Power Platform Governance and Center of Excellence Setup

Not dead, but no longer growing. Microsoft's own repository states the kit is no longer receiving ongoing feature investments or updates and points to the Power Platform admin center's native Inventory, Usage, Monitor and Actions experiences instead; it was always a community accelerator rather than a supported product. Our recommendation for most tenants is to run on the native admin center capabilities plus the roles and runbook, and to deploy the kit's core inventory components only if you specifically want its Dataverse inventory and Power BI dashboards and are willing to own an accelerator that may break with platform changes. We put that choice in front of you in the workshop with the trade-offs written down.

An operating model: who administers the platform, where solutions live at each stage of their life, which connectors may touch which data, how a new maker gets started, how a business need gets an exception, and what gets reviewed monthly. Tooling reports on that model; it does not replace it. This engagement implements the model in your tenant — environments, DLP, onboarding, cleanup, licensing posture, runbook — and configures whichever tooling you chose to report on it.

Only if enforced blind, which we do not do. Every existing app and flow is analyzed against the proposed connector classification before enforcement; the ones that would break are listed with their owners, and each gets a decision — reclassify the connector, move the solution to an environment with a different policy, grant an exception, or fix the solution. Enforcement then runs staged, non-production first, with the exceptions process already live. The goal is zero surprised owners, not zero exceptions.

It stops being the place where everything lands. It is renamed to signal its purpose, restricted so production work no longer accumulates there by accident, and its existing contents are triaged: kept, moved to a purposed environment, or retired by an attested decision. Environment routing then sends new makers to a personal developer environment instead, so the default stops growing.

New makers get a personal developer environment automatically through environment routing, inside an environment group whose rules treat it as a safe sandbox — no ticket required. When a solution matters to the business, the onboarding process defines how it graduates to development, test and production environments, and that is a request with a defined turnaround, not a gate. Locking creation to IT alone is a policy option we will show you the trade-offs of, and usually recommend against.

They are the most urgent item in the inventory, because a flow running under a disabled account's connections fails silently. We identify every app, flow and agent with a departed or disabled owner, ask the most likely business owners to attest, reassign ownership and connections for the ones that matter, and archive the ones nobody will vouch for. Nothing is deleted without an approved retirement queue, and the runbook makes this a monthly check rather than a one-time rescue.

Partly, and the review exists to say exactly where. Microsoft 365 plans include rights to build apps and flows using standard connectors within Microsoft 365; premium connectors, Dataverse-backed apps, Managed Environments and Copilot Studio need Power Apps Premium, per-app, Power Automate Premium or Process licenses, pay-as-you-go, or capacity — and it is common to find a premium connector in a flow that nobody licensed. The posture review maps premium usage to licensed users, states the Managed Environments implications, and records a decision on each gap; the purchase remains yours, at Microsoft's list price if you buy through us.

Inventoried, yes; governed by DLP, yes; fully governed as an AI program, no — and we say so. Agents live in Power Platform environments and appear in the admin center inventory alongside apps and flows, so the environment strategy, DLP policies and ownership attestation all apply to them, and the runbook documents the Power Platform admin center and Microsoft 365 admin center agent controls. Deciding what agents your organization should build, how they are approved, and how their risk is assessed is the AI Governance and ISO/IEC 42001 Readiness Assessment; securing them is AI Security for Microsoft 365 Copilot and Agents. Our agent governance primer explains the difference.

Microsoft's premium governance layer for an environment: usage insights, limits on how widely apps can be shared, solution-checker enforcement, maker welcome content, and the prerequisites for environment groups and routing. The catch is licensing: every user of a managed environment must hold a premium Power Platform license or capacity add-on, and Microsoft has said in-product notices for unlicensed use begin in mid-2026. We enable it where your entitlements cover the environment and leave it off where they do not, with the gap recorded in the posture review.

For the governance itself, only if you choose the CoE Starter Kit, which needs its own Dataverse environment; the native admin center experiences do not. For your solutions, Dataverse capacity depends on what makers build, and the posture review states your current capacity position so a business-critical app does not stall on storage later. We do not buy capacity on your behalf; we tell you where you stand.

That is the point. Governance here is guardrails, not a wall: makers keep a personal environment to build in, the rules of the road are written down and were chosen with your top makers in the room, the exceptions process gives a legitimate need a path, and graduation to production is a defined step rather than a fight. Tenants that lock the platform down get shadow IT; tenants that govern it get a platform they can trust with real work.

Three weeks: inventory and the governance workshop in the first, environments, DLP and tooling in the second, cleanup, licensing review and handoff in the third. $4,950 per project as an estimate for one tenant with dozens of apps and flows across a handful of environments, confirmed as a fixed written quote before work begins — you pay after you approve delivery. Estates with hundreds of solutions, many Dynamics 365 environments or the Starter Kit's full component set are priced in the quote, not discovered mid-project; ongoing operation of the runbook is a separate recurring scope if you would rather not run it yourselves.