Power Platform Governance Without Killing Innovation: Security, DLP, Environments & Citizen Development with Michael Roth [MVP]

Welcome back everybody to the M665s and podcasts. Today we are talking about one of the most important and often misunderstood parts of Power Platform governance. Power Apps, Power Automate, PowerPages, Co-Pilot Studio, DataWerrors, and the wider Power Platform gives people, yeah, gives people across the business, the ability to solve problems really quick. The accessibility is the magic, but it also creates real enterprise questions. Who can build what? Where do business data go? How do we keep environments secure? How do we prevent shadow IT without becoming the team, say, no to everything? My guest today is Michael Rod. Michael has been working as a consulate since 2011, and has been a part of the IT and Microsoft ecosystem since around 2015. His experience spends from Microsoft 365, collaboration technologies and organizational consulting, give him a broad view of what it really takes to make digital solutions sustainable. Today, Michael focused on Power Platform governance, administration security and organization enablement. He has organization, practical governance frameworks from DLP strategies, and environment architecture to custom and mentoring, lifecycle management, and adoption tuning built directly from the platform. This perspective is simple, but Power Platform is not a hobby tool. It's an enterprise software that happens to be accessible. The goal is not to slow make us down, but it gives the clarity, confidence and God-wraiths to build faster, saver and gives more business value. Michael, why come to the MC65 with M podcast? It's great to have you here. Thank you very much for the invitation. It's great to be here. Just a small clarification right at the beginning, the goal to give the maker clarification is the goal of my governance approach and not the goal of the Power Platform. But I think that's pretty clear to everyone who's listening. Sorry, it's for both in Germany. I wasn't Germany. It's really odd today. I think it's a little bit of a put on the break, but thank you. Michael, before we go deep into governance, security, administration, tell us a little bit about your journey. You started in consulting 2011, then moved more deeply into it. Yeah, the Microsoft ecosystem around 2015, what drew you into this world? Pure accident and a little bit of laziness, I would say. In 2011, when I started my journey into consulting, it wasn't necessarily IT consulting, but it was more organizational development, where I worked with mostly managers in all kinds of ranks towards how to create a team, how communication works, how change management actually works, what is necessary into that. So that was more or less my origin. And during this time, I stumbled upon a project that was closely reloaded later to IT, to information classification, so IT security, actually. And I managed the... Intramanagement plan, how this company would build up an information classification system. And there was so much work, because it was a big enterprise. At some point, we even maxed out our excel tables. We had excel tables with all the list, all the information that we needed, and we maxed it out, so we had more than 1 million lines. There was a point where I realized the thing with the computers and IT, maybe they would stick around, and maybe it would make sense to dive more into the technical part of life and all work. So it's kind of out of the blue, I applied for a job at a IT company, and they were like, "Great, do you have any clues?" And they said, "No." So there was a little bit awkward interview, to be honest, because I got lots of IT questions, and I couldn't answer them. In fact, I think last week, I thought about one of those questions, and I still have no idea where this comes from. There was a guy, and he was like, "Out of the blue, do you know what a forest is in IT?" There was like, "No, never heard that term before in IT." And I still haven't. I know that this is now the collection of all the entries in your enter ID, something like that, but there was... I was completely lost in that interview, but somehow I managed to build, I think, a car park management app, or something like that. Each app was list and all this stuff. There was way before part of that form, when I even started in that. Yeah, and then I kind of was stuck in IT, and focused on change management and introduction of Office 365 and M365. What is teams and planar and project, and how does it work? So I would say the soft skills guide side of IT. And then, because I'm really lazy, I discovered Paul Orman, Paul Epps, and I was like, "Yeah, that sounds like my kind of gem. Like automate your task. That's what I want to do for my task." And I failed miserably, but then I discovered the community, the Microsoft community around it, and I got so much help, and I engaged with different people. And then, at some point, I built my first flow, and then I got better at building flows, and then apps, and then I worked as a, yeah, more or less app and flow, and I developed for quite some time. But I realized it was a struggle for me, because coding doesn't get naturally to me, as I mentioned, I didn't study IT, or didn't have any experience. So, after a couple of years working with the Power Platform, I decided that I should use my skill that I had from my university, like communication, change management, analyzing situations, that I should use this together with IT, and the end is, that I now consult companies with how to work with Power Platform, why in general, work with Power Platform, how to make it secure, because somehow no one talks about it, like administration security and governance. So, I kind of took this niche or this road by accident, because nearly no one was there, and