Technical Readiness

The goal of Altus Technical Readiness is to prepare and clear the way so that a smooth Altus deployment can be performed by your implementation partner. The major points are:

Understanding licensing requirements
Establishing M365 Tenant functionality
Granting consent
Create a deployment account for your implementation partner
Create a Power Platform environment to host Altus
Additional Considerations

Please work through the Technical Readiness Checklist using any additional detailed information from the process below.

Licensing

Altus utilises Microsoft 365 products to provide a best-in-class user experience. You may already be using these products, or may need to source additional licenses. Your Altus or CSP partner can help you acquire additional licenses if needed.

As an overview, Altus utilises the following Microsoft technologies, from which the license requirements can be derived.

The license breakdown for using Altus

Each Altus User and the Altus deployment account requires:

Power Apps license (per user license, or per app pass)
Power BI Pro, or organisational Power BI premium capacity.
A license that grants Microsoft Teams usage. For Microsoft customers prior to April 2024, this is likely an Enterprise series license like E1, E3, E5, others. For new customers Teams must be purchased separately via a Microsoft Teams Enterprise license. More info here...

Note

We recommend the Power Apps Premium (per user) license at least for the key users + the Altus deployment account. End users can be covered by per app passes, but note there is additional administration required to manage the per-app passes to user assignments. More information can be found on the Microsoft about Power Apps per app page
The free Power Apps for Office 365 license does not meet the requirement for the necessary standalone Power Apps license. Please see above for the acceptable Power Apps options.

Warning

Please avoid using Microsoft Trial licenses for production use, as this may cause unintended interruption of service or data loss at expiry.

Licensing scenarios

Scenario	Power Apps	Power BI	M365/Teams	Power Automate	Planner	Project	Copilot
Core Scenarios - Mandatory
View and update Altus Tasks and tasks in other systems¹	Per app / Per user
Create/Update Projects, Tasks, Registers (Risks Issues, etc.), Portfolios, Programs, Benefits, Strategy²	Per app / Per user
Execute workflows inside Dataverse and non-premium connectors	Per app / Per user
View Power BI Reports		Power BI Pro / Capacity
Core Scenarios - Recommended
View and update Project Documentation			M365 E1, E3, E5 ...
Collaborate with other project members³			M365 + Teams
Additional Scenarios - Optional
Execute workflows with premium connectors⁴				Per Flow / Per user
View and update Tasks with Planner Basic					M365 E1, E3, E5 ...
View and update Tasks with Planner Premium					Project P1, P3, P5
View and update Tasks with Project Desktop						Project P3, P5
Smart Paste							(Not required while in Preview)
Natural Language Search							(Not required while in Preview)
AI Form Fill Assistance							(Not required while in Preview)
AI Row Summary							(Not required while in Preview)
AI Insights cards							(Not required while in Preview)
Allow users to converse with Altus Copilot Agent							M365 Copilot (1 needed for Agent publishing)

¹ – License multiplexing rules from Microsoft and external systems may apply and could require end-users consuming or authoring data to hold additional end user licenses. Contact the relevant third-party vendors for more information on their individual licensing requirements. More information about License Multiplexing in Altus.

² – AAD Guest access to the Altus Teams & Power App is not currently supported, but is likely to be enabled by a future update.

³ - Guest access via Teams and SharePoint has limitations and additional tenant requirements.

⁴ - At least one Power Apps Per User or Power Automate Per User licenses are required to deploy any Power Automate Flows that consume premium connectors. Power Apps per App users cannot be the owner of Power Automate Flows that utilise Premium connectors as the Flows will be disabled every 7 days.

Warning

Use of External/Guest accounts is unsupported. There are known issues with accessing the Microsoft Power Platform, Teams and Altus via External/Guest accounts. While using an External/Guest account some features will be unavailable and performance will be impacted. For more information regarding External/Guest accounts please click here.

Note

We only provide indicative general licensing advice, consult your Microsoft licensing advisor to confirm the specific licensing costs/requirements for your deployment.

