Cheat Sheet PL-900 — Power Platform Fundamentals

Documentation reviewed: October 17, 2026. Reference syllabus: July 24, 2026.

This LarrúaTech guide is designed for in-depth study and later reference to tables and revision scenarios. It retains common English terms so you can recognize them in Microsoft Learn and the tools.

Explanations draw on official documentation. Scenarios, prompts and revision questions are original educational examples; they do not reproduce exam questions.

1. Current syllabus and study approach

Use the skills guide as the scope reference. Power BI is not a specific domain in this version. Power Pages retains its value within the platform but no longer has its own area. Copilot Studio has a full domain.

Microsoft updates the English version first. Translations are usually updated approximately eight weeks later, although delays are possible. The guide also allows commonly used preview features to appear. Official PL-900 exam guide.

PL-900 is a fundamentals certification. When studying a service, answer three questions: which problem it solves, which components it uses and when you would choose it. Recognizing a name helps; understanding the scenario lets you justify the choice.

2. The Power Platform map

Power Platform combines tools to create applications, automate processes, organize data and use agents and AI. A solution can combine multiple products, each with a different responsibility.

Low-code reduces the amount of code needed; no-code uses configuration and visual design. Professional developers can extend solutions when specialized integrations or behaviors are needed.

Value appears in outcomes: less repeated data entry, shorter processing times, more consistent processes and better information access. Measure these outcomes with process indicators. AI or automation does not generate savings by itself. Power Platform business value and measuring value.

Power Pages lets you create, host and manage business websites that can use Dataverse data. Understand its usefulness for self-service and web access, distinguishing it from an internal application. Exposing data requires configuring access and permissions. What Power Pages is.

3. Dataverse: data structure and meaning

Dataverse is a managed data platform. Besides storing information, it provides metadata, relationships, access controls and reusable business logic. It integrates directly with other Power Platform capabilities.

A traditional database can also offer these capabilities. Dataverse integrates them into a platform prepared for business applications and visual creation.

Older materials may use entity, field and record: these correspond to table, column and row, respectively. Dataverse overview.

Relationships, forms and views

Linking a request to its customer avoids copying all customer data into every request. A “Pending requests” view selects existing records; it does not create a second table containing that data.

Forms and views are important model-driven application components. Hiding a field or filtering a view does not replace security permissions. Table relationships, view configuration and model-driven application components.

4. Business logic and Power Fx

Choose the mechanism according to what you need to achieve.

Power Fx is a formula language similar to working in Excel. It can be used in different Power Platform contexts, but supported functions vary. A Dataverse formula column can, for example, calculate an amount from price and quantity. Formula columns.

A business rule combines conditions and actions, such as validating data or setting a value. Some actions apply to the form and are not available in the same way in canvas apps. Check the rule’s scope before assuming it runs in every interface. Business rules.

Example: calculating a total, requiring justification and requesting approval are three different needs. They can be addressed with a formula, validation and a flow, respectively.

5. Connectors, connections and integration

Example: the Outlook connector offers email operations; a specific connection determines which account accesses them. Having the connector available does not grant permission to every mailbox.

Custom connectors expose API operations for makers to use. The target service still requires authentication and authorization. Custom connectors and connection management.

When studying licensing, distinguish standard and premium connectors. Technical operation availability does not prove every user has usage rights. Verify the product, connector and target-service rights before practicing.

6. Environments and administration

An environment groups resources such as applications, flows, connections, agents and data. It separates audiences, development stages or security needs. Each environment belongs to a Microsoft Entra tenant and can have zero or one Dataverse database.

Separate development, testing and production to validate changes before using operational data.

Environment Maker allows creation of certain resources; it does not automatically grant access to all Dataverse data. Creation permissions and database permissions are separate matters.

Documentation already warns about retirement of Dataverse for Teams and unmanaged developer environments. Check whether provisioning instructions remain current. Power Platform environments.

7. Security: identity, applications and data

Microsoft Entra ID provides authentication. Dataverse adds a security model controlling access to tables, records and certain columns.

Sharing an app does not automatically grant full access to its data. With connectors, also check the connection identity and source-service permissions. Dataverse security.

Roles and privileges

A role groups privileges such as creating, reading, updating, deleting, assigning or sharing records. Scope determines which records they apply to. Teams, ownership and other access rules affect the final result.

Privileges from multiple roles are cumulative: assigning a narrower role does not remove broad access already granted by another role. Apply least privilege and verify access with representative users. Security roles and privileges.

Scenario: someone opens the application but cannot read a table. Investigate permissions and the connection; do not assume the screen design is the problem.

8. Governance, privacy and accessibility

Data policies

Data policies help control which integrations can be used. Connector classification distinguishes these groups:

Business and Non-business labels represent policy groups; they do not automatically classify every piece of data. Not every connector supports blocking through classic policy. Advanced policies provide additional controls.

