1 Create the SharePoint communication site

1. Go to https://<tenant>.sharepoint.com and select Create site.
2. Choose Communication site. Do not choose Team site - this site must not be connected to a Microsoft 365 group or Teams; it is used purely as a data repository.
3. Pick the Standard communication site template (blank is fine).
4. Complete the fields in the table below.
5. Select Create site and note the final URL - you will need it in Step 8.

Record this now: Site URL = https://<tenant>.sharepoint.com/sites/CoworkPlanManagement. Every later step and the Power Platform connection reference it.

2 Import the five CSV files as lists

2.0 Download the five CSV files

They live in the same solution folder as the package you downloaded. Right-click each link and choose Save link as…, keeping the file name exactly as it is:

• Departments.csv
• Cowork Plans.csv
• Department plans.csv
• Cowork Plan Requests.csv
• Cowork Plan App Settings.csv

Each CSV was exported from SharePoint and carries its own column schema in the first line, so SharePoint recreates the correct column types automatically. Do not open, re-save or edit the CSV files in Excel - that strips the schema line and every column imports as plain text.

2.1 Import procedure (per file)

1. On the site home page select + New → List.
2. Select From CSV.
3. Select Upload file, choose the CSV, and review the detected column types on the preview screen.
4. Enter the list name exactly as shown below - the flows and app reference these names literally, including spacing and capitalisation.
5. Clear the Show in site navigation checkbox (optional; keeps the site tidy).
6. Select Create and wait for the list to finish provisioning before importing the next one.

2.2 Import in this order

2.3 Verify the import

• Cowork Plans must contain 4 items: Getting Started, Business, Business Plus, Business Catalyst.
• Cowork Plan App Settings must contain 6 items: Pause Group, Vacation phrases, Pause Enabled, Manager approval, Admins M365 Email, Downgrade approval.
• Cowork Plan Requests must show all 20 columns (Title, EntraID, Email, Plan, Agents and services, User limit, SecurityGroupID, PreviousSecurityGroupID, Manager Name, Manager Email, Request Status, DepartmentID, Department, Approval needed, Validity, Until, Business justification, Pause, Pause until, ExpiryProcessed).

If a list imported with the wrong columns, delete it (Settings → List settings → Delete this list), then re-import from the original untouched CSV.

3 Make Title optional on the Department plans and Cowork Plan Requests lists

Neither list uses the built-in Title column - Department plans only stores the DepartmentID/PlanID pair, and Cowork Plan Requests records the requester in its own columns. Title is mandatory by default, which makes the Power Automate “create item” action fail. Turn the requirement off on both lists:

1. Open the Department plans list.
2. Select the gear icon → List settings. (If you only see the modern pane, choose List settings → More library settings.)
3. Under Columns, select Title.
4. Under Require that this column contains information, select No.
5. Select OK.
6. Repeat steps 1–5 on the Cowork Plan Requests list.

Both lists must be changed. If Title is left mandatory on Cowork Plan Requests, every plan request fails at the point the flow writes the row - and the failure surfaces only when a user submits a request, not during deployment.

4 Create the five security groups in Microsoft Entra ID

One security group is required per plan, plus a fifth group for the pause capability - five groups in total, all of them required. The Power Automate flows add and remove users from these groups, and every Cowork spending policy is targeted at one of them.

The pause group is where users are moved when their consumption is temporarily suspended (for example while they are on vacation or leave). It carries its own spending policy with the minimum credit allowance, so a paused user keeps access but consumes almost nothing until the flow moves them back to their normal plan group.

4.1 Create each group

1. Go to https://entra.microsoft.com → Groups → All groups → New group.
2. Complete the form using the values below.
3. Select Create and repeat for every group in table 4.2.

Why the owner matters: add the deploying account as group Owner on all five groups. A group owner can add and remove members through the Office 365 Groups / Entra connector without any tenant-level admin consent, so the Power Automate flows run under that identity with no extra permissions or application registration.