Licensing FAQ

Can my organization use pay-as-you-go plan licensing for Power Apps?

Yes. Pay-as-you-go is an alternative licensing plan for Power Apps. Microsoft provides documentation on this option here

In order to set up this option for licensing your users to use Altus, organizations should follow the Microsoft documentation here.

Can I use Power BI Free instead of Pro or Premium?

The shared and embedded reports in Altus require all end-users to have either a Power BI Pro license or to be hosted in a Power BI Premium capacity.

From Microsoft: "With sharing, whether you share content inside or outside your organization, you need a Power BI Pro license. Your recipients also need Power BI Pro licenses, unless the content is in a Premium capacity."

Can my organization use trial licensing for Altus?

Having trial licenses expire during the deployment or rollout is undesirable and very costly. For Production roll-outs please utilise non-trial licenses at least for the deployment account.

Does the Power Apps provide my end-users with Power Automate capabilities?

The Microsoft Power Apps license allows Power Automate Flows to be used in conjunction with the Power App.

From Microsoft:. "In the original introduction of the new licensing and as a consequence of the older model, it was thought that a separate license would be required for a Power App to use A Power Automate Flow when, in fact, it is only the cost of the Power App that will apply even if the Premium connector is only accessed via the flow. The key guidance here is to understand the use case of the flow itself whether it is created to service the app or if it is the type that is expected to be shared or used outside of the application as it will then be a case of selecting the appropriate Power Automate license."

I'm confused by Power Apps per app plan license usage, can you help?

When using a Power Apps per app plan, you need to do the following things:

Purchase the Power Apps per app plan licenses in the quantity required.
Allocate the app passes to the environment in which the app will be used. This is done using Resources > Capacity > Add-ons.
Ensure that you've granted each user Power Apps per app baseline access under Licenses and apps.

Microsoft has additional documentation on Power Apps per app plan usage here: About Power Apps per app plans.

If your company purchases licenses through a third party, it's possible that the user license for Power Apps per app baseline access won't be added to your M365 tenant. If this is the case, you can add that license type to your tenant by clicking this link. You'll then need to confirm that your users have the Power Apps per app baseline access license applied in the M365 admin center, and add it if they do not.

Licenses for external execution and scheduling tools

For licensing information regarding any external execution or scheduling tools that an organization may choose to sync with Altus, please refer to the licensing information published by those software providers. For Project Online and Planner Premium see the service description from Microsoft here.

Tenant functionality

Altus utilises content, components and existing functionality of your Microsoft 365 installation to deliver the Altus experience.

Altus is tested to work with Microsoft 365 in the Microsoft issued default configuration, however after receiving the Microsoft 365 tenant it is possible for customers to disable key functionality that is needed for Altus to function correctly.

Altus relies on the following technologies within Microsoft 365:

Internet access for users
User driven M365 group creation
Power BI workspaces
Power Automate
Microsoft Graph
Teams Custom app installation
Exchange Online

Internet access

Altus is a product delivered over the Internet, and as such will require Internet access.

The following is a non-exhaustive list of hostnames known to be used by Altus and the Power Platform:

Microsoft Office 365
- *.office.com
- *.microsoft.com
- *.powerapps.com
- *.cloud.microsoft
Power Platform:
- *.dynamics.com
- *.crm.microsoftdynamics.us (GCC-High Cloud only)
Altus:
- *.altus.pro
- *.sensei.cloud
- *.getalt.us (GCC-High Cloud only)
Complementary Services:
- *.userback.io
- *.productfruits.com
- productfruits.help
- dc.applicationinsights.azure.com
- dc.applicationinsights.microsoft.com
- dc.services.visualstudio.com

Please ensure there are no proxy servers or firewalls that prevent direct access to the above domains or sub-domains.

Warning

This information is provided for information purposes only. As URLs to dependent services change regularly, URL whitelist approaches are expected to cause end-user outages that will invalidate product SLAs from Microsoft and Altus. Altus is not tested under whitelist conditions.