it kind of fitted my skills. So, it is fun for me now, and I'm still at the point where, and say, I can develop my apps and flows, and I do that for myself, but on an enterprise scale, for example, please let the code us do their work, because I'm clearly not as good as them are. So, yeah, that's how I ended in my spot, in a short story. Yeah, awesome, awesome. And you're also well-regunized sports star, you are a mini golf champion, how would you? How do you achieve your career? Well, this sounds bigger than it actually is, I guess. That was, with a bunch of people from the community, I attended the South Coast Summit in the UK, and I don't know why, but we thought, we come from Germany, we drive through Belgium and the Netherlands, and then we can go by car to the UK. So, let's make a road trip, this is fun, right? It was fun, I would say, first 15, 20 minutes, and then you have like a day-long road trip in a car, and it was a little bit, it was a lot, a lot of driving, so we decided to take a break at some point, and there wasn't any golf course. And I won this game, and since I won this game against many other Microsoft MVPs from different areas, I decided to call myself a Raining Mini Golf Champion, from that point on, that's all this, but that's the stories about, actually. Maybe I could delete it now from this, but it's still there, and I don't know. Yeah, a lot of people see the power platform, I say, as collection of tools like PowerX Power Automate, Power BI, DataWords, Co-Pilot Studio, and once also in it. You see it as an organizational capability. What's the difference between those, yeah, both mindsets? Yeah. All platform consists of many different services, so Power Automate is a service, Power Apps is a service, Power pages is a service, and so on and so on. So what you get there is a classic software as a service thing. And that's still true, but the whole platform that combines, or basically is a foundation for all these services to run on, that is the Power Platform that is baked into your tenant, into your Azure subscription, into everything with that. Then that is not software as a service, that is a platform as a service. And there's a difference between that, what kind of features are managed by Microsoft when you have a software as a service product, versus what is managed by Microsoft, when you have a platform as a service product. And that is a difference. And therefore, Power Platform is kind of both, it's a platform as a service, and if you have enabled it in your tenant and you use it, the services is software as a service for your users, but not for you as, let's say, administrator, as someone who owns the tenant, as someone who is in charge. And that makes a fundamental difference in how to act, as a, let's say, Power Platform developer, or Power Platform administrator, or Power Platform, I don't know, owner. If you are the owner of the platform, or the services in your company, then you have to ask different questions and do different things. Evolving and running flows is one thing, but managing the whole group of makers and citizen developers who do that is a different thing. So that is something, yeah, sometimes I think, Microsoft started to deliver the story, to really make this a story, that even this is just a low-code platform, it still requires work and setup and maintenance. That is something, and I really like that Microsoft started to spread the story more and more, because in the very beginning, it was all a little bit, it's easy, everyone can do that. It's a little bit, okay, okay, here, and then, voila, you have a flow, a business critical flow. So that is, yeah, that is, I guess, the main difference between, why? Because I say, there's a platform, on this platform, there are services like Power, or my Power Apps, and whatnot. Yeah, and that comes, you're, I say, your clear statement, you say, Power Platform, there's not a hobby tool, it's an enterprise software. I love the story. Yeah, I would love to repart the platform to be a hobby tool, because I have so many things I would automate for myself, but for Power Platform, you need a business license. That is the point. That means even if you do something as a hobby tool with Microsoft, then you always bound to your, not to your talent, but to your license, is so to say. That is something, but yeah, sorry, didn't want to interrupt, it's not a hobby tool. No, it's a pure, pure professional business application platform. Yeah, what's the, other more common misconceptions you have when they hear low-code, citizen development, and I think, actually, we have also Star Wars low-code on the platform. A vibe coding, or low-code? I don't know how, how, how, Microsoft actually called it. We are still on a low-code platform with the Power Platform. Vibe coding is getting more and more into the, into the platform. There was, I was called, Power Apps Plan, Power Apps Plan, or something like that, where you basically build your apps and codes, and whatever, with prompts. So this vibe coding element is getting more and more into the platform. Not sure how I think about that, but the most common misconception, I guess, I guess it changes, or it kind of changed. And for very long years, I think it always was following the Microsoft message, it's easy, and everyone can do that. That is not wrong, but to have it, or to treat it more like an enterprise, or business tool, then it's not easy. If you want to use it in a professional way, if you want to have a regional profit, for example, or if you want to solve a problem, then you would have to put in some effort. And it's, especially, I would say, Powerpages, Power Apps. That is something, or at least, not all Power Apps, but Canvas Apps, that require some kind of coding. That requires some kind of learning, and some time and effort to put in. And that