Example: prevent a flow from combining business information with an unauthorized service. This complements user and service permissions; it does not replace them. Data policies and connector classification.

Privacy and data processing

Identify which information is collected, who can access it, where it is processed and which integrations can use it. Check environment geography and AI data-movement options for each feature.

A platform provides controls to support compliance; the solution must configure and use them according to organizational needs. Use fictional data in exercises and avoid sensitive information in prompts without an appropriate purpose and authorization. Data protection and privacy.

Accessibility

Design for keyboard navigation, screen readers, sufficient contrast, readable text and a logical interaction order. Fields need understandable labels and errors should be explained in text rather than color alone.

The accessibility checker helps identify issues, but you should also test real usage. An automatically generated app may need accessibility adjustments. Accessible canvas apps.

9. ALM, solutions and pipelines

ALM — Application Lifecycle Management organizes solution development, testing, deployment and maintenance.

A common sequence is development → testing → production. Pipelines enable repeatable, governed processes with organizationally configured controls.

A solution does not automatically transport business records from Dataverse tables. Deploying a table definition and migrating its data are different operations. Also check connections, environment values and dependencies.

Example: the same app must use the test service during validation and the operational service in production. Configure the appropriate values for each target. Power Platform pipelines.

10. Platform monitoring and diagnosis

A large user count indicates adoption; it does not prove error-free operation. Similarly, successful flow completion does not prove it used the correct recipient or data.

Revision procedure: locate the resource → reproduce a controlled case → inspect the step or event → identify the cause → correct it and check the result again. Monitoring and performance tools.

11. Power Apps: choose the application type

Canvas and model-driven applications

Canvas example: an inspection with a few steps, photographs and large buttons. Model-driven example: management of cases, contacts and related activities.

For a canvas app, plan screens, controls, formulas and sources. For a model-driven app, define tables and relationships first, then select appropriate components and permissions. The choice depends on the user’s work, data and required visual control. Canvas apps, building model-driven apps and comparison of app types.

Code apps

The code apps let you develop web applications using an IDE and technologies such as React or Vue, and run them on Power Platform’s managed platform. They provide interface and logic control with identity, data and governance integration.

They are relevant when a team needs a specific experience and has development skills. Understand their purpose; PL-900 does not require turning revision into a web-programming course. Check requirements, limitations and usage rights before using them. Code apps.

Plans / Plan designer

Plans starts with a business problem and helps propose a complete solution. It can suggest Dataverse tables, applications, flows, sites or agents according to the case.

Input can include a description and contextual material, such as a process diagram. Review users, tasks, data and suggested components before accepting the proposal.

Distinction: a plan organizes the solution; an application implements part of it. Generating a plan does not prove every permission, integration and operational requirement is resolved. Official Plans overview.

12. AI-assisted application and data creation

A useful description

A prompt should explain who uses the solution, what information they need and what outcome they expect. Describing the process is more useful than simply requesting “a modern app”.

Educational prompt:

I need to manage training requests. Each request belongs to an employee and a course. Employees submit requests and check their status; managers review pending requests. Propose the data, relationships and required application. Use fictional data for testing.

When reviewing the proposal, check:

1. Whether business entities are represented appropriately.
2. Whether column types are correct.
3. Whether relationships avoid unnecessary duplication.
4. Whether screens and components allow tasks to be completed.
5. Whether each profile has only its intended access.

Canvas apps and data models

Copilot can propose tables and relationships from natural language to create a canvas app. It lets you review and modify the model before continuing to the application. Availability depends on requirements such as region, enabled features and permissions. Creating apps through conversation.

Model-driven applications

AI can also help build and modify model-driven applications and components. Current documentation includes generation tools that prepare a plan and create artifacts such as tables, forms, views and roles.

Understand the process: requirements → proposed model and components → review → creation → validation. Specific entry points and tools can vary. AI-assisted model-driven app creation.

Vibe experience

The vibe experience combines requirements, data and application generation in an AI-assisted workspace. It supports conversational iteration on required changes.

Status reviewed: its documentation still identifies it as preview and notes the evolution of application creation toward Copilot Cowork and Copilot Studio experiences. For PL-900, recognize the syllabus concept and review documentation before looking for a specific interface. Vibe experience.

AI speeds up construction, but you must verify data, calculations, access and outcomes. Evaluating a generated proposal is part of the maker’s work.

13. Power Automate: flows and scenarios

Choosing automation

Cloud flows integrate services through operations and connectors. Desktop flows use robotic process automation — RPA — to interact with applications and interfaces. They can be combined within one solution. Flow types.

In RPA, distinguish attended execution, with a user present, and unattended execution, without human supervision during execution. Unattended execution requires suitable machine, session and rights configuration. Unattended desktop flows.