Internet Access for Report Customisation

During report customisation, a SQL connection to the Power Platform environment is required to connect and publish Power BI models. This connection is secure and encrypted using TLS 1.2 and communicates over TCP port 1433.

When report customisation is performed from an off-site location, this typically does not present an issue. However, if work is carried out from within a corporate network using a customer-managed device, this port may be blocked by network security controls.

To enable report customisation, outbound connectivity to the Power Platform environment must be allowed:

Destination: Power Platform environment hostname (defined during the Create Environment step)
Port: 1433

For additional information, refer to Microsoft’s documentation on the Dataverse SQL (TDS) endpoint security requirements:
https://learn.microsoft.com/en-us/power-apps/developer/data-platform/dataverse-sql-query#security-and-authentication

Microsoft 365 group creation

By default, all Microsoft 365 users can create Microsoft 365 Groups, however some organisations choose to disable this feature.

Microsoft Project for the Web (and other Microsoft tools such as Teams, Roadmap, Planner, Power BI, Stream, etc.) utilise Microsoft 365 Groups to provide key functionality.

Altus utilises Microsoft 365 groups to:

Define the list of people working on each project and define who can be assigned tasks in the schedule.
Define who can see the items inside Altus associated with the project such as risks and issues.
Store documents and provide a collaboration space in the SharePoint site collection.

In the event that group creation is prohibited, groups can be pre-created by an administrator, and users can then associate their projects to existing groups if necessary, however, the gating/approval process around Microsoft 365 Group creation is outside the scope of Altus.

Microsoft Graph

The Microsoft Graph is an API that allows integration between Microsoft 365 applications, and in the case of Microsoft 365 groups and Teams, is the only API available.

Altus utilises the Microsoft Graph API to provide integration between Power Apps, groups and teams.

Power BI Workspaces

Power BI stores reports in workspaces. By default, all Power BI users can create workspaces, however, some customers choose to disable this feature.

Altus utilises Power BI to deliver shared reports that form part of the application. During deployment we will put these shared reports in a dedicated workspace to keep them separate from other reports in the environment.

To do this, we will create the following Power BI workspaces:

Altus - orgXXXXXXX
Altus (Test) - orgXXXXXXX

It is recommended that Power BI workspace creation not be disabled for the Altus deployment account.

Power Automate (Flow)

Power Automate is a Microsoft service that forms part of your M365 tenant utilised by Altus to provide workflow capabilities. The deployment engineer will create the following connections in the nominated Power Platform environment. If you will have a DLP policy defined for the environment, please ensure that the following connections are allowed:

Image shows connection approvals
Image shows connection dataverse
Image shows O365 connection
Image shows Teams connection

^* - At least Power Apps Per User or Power Automate Per User licenses are required to deploy any Power Automate Flows that consume premium connectors. Power Apps per app users cannot be the owner of Power Automate Flows that utilise Premium connectors as the Flows will be disabled every 7 days.

Teams custom app deployment

By default, Teams provides the ability for users to add Apps from the published store or to add custom apps to the environment. Customers can choose to disable the extensibility features in Microsoft Teams.

Altus comes with a Custom Teams App that will be added to the Teams deployment to provide integration features between Power Apps, SharePoint and Teams.

To allow this to occur, Custom Teams Apps must not be disabled (default setting), or at least the Altus App must be specifically allowed by the governance policies in Microsoft 365:

Image shows allow custom teams apps

Exchange Online

Altus makes the assumption you will be using Exchange Online (part of M365) for your email services. If you are using Exchange Online for your email services then no further action is needed on this point.

There are various workflows within Altus that will attempt to send users emails. By default this is done via the Exchange Online functionality of Microsoft 365, because the transmissions of the emails within the Exchange infrastructure (not SMTP) are assumed to be protected/encrypted in transit.

If your organisation does not use Exchange Online, e.g. Exchange Server on-premises, or GMail etc., these workflows can be amended to use SMTP to external email providers at your option. This would be done via an additional engagement and with your consent that the content transmitted via email will be unencrypted.