is, I guess, we had, if you see this, like, like, wave way of the development, at the beginning, everyone was like, "Yeah, there's a super easy, and everyone built a whole lot of apps and flows, and they are all stored in default environment." And after a while, they broke, they never really got finished. It was all tests, and they realized, "Okay, we have to do some series. We have to put in some series effort here." And then this, the usage of Power Platform went a little bit down, I think. And then there was a point where the more IT professionals started to do a "Urto Discover Power Platform" and put in some more work. And now, what I see is lots of organization use Power Platform. And users are using that for their first productivity projects, so small kind of flows remind us, something like this. And on the other hand, we have not even business apps, but whole business projects, like solutions that contain dozens of flows and apps and tables and everything. And that is, and plugins and custom coding. And all of that, that is like, a lot on the one hand side and just lower effort on the other side. So that's kind of interesting. There seems to be no in-between, more or less. Yeah, that's good. But I think for people to understand what's happened, can you give us one or two examples where we have seen it's yeah, flow at become, start with a good attention, but it becomes critical in the business? Yes. It's a little bit tricky because when you say a flow or an app or whatever, a Power Platform solution becomes business critical, it always depends on what you mean with critical. Because when you have a flow that helps you get the correct data from a big database, like SAP, I write my own code, I have access to the SAP database and so I can delegate my access to my flow to really get access and you even get, get, let, show me the data that I need for personal work. That is fine, that in a few terms can be a non-business critical. If now this flow gets shared with more and more people and they edit it and they customize a little bit and in the end you have 40 people that have automated access to SAP and they would not only receive data, but also write data, then you would, that would become a problem because you don't know what kind of data is getting in and you don't have like a layoff proof or something like that is something that you want to avoid. That could be a business critical, a flow that started with good attention, but then got business critical. I have another example yet a completely different example. I had a company and they used in the pre-Christmas season, they have like these Christmas parties and celebrations and they do a secret center and stuff like that. So very harmless, right? They would do this every year and at some point they said okay let's do this with power element because to figure out who is gifting to whom, like the secret center, a center. We can do this with a little bit IT with a little bit automation that works, right? So they build a secret center app. Absolutely not business critical. The point is now every employee of the company was invited to this app, which is also fine, but then you have one, I have one small little app that doesn't do something critical, but there are 500 people in there. And over the time you got a lactation in your stuff, like people are leaving the organization, new people are coming and so this app was kind of the list of members was outdated. And that means that you had at least 15 to 20 people or accounts in there that were not active anymore. And that is like a huge security gap because these accounts could be utilized, they were still in the Entra ID, whatsoever. And with those accounts, you could use some serious harm. So that is another example of an application or an idea that is very harmless and very fun and lighthearted, but if you don't maintain it and you have so many people involved, there's so much potential for mischief, let's say. So it all depends on the context, what is critical or what is not, what is secure, what is insecure, it's never the app, almost never the app, it's almost always the behavior of the people. And that is something important to understand, especially if you think about governance and security, all the tools that we have in the admin center, you have data loss prevention policies in that, that are tools to make your governance work, but in the end, you have to train your people because they are first and last baseline of security, basically. Yeah, tools help, absolutely. If we wouldn't have a tool like the app or something, that would be tricky. Yeah, I think, yeah, for governance, you're the specialist, the governance specialist around the world. So many makers here, the word governance, and yeah, immediately, they think of bureaucracy, tickets, approvals and restrictions. Yes, absolutely. I do really find governance for them. Actually, I think I don't really find governance, I explain governance. I think that is a thing, because in governance and security as well, you always have something like you have to decide, do you want it to be super secure and super governed, then it's really not handy to work. Then it takes effort, it takes time. You have to write tickets and you have to make backup copies and all that. That takes time and it's not this easy breezy. I just click around and move ahead of the flow. That is something different. If you want this to be super easy and with no restrictions at all and everyone can use it any time and it's super fast, then it's probably not that secure. So you have that decision to make anyhow. But the idea that people think of governance and now it's going to be slow and it's super awkward and I can't use all the connectors that I want so that they don't want really governance or security. That's understandable and they absolutely see