What's new: Governance & Administration (2024 release wave 1)
Business Central 2024 release wave 1 governance and administration session. Already shipped: self-service environment transfer between Entra tenants (February), a 14-day recovery period for deleted environments, and the Dynamics 365 Business Central administrator role. Upcoming: environment-level partner access controls, customer managed encryption keys and Purview auditing. Also covers AppSource preview apps for sandboxes, linking to Power Platform environments, and customer lockbox.
- Introduction and agenda overview
- Environment transfer between tenants
- Deleted environment recovery period expansion
- Dynamics 365 Business Central administrator role
- Environment-level partner access controls
- AppSource preview apps functionality
- Linking Business Central to Power Platform environments
- Customer lockbox and governance policies
- Customer managed encryption keys
- Auditing and Microsoft Purview integration
Overview
The video, published 2024-04-04, covers the governance and administration updates in 2024 release wave 1. It starts with tenant-level topics: transferring environments between Microsoft Entra tenants, a longer recovery period for deleted environments, a dedicated administrator role, and partner access limited to specific environments.
It then covers AppSource preview apps in sandboxes, linking Business Central environments to Power Platform managed environments, and the data governance features that build on that link: customer lockbox, customer managed encryption keys, and auditing in Microsoft Purview. Environment transfer and preview app installation are demoed.
Key points
- Environment transfer between Entra tenants is self-service in the admin center. Only internal administrators can run it, the destination tenant ID is specified, and transfers can be scheduled up to 14 days ahead. Requests must be accepted within 8 hours.
- After a transfer, users must be recreated and permissions reassigned in the destination tenant. That tenant needs a paid license and available quota.
- The recovery period for deleted environments doubled from 7 to 14 days. Total backup retention stays at 28 days.
- The new Dynamics 365 Business Central administrator role covers environment lifecycle, extension management and admin center access, but not other Dynamics 365 products. Help desk admin access will be removed.
- Partner access can be restricted to specific environments. It applies to delegated users and service authentication apps.
- Power Platform linking is one-to-one and can be reverted. Environment type and Azure geo must match, linking restarts the environment, and a linked environment cannot be deleted. Copied or restored environments do not inherit the link.
- Customer lockbox is enforced only for managed environments. Approved Microsoft access expires after 8 hours. Customer managed encryption keys were announced for later in the wave and need a linked managed environment.
Features
| Feature | Status | At | Evidence |
|---|---|---|---|
| Environment transfer between tenants | status not stated, demoed | 1:48 | |
| Deleted environment recovery period extension | status not stated | 5:11 | |
| Dynamics 365 Business Central administrator role | status not stated | 6:02 | |
| Environment-level partner access controls | status not stated | 7:15 | |
| AppSource preview app installations | status not stated, demoed | 8:37 | |
| Business Central and Power Platform environment linking | status not stated | 10:42 | |
| Customer lockbox for Business Central | status not stated | 12:53 | |
| Customer managed encryption keys | announced | 15:30 | “this is a heads up that this will be coming later in this wave” (15:30) |
| Auditing in Microsoft Purview | status not stated | 16:32 |
AL objects mentioned
As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.
Quotes
- 2:09 “since we made this capability available as a a self-service functionality in the admin Center at the beginning of February we have already seen”
- 3:37 “very important transfers can only be executed by internal administrators this is for security reasons”
- 4:17 “we allow you to schedule these transfers up to 14 days in the future”
- 5:31 “recently we have improved it and doubled the recovery period from 7 to 14 days”
- 11:17 “the linking of environments is one to one one business Central environment to one Power Platform environment and it can also be reverted”
- 14:09 “the lockbox policy is only enforced for environments that are activated for managed environments”
- 15:30 “this is a heads up that this will be coming later in this wave”
- 17:35 “by default uh there’s an 180 days log retention in perview and it can be extended up to 10 years with additional add-on licenses”
Disclaimers in the video
- 1:27 preview: new auditing capabilities that we are going to ship soon in perview
- 15:30 coming-later: customer managed encryption Keys all customer data that is stored in business Central is encrypted addressed with a strong Microsoft managed encryption key by default so Microsoft stores and manages the database encryption key for all your data so that you don’t have to however we will provide the ability to use a customer managed encryption key also referred to as cmk for your added data protection control where you can then self-manage the encryption key that is associated with your business Central environment so this is a heads up that this will be coming later in this wave
- 17:03 preview: in this initial release we will deliver the capability to audit create update and delete events in business Central that require administrator privileges
Presenters (as heard): Roman.