4.2 Groups to create

5 Copy each security group ID from the URL

1. In the Entra admin centre, open Groups → All groups and select a group.
2. Look at the browser address bar. The URL ends with the group’s object ID (a GUID), for example …/GroupDetailsMenuBlade/~/Overview/groupId/ab36b72a-3f84-4eb4-a217-542b04d0ce63.
3. Copy everything after /groupId/ - that 36-character GUID is the Security Group ID. (The same value appears on the group’s Overview page as Object Id; either source is fine.)
4. Record each GUID against its plan - you will paste them in Steps 6 and 7.

6 Populate Security Group ID on the Cowork Plans list

The imported Cowork Plans list already carries the GUIDs from the source tenant. They are not valid in your tenant and must be replaced with the IDs you collected in Step 5.

1. Open the Cowork Plans list.
2. Switch to Edit in grid view so you can paste directly into cells.
3. For each of the four rows, replace the value in the Security Group ID column with the GUID of the matching group.
4. Select Exit grid view to save.

6.1 Update the App Settings list at the same time

Open Cowork Plan App Settings and set the tenant-specific values. Every item is edited the same way: select the row, choose Edit, and replace the text in the Value column. The two mandatory tenant-specific entries are Pause Group and Admins M365 Email - the application will not work correctly until both are set.

Enter true/false in lower case exactly as shown - the flows compare the text literally.

6.2 Fill in Departments and Department plans

• In Departments, add one item per department: Title = department name exactly as it appears in the users’ Entra Department attribute; Approver = the person who approves requests for that department.
• In Department plans, add one item per allowed combination: DepartmentID = the ID of the department row, PlanID = the ID of the plan row (1–4). A department only sees the plans listed here.

7 Create the Cowork spending policies

Each plan’s credit allowance is enforced by a spending policy scoped to that plan’s security group. Create one policy per plan, in ascending order of generosity, plus a fifth pause policy for the pause group - five policies in total.

1. Open the Cowork admin experience and go to Spending policies (or Billing → Spending policies, depending on your admin portal version).
2. Select New policy (or Create policy).
3. Policy name - match the plan name so that reporting is readable.
4. Assigned to - select the security group for that plan (search it by name; confirm the object ID matches the GUID recorded in Step 5).
5. Limit - the monthly credit cap per user.
6. Save the policy and repeat for the remaining plans.

How pausing works: when a user is paused, the flow removes them from their plan group (retaining it in PreviousSecurityGroupID) and adds them to Cowork - Paused, so the minimum-credit pause policy applies. When the pause ends, the flow reverses the move and the original plan policy takes effect again. Pausing is only active when Pause Enabled is true and Pause Group holds a valid group ID.

A user must belong to exactly one plan group at a time. The flow removes the previous group (kept in PreviousSecurityGroupID) before adding the new one - do not add users to these groups manually.

8 Import the solution into the Power Platform environment

8.1 Prepare the environment

1. Go to the Power Platform admin centre (https://admin.powerplatform.microsoft.com) → Environments.
2. Use the dedicated environment for this application (create one with + New if it does not exist: type Production, region matching your tenant, Dataverse enabled).
3. Confirm the deployment account has the System Administrator security role in that environment.

8.2 Get the solution package

Download the ready-made package - no source environment needed:

⬇ Download the solution

Current version: CoworkPlan_1_0_0_9.zip · view on GitHub

Some browsers flag .zip downloads - choose Keep. Do not unzip the file; Power Platform imports the .zip as-is.

Exporting from your own environment instead? Open make.powerapps.com → Solutions → select the solution → Export solution → Publish all customisations → Next → choose Managed for production (Unmanaged only if you intend to keep customising) → Export.

8.3 Import into the target environment

1. In make.powerapps.com, switch to the target environment (top-right environment picker).
2. Go to Solutions → Import solution → Browse, select CoworkPlan_1_0_0_9.zip, then Next.
3. On the connections page, create or select a connection for each connector used by the solution, signed in as the deployment account:
   • SharePoint - access to the site from Step 1
   • Office 365 Users - reads manager and department attributes
   • Office 365 Outlook - sends approval and notification e-mail
   • Microsoft Entra ID / Office 365 Groups - adds and removes group members (works without extra permissions because the account is a group owner, Step 4)
   • Approvals - manager approval requests
4. On the environment variables page, enter the tenant-specific values shown below.
5. Select Import and wait for completion (typically 5–15 minutes).