that. I have a very interesting example that I've seen with a German company, surprised it was a German one. They said, "Okay, we want this secure." They came up with a process who can develop apps and flows, who would prove and test those apps and flows and then they would be raised at some point. The whole process was kind of solid. It was secure, it was good, understandable. Everyone knew how to work, how to handle it, how this process works, but this process took in the best case if I have, from my first idea, what kind of app offloader do I want to build? From I requested the access to the environment and to the right connectors. If everything went through smoothly, this process went for six months. So best case, I have an idea for an app and six months later it's done, regardless if I work six months on the app or just finish it in one day. So that was a little bit of security and governance overkill and people were really angry and they were like, "We don't take this anymore. That doesn't make any sense." And that was just the best case. So if you work on your app and two weeks, three weeks into work, you realize, "Oh, dang, I need another connector." The whole process started from the beginning. So it could be that your application development lifecycle would take a year for an app that you would build in a week. That was overkill. Now, the point is, so you can overdo it for sure, but the governance insecurity doesn't automatically mean flows, luggage and not usable anymore. And quite often in my workshops, I use an example that I think fits really well. And this is the idea if we think about traffic rules that we have in our everyday life. We do have traffic rules right now. We have lights and signs in Germany. We have so many sites on the road. And we do have a driver's license test. That is something as well. So if I want to use a vehicle, I have to take a driver's license. I have to learn all the rules and I have to identify all the signs. I have to know what they mean. And then I can participate in traffic. And I even sometimes put my kits in my car. So I make them participate in traffic because I feel safe enough in traffic to navigate around and everything is fine. Now, if you ever imagine we wouldn't have any signs or any rules in traffic, like no traffic lights, no clear rules of who drives first and you wouldn't have to take a test. Anyone who has access could just enter a car and just go for it. Then what happened, it would feel very insecure for us to participate in traffic because you would have to feel that every at every corner, someone would smash into you or just ignore the lights if you would have any in the first place. So what would happen then if you would participate in traffic in such a world without without any rules inside? What would you say? I think chaos. Teos? Yes. Would you participate in traffic? No. No. Like every day. You would be cautious. From not a really good car driver. So I'm my woman drives. So I think, I think, let me know, Cologne, I drive there for sometimes. Yeah, for me, it's double hard. I think. Yeah. Okay. You know, very much. And that is with traffic rules. So most people, answer me this question like this. They would say, yes, I would participate in traffic. I would drive in my car, but not all the time. Only if it's really necessary. Like I need something re-urgently or something like that. Would I take my kids? I don't think so. And especially I would drive very slow because I always have to take into calculation that someone would smash into me or would drive way too fast or something. So the whole process would be slowed down extremely. And it would be a lot of effort to do that. It would be insecure. You're not allowed what to do when and stuff like that. And it's it's the same with governance rules in power platform. If everyone is allowed to do anything all the time and you don't have any regulations, you don't have any rules or people don't know the rules, then what happens at least for the administrators in every environment all of the time they are always apps and flows popping up, being deleted. Things would break all the time. The IT administrator would have to act like a firefighter. They wait for an emergency to happen, then they rush to it and try to fix things. That is frustrating for everyone. For users now, if they don't know what's allowed and what not, where am I allowed to build? What can I use and what not? They get cautious because sometimes you get emails from IT, you broke a rule or you got a DLP violation error or something like that. I didn't intend to do that, but I didn't know any better. So the whole process is sometimes slow. If you have a clear set of rules and regulations and it's that is the second amount in part is communicated to everyone that is using the power platform and they understand it. Like here is your environment where you can build. Just go wild, do whatever you want. We've secured it. You can try whatever you want to try. Then the makers and the citizens develop us. They have the confidence to build free, to experiment, to break things even because that is, I think, a necessary part in learning and developing. It's like if you do something and breaks, usually, at some point you learn a lesson and you say, "Why does it break? Why is it me? Is it the restriction? Something like this." I often see from, as a result, from my work in companies where I work and I and we worked on a governance approach, that the development cycle actually gets faster and accelerates. The incidents, the incident rate gets lower and usually that is a win-win for both sides. That is often the problem when people and makers hear the word governance and security, they think, "No, no, I'm not allowed to do stuff anymore." The point is often most administrators and platform owners, I know, they would be