Altus is deployed into your Microsoft 365 tenant, and requires consent for deployment and continued operation. To facilitate this, an administrator will need to grant consent for the Altus software to work in conjunction with the Microsoft 365 tenant.

The procedure for granting consent varies depending on which Microsoft Cloud is being used.

Cloud	Primary audience	Altus Support
Commercial	Global enterprises	✅ Yes - Public Cloud Consent
GCC	US Government & contractors	✅ Yes - Public Cloud Consent
GCC High	DoD contractors / ITAR	⌛ Coming Soon - GCC-High Consent
DoD	US DoD only	⚠️ No support - let us know
21Vianet (China)	Mainland China	⛔ No support
Germany Sovereign (Black Forest)	Existing German tenants	⛔ No support, legacy only
Microsoft 365 Local disconnected	On-premises, disconnected	⛔ No support, no Power Platform

Public Cloud
GCC High

To provide consent, please have an M365 Administrator click on the three links below, and agree to the terms on the dialog displayed:

More detailed instruction and explanation of these steps are below.

Altus Deployment

Altus will need to be initially deployed and updated regularly. To allow this, consent is given to a Service Principal that is used solely for deployment, separate from the other operational identities.

To consent to deployment, an M365 administrator of the tenant must click on the following link:

Grant consent to the Altus Deployment

Image shows the consent deployment

Note

This consent does not grant Altus any permissions by itself. Instead, it allows permissions to be granted to the service principal later, within a dedicated Altus Power Platform environment created in subsequent steps. This ensures that the service principal has no access to additional data or systems while enabling regular patches and updates to be deployed to the environment. Microsoft CRM and Project Operations are updated using the same mechanism.

Altus Applications

Altus provides the user with an experience that integrates with the services provided in your M365 Tenant. This is achieved via making connections to Power BI Reports, the Microsoft Graph and Microsoft Dataverse services.

To allow this to occur, and prevent each user from receiving this consent request, an M365 administrator must grant pre-consent to Altus Applications:

Grant consent to Altus Applications

Image shows delegated permissions

Note

This consent is solely for user-delegated permissions (Application Permissions) that the Altus needs to function while the user is present. Granting this consent does not give the application any abilities beyond what the user can do, and it filters what the application can do while the user is present. It cannot be used remotely by Altus and does not confer any additional permissions to end-users. More information about delegated permissions....

Note

The blue tick mark next to Sensei indicates that this identity is a Verified Publisher and is managed by a Microsoft Certified Partner.

Altus Hub

Altus also has a website called Altus Hub which is used to initially deploy Altus as well as a centre for self-service access to end-users to monitor and make changes to their subscription services. This website utilises your own Azure AD to log in users from your Microsoft 365 tenant. This way Altus never stores any passwords for users but is able to cryptographically verify their identity.

To allow this to occur, an M365 administrator must grant consent to the Altus Hub app by navigating to the following: Grant consent to Altus Hub .

Image shows consent for the Altus Hub

Note

Altus Hub is for the administrative self-service. This consent is for basic profile information that allows us to sign on users and verify the tenancy they are coming from. Only username and basic profile attributes can be read. This allows you to control security via Entra ID conditional access and prevents us from needing a separate username/password database for your self-service admin users, which could potentially have a greater impact on security posture.

Warning

If your tenant has turned off the ability for users to grant consent for applications, an administrator may be needed to grant consent to the Altus Hub application via the this process.

To provide consent, please have a GCC-High M365 Administrator click on the link below, and agree to the terms on the dialog displayed:

Altus Admin Consent for GCC-High

Image shows the GCCH consent dialog

Agreeing to the consent will create the following Enterprise Applications and grant them necessary permissions:

Application	Purpose
Altus - GCC High	Parent Principal
Altus Deployment - GCC High	Deployment and update delivery
Altus Applications - GCC High	Altus for Teams and Altus Power App
Altus for Project - GCC High	Altus for Project, Project Desktop add-in
Altus for Word - GCC High	Altus for Word, Word add-in
Altus Hub - GCC High	SSO for self-service update deployment control

Deployment account

To enable the deployment engineer to perform the interactive activities necessary to deploy Altus to your environment, they will require at least temporary access via an account in the target environment.

