables and the TENANT_MASTER_ADMIN_EMAILS admin allow-list, switches ingress to port 3000, and deploys the GHCR image.

Run the one-shot configuration script — it discovers the deployment outputs, wires every secret and variable, and adds the redirect URIs:

./deploy/scripts/configure-containerapp.ps1 \
  -ResourceGroup rg-lab-tenant-manager \
  -ClientId <client-id> \
  -OperatorTenantId <tenant-id> \
  -MasterAdminEmails admin@yourdomain.com \
  -MailSenderUpn noreply@yourdomain.com

Full Step 3 with the manual Azure CLI path →

4

Sign in & onboard your first tenant

Sign in at https://<your-fqdn>/sign-in with your operator tenant account (the root URL redirects participants to /redeem), then open the Admin Portal at https://<your-fqdn>/admin. A healthy revision does not prove database access — reaching /admin confirms Cosmos connectivity. Choose Workshop lab or Development environments, enter the tenant domain, and share the onboarding URL with the tenant's Global Admin — they consent once, and the app guides you through the rest.

Full documentation →