Power Apps Without Regrets

Static analysis before anything travels — catches deprecated APIs and perf traps.

pac solution check --path {{solution_zip}} --outputDirectory {{report_dir}}

Prerequisites:

pac CLI authenticated

Run from:

Anywhere

Expected output:

Report written; issue counts by severity printed

Success looks like:

Zero critical/high findings (or each one triaged in writing)

The build artifact for test and prod (Rule 7).

pac solution export --name {{solution_name}} --path {{output_path}} --managed --async

Prerequisites:

pac auth pointed at DEV

Run from:

Anywhere

Expected output:

Managed zip written to the output path

Success looks like:

Zip contains the expected components at the expected versions

Follows Rule 7

The sanctioned door into any environment (Rule 6).

pac solution import --path {{solution_zip}} --environment {{environment_url}} --async --activate-plugins

Careful: Against prod this changes what users run right now — deploy window + rollback zip first.

Prerequisites:

pac auth profile for the target; System Customizer+

Run from:

Anywhere

Expected output:

Import completes without dependency errors

Success looks like:

Apps open and flows are on in the target

Follows Rule 6

Sanity-check which tenant/environment pac is pointed at before anything privileged.

pac env list

Prerequisites:

pac CLI authenticated

Run from:

Anywhere

Expected output:

Table of environments with the active one marked

Success looks like:

The active environment is the one you think it is

The boring, repeatable path: checker, managed export, a test-environment rehearsal, then prod — with connection references and environment variables handled deliberately instead of by surprise.

Prerequisites:

Solution exists in dev with all components inside it; service-account connections created in test and prod; environment variable values decided per environment

Permissions:

System Customizer in test; System Administrator (or deploy service principal) in prod

Starting state:

Dev work complete and smoke-tested in the dev environment

Tools:

pac >=1.30

1. 1.RunConfirm which environment pac is pointed at
   ⌘4List environmentspowershell

   pac env list

   Copy command

   Thirty seconds here has prevented every "imported into the wrong tenant" story we know.

   Expect:

   Active profile shows DEV

   Verify:

   Environment URL matches dev

2. 2.RunRun the solution checker
   ⌘1Run the solution checkerpowershell

   pac solution check --path {{solution_zip}} --outputDirectory {{report_dir}}

   solution_zipreport_dir

   Copy commandfill {{solution_zip}}, {{report_dir}} to copy

   Expect:

   Report generated

   Verify:

   No critical/high findings untriaged

3. 3.RunExport the managed zip
   ⌘2Export a managed solutionpowershell

   pac solution export --name {{solution_name}} --path {{output_path}} --managed --async

   solution_nameoutput_path

   Copy commandfill {{solution_name}}, {{output_path}} to copy

   Version number bumps automatically on export; note it in the deploy ticket.

   Expect:

   Managed zip on disk

   Verify:

   Zip size sane; version recorded

4. 4.CheckAudit environment variables and connection references

   Open the solution in the maker portal: every environment variable has a decided prod value (no dev defaults leaking), and every connection reference has a named owner identity per Rule 8.

   Expect:

   A written list: variable → prod value, connection reference → service account

   Verify:

   Nothing on the list says "whatever it defaults to"

5. 5.RunRehearse the import in test
   ⌘3Import a solutionpowershell⚠ Privileged

   pac solution import --path {{solution_zip}} --environment {{environment_url}} --async --activate-plugins

   solution_zipenvironment_url

   Copy commandfill {{solution_zip}}, {{environment_url}} to copy

   Test is where dependency and connection surprises are cheap.

   Expect:

   Import succeeds in test

   Verify:

   Apps open; flows on; run one end-to-end

   If it fails here… (1 known failure)

   A missing-dependency error here means a component references something outside the solution — see the attached failure note.

   ⚠ Import fails: missing dependency on a connection reference or table

   Import errors citing a missing dependency (a table, connection reference, or component not found in the target)

   Likely cause: The component exists in dev outside the solution (created before the solution, or added directly to the environment) so it never traveled

   Fix: Add the missing components to the solution in dev, re-export, re-import. For shared base components, split them into a separate base solution imported first.

6. 6.RunImport to prod in the deploy window
   ⌘3Import a solutionpowershell⚠ Privileged

   pac solution import --path {{solution_zip}} --environment {{environment_url}} --async --activate-plugins

   solution_zipenvironment_url

   Copy commandfill {{solution_zip}}, {{environment_url}} to copy

   Same zip that passed test — never a fresh export between test and prod.

   Expect:

   Import succeeds in prod

   Verify:

   Version in prod matches the ticket

7. 7.CheckPost-deploy verification

   Open each app as a normal user (not admin), run one real flow end-to-end, and confirm it executed as the service account in the flow run history.

   Expect:

   Green run in flow history, owned by the service account

   Verify:

   Run history shows the service-account identity, not a personal one

   If it fails here… (1 known failure)

   ⚠ Flow runs as a departed employee

   Solution flows start failing with authentication errors; run history shows a former teammate as the running user

   Likely cause: Connection references were bound to a personal account at first import and never revisited

   Fix: Create service-account connections, re-bind the connection references, and re-save the flows. Then adopt Rule 8: owners decided before import, audited quarterly.

Success looks like:

Apps open and flows run in prod under the service account, with prod environment-variable values

Rollback:

Re-import the previous managed zip (kept from the last release) over the top; managed layering restores prior behavior. Then re-bind connection references if prompted.

Implements Rule 6, Rule 7, Rule 8

When prod behaves differently from dev, check the layers on the component (Solutions → the component → Solution layers). An old unmanaged customization sitting on top of your managed layer wins silently — and it usually got there from a well-meaning portal hotfix months ago.

Published canvas changes only reach users after they close and reopen the app — sessions in flight keep the old version for hours. Ship breaking data-shape changes with that overlap in mind, or force a version check on app start.