Flow components

• Trigger: sets when it starts.
• Actions: perform subsequent operations.
• Dynamic content: reuses values obtained from the trigger or earlier steps.
• Conditions: select a branch according to a result.
• Loops: repeat steps for a set of items.
• Connections: determine how each service is accessed.

Example: when a Forms response arrives, retrieve its details, create a request and notify an approver. The response identifier passes from the trigger to the action retrieving information. Review which data each step needs, not just its name. Creating Power Automate flows.

Approvals and Microsoft 365

Proposed approval flow: a request is created → information is retrieved → approval starts and waits → the decision is checked → status is updated → the requester is informed.

Microsoft documentation demonstrates this pattern with vacation requests. The approval action and a subsequent condition handle different outcomes. Some document tasks require additional connectors or capabilities. Creating and testing approvals.

AI and flow verification

Copilot helps create or modify flows using natural language. For desktop, it also provides assistance, creation and repair capabilities, several in preview.

After generating a proposal, review the trigger, connections, fields, recipients and branches. Save and test with controlled data. Verify the outcome in the target service and inspect failed runs. Copilot in Power Automate.

14. Copilot Studio: agent design

An agent can understand requests, answer using available information and use tools to perform tasks. Its behavior depends on configured instructions, context, knowledge, tools and controls.

Example: a training agent can explain course requirements and query a specific request. Explaining policy uses knowledge; checking status may need a tool.

Copilot Studio has different experiences and execution engines. Some documentation on topics, agent flows and evaluations applies to the standard harness. Check which experience each guide applies to before following its steps. Copilot Studio overview.

Topics and conversation paths

A topic contains nodes that can show messages, ask questions, save answers to variables, evaluate conditions and call tools.

In classic orchestration, trigger phrases help identify the relevant topic. In generative orchestration, component descriptions help the agent select a combination of topics, knowledge and tools.

Educational path: ask for the request identifier → check that it is supplied → query the system → communicate status or explain that no authorized result was found.

System topics handle behaviors such as ending or redirecting a conversation; custom topics implement your own process. Topics and orchestration.

Knowledge sources

Sources can include websites, documents, SharePoint, Dataverse and other supported integrations. Grounding an answer means using information from those sources to compose it.

Check content quality, currency and coverage. Authenticated sources can restrict information according to user access. Do not assume every source uses the same permission model: uploading a document and connecting an authenticated repository are different scenarios.

Example: a handbook explains how to request training; a data query returns a request’s status. Adding the handbook does not create the operation to process a request. Knowledge sources.

15. Tools, MCP and agent flows

Tools

A tool exposes an operation an agent can use: query a request, create a record or call an automation. It needs an understandable purpose and parameters. The operation is subject to its connections, permissions and policies.

Before an action, the agent must have the required data. A name entered by the user can be ambiguous; a well-designed process collects or confirms sufficient information.

Model Context Protocol — MCP

MCP standardizes integration with tools and resources exposed by a server. In the documented Copilot Studio experience, the server supplies metadata such as names, descriptions, inputs and outputs; one server can offer multiple tools.

Example: a “Look up order” tool receives an identifier and returns status. The agent chooses it in the context of a request and presents the result to the user.

MCP does not remove authentication or grant universal system access. The standard harness guide requires generative orchestration and documents support for tools and resources. MCP in Copilot Studio.

Agent flows

Agent flows are automations created in Copilot Studio. They can run from different triggers and be used by agents. They include actions, conditions, connectors and other capabilities, including human intervention where appropriate.

The flow defines the sequence; the agent uses it to complete a task and can communicate its result. Even with a structured sequence, an AI or external-system call introduces results dependent on those components.

Example: the agent obtains request data, an agent flow records it and returns the generated number. The agent should communicate that real result without inventing confirmation. Agent flows.

16. Publishing, channels and access

After modifying an agent, check whether republishing is needed for users to receive the new version. Publishing and adding a channel are different steps. Also validate access from that channel with the intended identities.

Example: a maker’s ability to view information in the test panel does not prove a channel user has the same permissions. Publishing and channels.

17. Agent 365, analytics and evaluations

Microsoft Agent 365

Agent 365 provides enterprise agent-management and governance capabilities. Copilot Studio’s documented integration offers agent-registry visibility and automatic telemetry transmission.

An administrator can obtain information on agents, connectors and activity, and apply available governance actions according to permissions and agent type. Recognize the relationship to identity, inventory, observability and organizational control.

Study distinction: Copilot Studio builds and manages the solution; Agent 365 extends visibility and governance across organizational agents. Agent 365 integration.

Usage, adoption and outcomes

Analytics reveal how the agent is used, which components participate and where improvements are needed. Separate different questions: how many people use it, whether it completes tasks and whether it produces suitable answers.