happy if they knew what people want to do and why. So if someone says, "I have a great idea for the Instagram connector and our business data." The answer to that would say, "No, that doesn't sound too good." But if they put their ideas into a plan, why would you want to do that? What would you want to do? Even maybe you would give them a demo example where they can try out a bit of words, let's see how the result is, then maybe it's a valuable idea. I don't know that yet, but from the administrator or owner perspective, I can't really evaluate the idea yet enough if I just hear this kind of scenario. So what really the important point of my work is to explain what is governance and what is it for because in the end, governance is a part of the solution that everyone that works in companies still has a job tomorrow because really big upsies, they cost jobs and money and that is something that we don't want, especially not with a cool and fun tool like Power Platform. Yeah, I think just this last thought maybe. What Power Platform does is it democratizes the accessibility to software solutions. So even without extensive computer or programming knowledge, you can build your own solutions because you are the expert of your own for your own work. You know what really sucks at work and what could be done better and now you have the possibility to solve it yourself and that is really, really important and brings lots of value and I don't want to restrict that too much. That would be a shame basically. So explaining what governance is is usually it lowers the fear I would say. Yeah, fear. Yeah, roots fear. I think one of some of your articles, you are a little bit reframing the governance to clarity, confidence and boundaries. That's a little bit unpagnate. First let's a little bit talk about clarity. What does clarity looks like in a major Power Platform organization? Is it the key ownership, key environment, key data classification, connect, rules, escalation path, what is clarity? Yeah, so first of all, I think and that is not only for Power Platform, but for every aspect in life, clarity brings freedom. If I know if I have clarity in the if I know what I can do, what is expected of me, what is supposed to happen, I know rules. Then I have the freedom to choose how I act. That is an if I don't have clarity and if some things are uncertain and the outcome and the expected outcome is uncertain, then I maybe hesitate to take action. If I know what will happen, if everything is clear to me, then I can choose my actions and do so. And clarity in Power Platform is exactly that. On the one hand side for the maker, on the one other hand side for the administrators, let's say, it's up with the maker side. That means if a maker knows, default environment is forbidden. No, no, don't build here. If the maker knows, I can have my personal developer environment and I can build there within all those restrictions, restrictions that we have. For example, we won't use the Twitter or X connector or the Instagram connector. Fine, then I have the freedom of building my flows and apps, but without those connectors. I can do that. If I still want to use those connectors, for example, and I can ask for it, maybe like a demo, extra secure demo environment or something, then clarity would mean that I know whom to ask. Where do I go to if I have a question? Where do I go to if something breaks? That is like a first level support process that I have. And if I have such a process, it's really necessary that my makers and all users, basically, all of them, they know, they know how to do it. How does it work? Where do I go to? Where do I have to click? What language should I use? Something like that. And this clarity is important for users of the kind, but for powerful platforms, especially I think. On the other hand, clarity for administrators looks different. As an administrator, I want to know what's going on in my tenant because I'm responsible for security. And I can't be responsible if, let's say, 100-maker would don't have any clarity and they just click around aimlessly. Then I can't provide the security that is my job. So I need the clarity to see what's going on. I might and my tenant. What environments are there? Who has access to this environments? Are there any other administrators or people who have extended rights? Is there a citizen developer, an account that has developed 50 new custom connectors? And I would like to know about this. What do they connect to all those connectors do? I don't want to restrict the development of connectors, but I just want to know if they are working within the compliance rules of our organization. I just need to know that. And before I can evaluate some of this, I need to know what's there and what's in it. So clarity, I need a good inventory. So for administrators, the term clarity is more technical term. I need a good fucking inventory. Otherwise, I have no idea what's going on. I can't go on it. So clarity, it's absolutely a must have. Okay, the clarity brings the freedom and then we have confidence. What brings confidence? Well, as I said, clarity brings confidence. That is kind of the point. It follows each other. If I know what I'm allowed to do and what I'm not allowed to do, then I have the confidence to build within those restrictions that I have. If I don't know, if I'm doing something forbidden right now, then I don't act confident. Then I always act like I'm trying to stay under the radar. I'm trying to be hidden to not get caught or something. That is not confident. That is sneaking around. And that is what we, for decades, now called shadow IT. Well, shadow IT is a term not necessarily fitting in this discussion or in the, in this confidence discussion, but shadow IT is an important term. And in power platform has the opportunity to build this