Requirements for the deployment account include:

Must be accessible externally (from the Internet)
Must not be a guest account, as guest accounts cannot be used with all the features of Power Apps at this time. i.e. the account must be created in the same Entra ID Directory as the Power Platform environment.
Licensed as per an end-user (see license section above). A Power Apps Per User license is required for this account to enable Power Automate Flows.
Power platform permissions: The deployment account will require System Administrator permission within the target Power Platform environment for deployment and customization activities. This permission is granted after environment creation - see Granting PowerPlatform permissions to the deployment account.
(Optional) Teams Administrator: To allow us to deploy the Teams application and configuration policy for your users we require access to the Teams admin portal. To do this, grant the deployment account access in the Office Admin Centre. This is a once-off activity that could also be completed by the customer IT governance team if desired.

Note

Altus does not recommend the use of "Shared Accounts". It is always important to adhere to the relevant customer Information Security Policy for the target environment.

Decommissioning the deployment account

It is possible to decommission the Deployment Account after Altus is deployed, however, a new responsible person will be needed to own the Power Platform assets. More information on this procedure is here: Decommission or Update the Deployment Account

Warning

To prevent system downtime, please work with your engagement lead before either disabling the Deployment Account or changing the password for the Deployment Account.

Create an environment

A new, dedicated, production Power Platform environment is required to host Altus. This gives your organization control over security and additional management tasks when maintaining the solution and environment.

Note

While it is possible to deploy Altus into a pre-existing environment with other Dynamics 365 and 3rd party Apps, this is not a scenario we actively test, or support.

Altus is deployable into most types of Power Platform environments:

Environment type	Altus deployable?
Production (recommended)	✅
Default	❌
Sandbox	✅
Trial	✅
Developer	✅
Dataverse for Teams (Oakdale)	❌

Create a new environment from the PPAC - Power Platform admin center.

For production installations Set the type to Production - be aware that using Trial or Developer type environments could lead to data loss on expiry or inactivity.
Enable Add a Dataverse Data Store.
NOTE: Managed Environment setting enables addition governance features and can be enabled but is not required for an Altus installation.
NOTE: Please choose your region carefully, this controls the data sovereignty of the application and is difficult to change later.
NOTE: Do not enable Dynamics 365 apps.

Press Next.

New environment modal

Language: Specify the language for the install. At time of writing we do not have complete language support for languages other than English, but it is on the development roadmap.
Currency: Specify the base currency for the environment - this is the currency used to record the "Base" value of all currency fields, even if those values were in other currencies at the time of data entry. Suggest using the main currency of the organisation, rather than matching the geography of the deployment.
Security Group: This group specifies who will have access or appears as users (System Users) in the environment. Either select none, or specify a group that will include the interactive users of the system as well as the Entra ID accounts for any bookable resources that will be required to assign tasks or timesheets. These users will be added to the environment automatically over time, although Microsoft is not specific about the timing of this.
URL: The URL of the environment. Please customise this so the URL of the environment is meaningful. Commonly include "dev","test" or "prod" in the URL if there are planned to be multiple environments. Please note that while this URL can be changed later it will cause issues in Altus and will require manual steps to rectify - so please choose carefully to avoid unnecessary support calls.

Add database modal

Warning

Once created and Altus has been deployed, please DO NOT change the URL. This could orphan the environment and prevent updates from being applied. If you do need to change the URL after deployment, please collaborate with your Altus partner manager.

For further information on how to complete these tasks, review the documentation on Microsoft docs here: https://docs.microsoft.com/en-us/power-platform/admin/create-environment#create-an-environment-with-a-database

Add permissions for the Deployment Account

After creating the environment, please ensure the deployment account has the System Administrator inside the Platform environment:

PPAC -> Environments -> Settings -> Users -> Security Roles

Open the PPAC and select the target environment where Altus will be installed