Introduction

The Power Platform democratises application development. That is both its greatest strength and its biggest operational challenge. After implementing governance frameworks for large global enterprises — including organisations with thousands of makers and hundreds of environments — I have seen what works and what creates expensive technical debt.

This post covers the governance patterns I rely on in production, moving from “anyone can build anything” chaos to a structured, secure, and scalable maker ecosystem.


Why Governance Cannot Be an Afterthought

Most organisations discover the need for Power Platform governance only after something goes wrong:

These are not hypothetical scenarios — I have seen all of them firsthand. The good news is that Microsoft provides comprehensive tooling to prevent them. The bad news is that tooling requires deliberate configuration and a governance model to back it up.


The Governance Pillars

A mature Power Platform governance framework rests on four pillars:

┌─────────────────────────────────────────────────────────┐
│                  GOVERNANCE FRAMEWORK                   │
│                                                         │
│  1. Environment Strategy  │  2. Data Loss Prevention   │
│  ─────────────────────── │  ─────────────────────────  │
│  • Default isolation      │  • Connector classification │
│  • Dept environments      │  • Business / Non-Business  │
│  • Sandbox / Production   │  • Blocked connectors       │
│                           │                             │
│  3. CoE Starter Kit       │  4. ALM & DevOps           │
│  ─────────────────────── │  ─────────────────────────  │
│  • Inventory & visibility │  • Solution-based packaging │
│  • Compliance monitoring  │  • GitHub Actions CI/CD     │
│  • Maker enablement       │  • Managed environments     │
└─────────────────────────────────────────────────────────┘

Pillar 1: Environment Strategy

The most common mistake is allowing everything to happen in the default environment. This environment cannot be deleted and has relaxed defaults — it becomes a dumping ground.

My recommended environment topology:

Environment Purpose DLP Policy
Default Learning & experimentation only Strict — no business connectors
Department (per BU) Team solutions, shared resources Moderate
Production Approved, monitored solutions Strict
Developer (personal) Individual maker sandbox Moderate
Sandbox Pre-production testing Mirrors production

Implementation via PowerShell / PAC CLI:

# Create a department environment with managed environment features
New-AdminPowerAppEnvironment `
  -DisplayName "Finance - Production" `
  -LocationName "unitedkingdom" `
  -EnvironmentSku Production `
  -ProvisionDatabase $true `
  -SecurityGroupId $financeGroupId

Managed Environments (premium) are essential at scale — they unlock usage insights, weekly digest emails to admins, and maker welcome content customisation.


Pillar 2: Data Loss Prevention (DLP) Policies

DLP policies are the security backbone of the platform. They control which connectors can work together, preventing data from leaking between trusted and untrusted services.

Three-tier classification:

DLP Policy Design Principles I follow:

  1. Layer policies — apply a tenant-wide base policy, then environment-specific overrides. The most restrictive policy wins.
  2. Block HTTP connector in production — the HTTP connector is an escape hatch that bypasses DLP entirely. Block it except in developer environments with explicit exception process.
  3. Audit before enforcing — use audit mode first to understand the blast radius of a new DLP policy before enforcing it.
{
  "displayName": "Global Base Policy",
  "environments": { "filterType": "AllEnvironments" },
  "connectorGroups": [
    {
      "classification": "Confidential",
      "connectors": [
        { "id": "/providers/Microsoft.PowerApps/apis/shared_sharepointonline" },
        { "id": "/providers/Microsoft.PowerApps/apis/shared_office365" },
        { "id": "/providers/Microsoft.PowerApps/apis/shared_commondataservice" }
      ]
    },
    {
      "classification": "Blocked",
      "connectors": [
        { "id": "/providers/Microsoft.PowerApps/apis/shared_twitter" }
      ]
    }
  ]
}

Pillar 3: Centre of Excellence (CoE) Starter Kit

The CoE Starter Kit is a collection of Power Apps, Power Automate flows, and Power BI dashboards that give admins full visibility into what is happening across the tenant.

What it gives you out of the box:

What I customise in every deployment:

CoE Customisations:
├── Custom risk scoring weights (adjust for your data sensitivity)
├── Integration with ServiceNow / Jira for environment request approvals
├── Power BI executive dashboard (tenant health at a glance)
├── Automated orphaned resource cleanup (flows with no owners)
└── Custom welcome email with internal training links

A well-configured CoE shifts the admin from reactive firefighting to proactive quality management.


Pillar 4: ALM with Solutions and DevOps

Ungoverned apps are built directly in environments — no source control, no review, no deployment pipeline. The antidote is Solutions-based development combined with CI/CD.

The golden rule: if it matters, it is in a solution.

My standard ALM pipeline using GitHub Actions:

# .github/workflows/deploy-power-platform.yml
name: Deploy Power Platform Solution

on:
  push:
    branches: [main]

jobs:
  export-and-deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install PAC CLI
        uses: microsoft/powerplatform-actions/actions-install@v1
      
      - name: Export solution from dev
        uses: microsoft/powerplatform-actions/export-solution@v1
        with:
          environment-url: $
          app-id: $
          client-secret: $
          solution-name: MyEnterpriseApp
          solution-output-file: solutions/MyEnterpriseApp.zip
          managed: false
      
      - name: Unpack solution
        uses: microsoft/powerplatform-actions/unpack-solution@v1
        with:
          solution-file: solutions/MyEnterpriseApp.zip
          solution-folder: src/MyEnterpriseApp
      
      - name: Import to production
        uses: microsoft/powerplatform-actions/import-solution@v1
        with:
          environment-url: $
          app-id: $
          client-secret: $
          solution-file: solutions/MyEnterpriseApp_managed.zip
          managed: true

Naming conventions I enforce:

Solution:  [OrgCode]_[Domain]_[AppName]_v[Major]
App:       [OrgCode]_[Domain]_[AppName]
Flow:      [OrgCode]_[Trigger]_[Action]_[Entity]
Table:     [orgcode]_[entityname]
Column:    [orgcode]_[columnname]

Consistent naming sounds trivial. After 18 months in a tenant with 500+ assets, it becomes the difference between a maintainable platform and an unmaintainable one.


Operational Playbook: Common Scenarios

Scenario 1: Maker wants to use an unapproved connector

Without governance: They figure out a workaround (HTTP connector, custom connector) or just use the free tier of the external service.

With governance: Submit a connector exception request via the CoE portal → admin review within 2 business days → approved connectors added to the relevant DLP policy → maker gets a notification.

Scenario 2: Critical flow breaks because the owner left

Without governance: Production outage. Nobody knows the credentials. Flow runs under a personal account.

With governance:

Scenario 3: Capacity planning for Dataverse

Without governance: You hit the Dataverse storage limit. Emergency purchase under pressure.

With governance:


Metrics That Matter

After implementing governance, track these KPIs monthly:

Metric What it Tells You
% flows with service principal connections Reliability of production automations
% apps with 2+ owners Bus factor risk
DLP policy violations (audit mode) Shadow IT indicator
Orphaned resources Governance process health
Maker count by environment type Is the default environment being misused?

The Cultural Side

Technology alone does not create a governed platform. The hardest part is always change management:


Conclusion

Power Platform governance is not about restricting innovation — it is about making innovation sustainable. The organisations that invest in governance early end up with a thriving, trusted maker ecosystem. Those that do not end up with a shadow IT problem disguised as digital transformation.

The pattern that works: strict defaults, easy exceptions, full visibility, and strong maker enablement. Start with the CoE Starter Kit, build your environment strategy, and layer DLP policies with care. The first 3 months of governance work will save years of remediation.