inventory, to get this clarity for all participants. And that means that confidence coding is possible for everyone, for administrators and for users, for citizens, developers, for all the people that we have. And this confidence, I think clarity brings confidence and confidence on the other brings clarity. Because if I build confidence in there and I can transport my ideas and I can communicate my ideas and show the output, like, proud and confident, then I have a foundation to talk about what I've done. Is it a good solution? Is it valuable? Is it nice to have? But if I don't have this, then I can't talk about this. And then we drift into this shadow IT world where I try to be not get caught by administrators because I build something that is not really allowed. Yeah. And then we have the last key, yeah, the last, the last word boundaries. What, what, what's that there all the point? Why I put this word in there is boundaries is something else from restrictions. If something is forbidden, I know it is, I'm just not allowed to do that. A boundary, at least in my, in my hat, in my understanding is something that is not necessary for bitten, but we don't do that because of a specific reason. So we have reasoning for it. And that is kind of often another misconception that we have in IT between IT and business often. IT says no, but not why. And the business is, well, that sucks. A boundary for me is usually communicated within a reasonable, but we do have a reason for that. And when I say, I don't want to allow the, the Instagram connector in our tenant, then I should be better in the position to say why because it's linked to matter and matter collects data like crazy. And we don't want our business data like to get to matter because we don't know what they do actually with it. And that is not our goal. So that is a little bit, maybe it's a little bit sneaky of me to, to swap the turn, being forbidden, being restricted, but being, there's a boundary, but you can always discuss about a boundary. And if you ever fix through, there's not much room for discussion. So maybe it's a little bit, but it's, as you said in the beginning, it's reframing. It's reframing what governance means and why we do that, why we do have boundaries and what reason behind it. Once again, and these boundaries and those security rules and governance rules that we have, they have to be flexible in a way because that means a rule that was yesterday absolutely fine, doesn't mean it's absolutely fine tomorrow. Sometimes the compliance rules that we have to follow, they change as well. Example would be the EU AI Act that just came to terms. This now is a major change in how we act in the European Union. And now we have to adapt our rules and compliance for that. Another example would be seat belts. Seat belts were not mandatory in class for quite sometimes in the 60s and so now they are. So we have to adapt our compliance and our rules. So I think boundaries are a little bit more flexible and they can be adapted. So they, that's, that's the important point. So reframing governance and explaining why we do what we do and also be in the position to take some critical questions. If all of you say that doesn't make sense and I explain you why, then I should be confident enough and I can be confident if I have the clarity, if I know what's going on. To take this discussion, why do we do that? Or why don't we allow that? And that is something that is necessary, I think, in the whole security, IT security and the governance area. Partly, from kind of shows it because so many people have access all of sudden and yeah, makes it kind of a more open issue. Yeah, I work for, I don't know, three years for one of the biggest automotive companies. I don't know the law to say their name, but my time in Voss book. I was, all right, got it. Was therefore a Microsoft fabric project and that's what was really interesting because they, they used the power platform every, really every day. I have flows that give the data back, transform it. There was bots that were working with it. They have custom connections to it. SharePoint was connected and also a variety of, of data was a database is also connected to this. And then I think I know the answer, but from your perspective, why is inventory the foundation of governance? As I said earlier, if you don't know what you have, you don't know what to have to do to government to make it secure. It's as easy as that. And for that, I have plenty of examples because usually it's when I work with companies and organizations, ask them, do you have a governance and say, yes, we do. Second question is, and have you written it down? Like recommended, no, almost no, something like that. So when we start the governance project, usually we start with inventory, okay, what do we have? We open a hood and let's see what really out there. And quite often we find something like, I don't know, 600 apps in default environment. And that is not best practice. That is in fact, security risk. And quite often we find just a few, a couple of accounts like those very power users who are very confident, they're funnily, and they develop a few custom connectors. And then you realize, okay, they could do a lot of stupe those custom connectors. I just want to see what's happening to my data. Where is it right now? It's a little bit like switching on the light in a dark room. You have to see what there is in order to decide how to proceed. And sometimes you have funny moments for that. A good friend of mine once also works in governance. He had a project in the customer and they found a custom connector to, let's say, to an internet site, to let's say an adult film site. I don't want to say the name, but I think everyone knows what's meant by that. And they got a custom connector. You just would receive data. This would