8.4 Turn on the flows and share the app

1. Open the imported solution → Cloud flows. Any flow shown as Off must be turned On (open the flow → Turn on).
2. Open the app → Share → add the user population (for example a broad “All employees” group) with User permission.
3. Confirm the app’s SharePoint data sources resolve without errors, then Publish the app.

9 Give everyone permission to submit requests

Users write directly to the Cowork Plan Requests list when they submit a plan request, so they need more than read access on that one list - but nothing more anywhere else on the site. The pattern below grants exactly that: Visitor (read-only) across the site, plus a purpose-built permission level on the requests list alone.

9.1 Add everyone as Visitors

1. On the site, select the gear icon → Site permissions → Advanced permissions settings.
2. Open the Cowork Plan Management Visitors group → New → Add users to this group.
3. Add the Everyone except external users claim and select Share.
4. Add your app administrators to the Members group (Edit) or the Owners group - they maintain the plan catalogue, departments and app settings, which Visitors cannot change.

Do not grant Edit to everyone as a shortcut. Site-wide Edit would let any user rewrite the plan catalogue, department entitlements and app settings, and delete other people's requests.

9.2 Create the “Submit request” permission level

Visitors cannot create list items, and Contribute would let users delete their own rows - which would break the request history the flows rely on. Copy Edit and remove the two capabilities you do not want:

1. On the advanced permissions page, select Permission Levels in the ribbon.
2. Select the Edit permission level, scroll to the bottom and select Copy Permission Level.
3. Name it Submit request (add a short description, e.g. “Add and edit own requests; cannot delete”).
4. Clear Delete Items and Delete Versions.
5. Clear View Application Pages.
6. Select Create.

9.3 Apply it to the Cowork Plan Requests list

1. Open the Cowork Plan Requests list → gear icon → List settings → Permissions for this list.
2. Select Stop Inheriting Permissions and confirm. The list now has its own permissions, independent of the site.
3. Select Grant Permissions.
4. Enter Everyone except external users, open Show options, and choose the Submit request level.
5. Clear the option to send an e-mail invitation, then select Share.
6. Confirm the app administrators still hold Edit or Full Control on the list.

Permission changes can take a few minutes to propagate. If a pilot user hits an error when submitting, wait, then have them re-open the app before investigating further.

10 Post-deployment verification checklist

• Communication site exists and is not group/Teams connected.
• All five lists exist with the exact names; Cowork Plans has 4 rows and App Settings has 6 rows.
• Title is no longer mandatory on Department plans - or on Cowork Plan Requests.
• Five security groups exist, membership type Assigned, deployment account is Owner on each.
• Every Security Group ID in Cowork Plans matches a group in this tenant (no leftover source-tenant GUIDs).
• Pause Group in App Settings holds the object ID of the Cowork - Paused group.
• Admins M365 Email in App Settings holds the primary administrators’ addresses (sample addresses removed).
• Departments and Department plans populated for at least one pilot department.
• Five spending policies created (four plans + pause), each targeting the correct security group; the pause policy uses the minimum credit allowance.
• Solution imported, all connections green, all flows On, app published and shared.
• Everyone except external users is in the site Visitors group; app administrators are Members or Owners.
• The Submit request permission level exists, with delete and View Application Pages cleared.
• Cowork Plan Requests has unique permissions, granting Everyone except external users the Submit request level.

Smoke test: submit a plan request as a pilot user → the approval reaches the manager → approve → a new row lands in Cowork Plan Requests with the correct SecurityGroupID → the user appears in the matching Entra group within a few minutes → the spending policy applies to that user.

Rollback: if the smoke test fails, turn the flows Off, correct the configuration (usually a list name, an environment variable, or a mismatched group ID), turn the flows back On and re-run the test. No data is lost - all state lives in the SharePoint lists.