This checklist defines the fields, validation rules, and routing logic for the CoE environment request intake application. Implement these as a Power Apps form in the PLATFORM-COE-ADMIN environment.
The intake application should be built in Power Apps with a Power Automate approval flow backend. This document defines the logical requirements. Do not implement intake via email — email-based intake does not scale and does not produce the audit trail required for ATO evidence.
Name + DoD ID; this person is accountable — not a team
Owner Email
Email
Yes
Must be in the organization’s GCC High Entra ID
ISSO Name
Text
Required for Business Critical+
Name + contact
ISSO Email
Email
Required for Business Critical+
Must be in the organization’s Entra ID
ATO Documentation Attached
File / Link
Required for IL5
Link to ATO artifacts or ISSO acknowledgment
Service account / pipeline
Field
Type
Required
Validation
Pipeline Service Principal Needed
Yes/No
Yes for LP-ALM
If Yes: CoE will provision; requestor provides Azure Government AD app registration
Connection Reference Accounts Available
Yes/No
Yes for LP-ALM programs
If No: add note to track with IAM; flag for ISSO review
Licensing Capacity Confirmed
Yes/No
Yes
Checkbox; CoE validates against capacity dashboard
Automated validation rules
Run these checks immediately on form submission, before routing to any reviewer.
Check
Failure action
Environment name uniqueness (generated name not already in register)
Block submission; display conflicting name
Solution prefix uniqueness (no existing publisher in tenant with same prefix)
Block submission; display conflicting prefix
Data classification / app class consistency: Citizen class cannot be IL5
Block submission; display error
Sandbox request has no ATO, no external integrations
Auto-approve path confirmed
Prod request without Test request in same submission or existing
Block submission; require Test environment first
LP-ALM programs: ADO project name provided
Block submission if missing
IL5 request: ISSO field populated
Block submission if missing
Estimated user count > 500 without Business Critical or Mission Critical classification
Display warning (not block): “Applications with >500 users should consider Business Critical classification”
Connection Reference Accounts = No for Test or Prod
Display warning: “Test and Prod require non-personal connection reference accounts. Ensure IAM request is in progress before provisioning.”
Routing logic
Submission passes automated validation
↓
Is this a Sandbox request only?
YES → Auto-approve → Auto-provision within 1 hour → Notify requestor
NO → Continue ↓
Is this Mission Critical or IL5?
YES → Route to ISSO review (5 business day SLA)
AND Platform CoE Architecture Review (5 business day SLA, concurrent)
AND PGB approval (next meeting or async within 5 days)
NO → Continue ↓
Is this Business Critical?
YES → Route to Platform CoE Architecture Review (5 business day SLA)
AND ISSO notification (no approval required unless IL5)
NO → Continue ↓
Is this Standard or Citizen?
YES → Route to Platform CoE Architecture Review (2 business day SLA)
→ Auto-approve if no concerns raised within SLA
Provisioning actions (on approval)
The following are automated actions triggered by approval. Implement via Power Automate calling the Power Platform Admin API.
Action
Automated
Notes
Create environment via Admin API
Yes
Use approved environment name; set region to US Gov
Apply Managed Environments settings
Yes
Enable for all non-sandbox environments
Apply DLP policy assignment
Yes
Assign to appropriate environment group based on data classification
Send onboarding email with links to LP-ALM onboarding, environment URLs, Entra group names
Create calendar reminder for owner confirmation
Yes
Set 90-day quarterly review reminder
Sandbox: set expiry date and auto-quarantine workflow
Yes
90-day default; configurable up to 90 days
ADO variable group secrets (client secrets, tenant IDs) are never auto-populated. After ADO project creation, a CoE engineer must manually populate the secret-flagged variables. This is a deliberate security control.
Post-provisioning owner checklist
Send this to the environment owner on provisioning:
Log in to the environment and confirm access: {ENV_URL}
Review the Entra ID groups created: PP-{ENV}-Owners, PP-{ENV}-Users