In the Monitor experience documented for the standard harness, test-panel activity is excluded from agent usage analytics. Do not confuse maker testing with real adoption. Copilot Studio analytics.

Agent evaluations

An evaluation runs test cases to assess answers or behavior against defined criteria. Prepare a set of cases and repeat it after changing instructions, knowledge or tools.

A useful set includes frequent questions, rephrasings, incomplete requests, unavailable information and operations that may fail. Also check relevant user profiles.

Evaluations help detect regressions and improve quality. Complement them with access and process tests. Agent evaluations.

18. Integrated scenario: training requests

LarrúaTech educational proposal. An organization receives training requests by email. It needs centralized data, coordinated approvals and a way for employees to check their request status.

Data and profiles

• Employees: identity data required for the process.
• Courses: name, dates and descriptive data.
• Requests: employee, course, date, status and outcome.
• Approvers: people reviewing requests within the defined scope.

An employee can have several requests and a course can relate to many requests. The Requests table also stores request-specific information, such as status and decision date.

Proposed components

Expected process

1. The employee creates a request with required fields.
2. The system saves the data and obtains an identifier.
3. A flow requests review from the appropriate approver.
4. The decision updates the request.
5. The employee receives the intended communication.
6. The agent can explain the process or query status with authorized access.

What to check

• The employee accesses only intended records.
• The approver sees their assigned set of requests.
• Approval and rejection branches update status correctly.
• An incomplete request receives a useful explanation.
• The agent does not confirm failed operations or invent identifiers.
• Changes are validated in testing before deployment.

The solution is a proposal for reasoning about components. Its final design depends on the process, usage rights and organizational controls.

19. Differences to understand clearly

To study this table, create your own example for each pair. If two concepts seem interchangeable, revisit the relevant section and explain each responsibility.

20. Reasoned revision questions

These questions are original exercises. Answers explain the intended concept; a real system may need additional components and controls.

1. What would you choose for an inspection screen with a specific visual experience?

A canvas app. It lets you design an interface focused on that task. Choose the data source and verify access, accessibility and device behavior.

2. What fits management of cases, contacts and related activities?

A model-driven app on Dataverse. The work is organized around records, relationships, forms and views.

3. A user opens the app but cannot update a request. What would you review?

Their data permissions and the identity used by the connection. Opening the app and updating a record are different authorizations.

4. How would you start a process when a Forms response arrives?

With an automated cloud flow. The event starts execution; subsequent actions retrieve data and perform processing.

5. When would you consider a desktop flow?

When the process requires interaction with an application’s interface. Also evaluate direct integration, the execution machine and attended or unattended mode.

6. What can restrict connector combinations in a solution?

A data policy. Classification and applicable controls must reflect the integrations allowed by the organization.

7. What do you need to move an app between development stages?

An ALM strategy with configured solutions and deployments. Pipelines facilitate the process. Business records need a separate strategy.

8. Does adding a manual let an agent automatically process a request?

Not on its own. The manual provides knowledge. Processing requires a tool or automation to perform the operation with the necessary data and permissions.

9. What does an MCP server provide to an agent?

Standardized access to supported tools and resources. Each operation still depends on its access configuration.

10. What would you do if the response changes after modifying instructions?

Rerun an evaluation set. This lets you check both the modified case and other scenarios that should retain their behavior.

11. What is Agent 365 for in this context?

To extend agent inventory, observability, and governance. Relate it to organizational administration and Copilot Studio integration.

12. Is it reliable to accept an AI-generated solution without reviewing it?

You must validate it before use. Check the data model, logic, permissions, results, and requirements of the features used.

21. Preparation and official resources

A practical study sequence

1. Review the five domains and flag concepts you cannot yet explain.
2. Model a small case with tables and relationships using fictitious information.
3. Compare a canvas experience with a model-driven one.
4. Create or study a flow with a trigger, actions, and a condition.
5. Design an agent with clearly separated knowledge and operations.
6. Explain how the solution would be shared, protected, monitored, and deployed.
7. Complete the official practice assessment and revisit areas where you have doubts.

You can follow the eight-lab PL-900 path to practice tables, apps, flows, and agents. Each exercise lists its requirements and how to verify the result. There are also introductory Power Platform projects to extend your practice.

Sources for keeping revision up to date

Exam session details

Microsoft specifies 45 minutes of exam time and 65 minutes for a standard session for Fundamentals. Accommodations and your session's conditions may change these times. Question counts may vary. Exam duration and experience.

The passing score for technical exams is 700 out of 1,000. It is a scaled score and does not necessarily equal 70% correct answers. Scoring and results.

Update criteria: use the current guide to decide what to study and each product's documentation to verify capabilities, availability, and requirements. Older courses and materials may retain sections from previous versions. In this edition, each section links to the source that expands or verifies its explanation.