receive playlists and stuff. And I don't know what the background was, if they have like any business with that, or if they just weren't very curious, can we do this? Because of course, there is an API and you can connect with that. And that was really interesting. And if you want to make a rule in your company, don't connect our tenant to adult film sites. Then you have to know that people do that in the first place. And yeah, that why inventory is the absolutely first and important thing for governance. Yeah, that's a really funny thing to go. There was one guy who gets a little bit famous. And yeah, he, oh, what's the English word? He has also a connector. I have never used this word in English. I have to look at betting stuff. And they sell it. What they have used in these movies. So they have a marketing, funny marketing idea. Yeah, I think it's really interesting for what you can use these custom connectors. But the other thing with the darkroom, you say, and bring the lighter, okay, not all dark rooms like it in Kalon, but I say it's the visibility topic. And how can we start bringing visibility to the inventory? What's your tips? Yeah, that's a good question. For the last couple of years, I always say use the center of excellence data kit. Well, surprise. So now it's replicated now, which means we can use it still, but there won't be any updates. And yeah, now we have to think about how we do that. Now, the good thing is that we have a new inventory in the power platform admin center natively. So it's there and it's not bad. I usually don't say very good things about the PPEC power platform admin center. But this I really like, it's not bad. It's by the pure inventory. It shows you what is there. Compared to the center of excellence data kit, I use that inventory to combine it with my rules. So I have those tables with all my flows, environments, apps. And usually I build my flows on top of those tables to make like rules and alerts and stuff like that. It's not possible within the admin center now. But this is this inventory in the admin center. It's kind of fast because it doesn't use a flow together with data from all the tenant, but it it queries the API directly. And that means whereas with the center of excellence data kit, all the synch flows to run through you have the all time time we know from like 24 hours or something like that to get new set of data. If something changed, talk a while until you realize, hey, there's something new. Now this goes within 10, 15 minutes. The query against the API is very fast. It's very cool. It's not complete yet. A few things are missing like we don't have custom connectors in that and we don't have names of owners or planters I think for all this stuff. So it's still under development, but it's it's a very good start. And especially for smaller and medium sized companies, this is absolutely sufficient. So no need to build something more complex than that or to buy a governance product from from one of the vendors we have out there. So this is cool. If we don't want that or we want something that is a little bit more customized than the then the ppex thing, it's not that hard to build your own inventory with the power platform API. We have like three or four APIs that we need to build up something like a center of excellence clone or something like that. And with all the AI we have like a chat with the AI and whatever we have, it's kind of of doable to build your inventory even if you are not that deep into coding. So that kind of works good. And for all medium sized and bigger companies, that's what I do and I suggest all the time basically is build your own inventory based on your customized needs because if you don't have premium licenses and you have no one in your company that can build model-driven apps or custom connectors, then you don't need to monitor for a model-driven apps or custom connectors. Easy as that. So kind of depends on your on your needs. But two things, the ppex API inventory is very good now, not completely yet. And the other hand is build it yourself. And that is something that is necessary now because center of excellence data kit is well not that, but not a life too. And especially with all the agents that we have now, Copilot Studio agents, there is another toolkit, the Copilot Studio Kit. No, no, if you know about it, but that is quite nice for an inventory as well, especially an only for Copilot Studio. But then once again, for a good inventory, how to do that, how to start is use the kit set out there, maybe even use the use of center of excellence data kit, but have a backup plan because in the next 12 or 18 months, you won't use it anymore and build up your own thing, what you need. So once again, start with an, let's say, a project like inventory, switch on the lights in your environments and see what you have, see what you have to take care of, and then build up an inventory and governance, according to those needs that you have. Yeah, well, we have our inventory. I think the next step we have to talk about is life cycle management. Can you tell us a little bit how, how do you handle this? Yes, I can do that. Before that, I would say the first thing that I do after the inventory is more or less to get like a map. I split the tenant into different environments and see what do we need. I start, we do have the default environment and we don't get rid of that. Usually I restrict that very, very strongly, but then I have an environment for the IT department, administrators. So everything that is just for the IT department, plug-ins, professional code of that is thought in the IT department and I have a citizen developer or maker shared environment where they can all use their, put in their, their flows and apps and share what they have. Everyone get their personal developer environment where they can code all that for special and business critical projects. We have like environment with environments with deaf tests and production. And that is when it comes to life cycle management. First of all, I, yeah, I structure everything that I have into different parts because I, if I have to clean up and take care of what I, I don't want to clean up everything but just the parts that really need ALM. And ALM is an interesting topic for me right now because right now I'm in front of a new challenge for me personally and in my business life. I've usually used the, not get up the pipelines, part of the pipelines because they are quite good now and I do like the features that come with it and it's super cool for small and medium-sized companies to use those if you have premium licenses that is a condition to use them. To have like with chain of environments, deaf test, project, we develop, we test it and then you take it into production. And this, they work nice. They do have this GitHub integration now so you can have a single source of truth in the cloud and the internet so you don't rely on your own project and service and stuff. That is really cool. But if you start developing solutions that are more complex and bigger and you have custom plugins for example if you have multiple solutions that have to merge into one in the end. If you have multiple developers who work on different parts of an application or a solution and that you have to merge those results then it can get nasty. And for that, for usually what is used often is DevOps and I've never worked with DevOps in my life. Now I have a whole team they're working with DevOps and they ask me all kind of questions how to make it secure, how to make it more better and stuff like that. And so I have to speed up my learning right now, especially with DevOps, GitHub and ALM in general. And what I'm, what right now is on my table is how to make a database ALM experience that is kind of similar to GitHub. So that means that if I work at a, on one solution and one part or let's say one page or one side of an app and another developer is working on another side, now we are both finished with our work and we put it back into the main solution. How do we make sure that there are no errors coming up? Some one or something has to check if everything will work in the future in production and that is something that I have a good idea for that. It's a little bit tricky right now, but basically it's with the, with the connection to GitHub that is something, well, it's kind of, I realize I'm getting, I'm getting too deep right now. I'm getting too deep a little bit. It's very complex and not complex and not yet, you know, yet finished. But ALM, all platform pipelines are very good. Sometimes I've just smaller teams and it's not that time critical, you could even do the our platform SDK works really well if you want to work with VS Code. So there are many different options and opportunities how to work with ALM and that is a funny thing or an interesting thing actually because at the beginning we were talking about our platform as a local platform and even people without IT background could work with it. Now ALM and talking about DevOps, pipelines, GitHub, all of a sudden is on the other side of the end right? This is because citizen developer, I know they pretty much are a little bit overwhelmed when it comes to to GitHub and tokens and how this all works and how a pipeline works. And that is, and that shows how our professional, the platform is by now. But ALM is something that is very important for the business critical solutions for the important solutions but not for the everyday life solutions. Like the personal project, the things that you do, like the reminder flow that reminds me when I don't know, my boss sent me an email or something like that. That doesn't need ALM. I think we have the most of the big works now for, I think, yeah, all the buzzwords. Yeah, one is missing, one is missing, data loss prevention, I think. Yeah, we did this also. Yeah, I think a lot of companies handle data loss prevention, like one click on solution. So can you tell a little bit? So we have the big, the big ones about, you see data loss prevention? I don't know how many big words we have, but big five or something. I don't know. But yes, data loss prevention. Oh, that is the topic. And you're right. I think when you said many companies treat them as like one click solution, click, I switched it on. Now I'm fine. Many people or many companies do that, which is in case of powerful, I've owned kind of not enough. I don't want to say it's wrong, but it's not enough. But the name is misleading also. So data loss prevention, that sounds like a prevention or a policy that, yeah, it kind of prevents data loss. It's not wrong, but it's not what people expect because the word data loss prevention or DLP, the approvision is used in different contexts, the contexts for different things. We have Azure DLP's and N365 DLP's and Teams DLP's, and they all work in kind of the same way, but in the power platform, they work differently. Yeah. So data loss prevention policies are policies that define which connectors can be used in one solution. So that means can I build an app with a SharePoint connector and an Instagram connector? Usually yes, if I have my DLP set up to explicitly forbid that, then no. So it's more or less like like a regulation which connectors can be used together and which can be not. Additionally, which connectors are blocked overall. And those DLP's are for every environment. So I can build one for every environment. So I can, I have a little bit of granular, lary-tip to define which environment can be used for which connectors. This is nice. There are so many issues with it. I don't want to open that topic now. But I want to say when you use premium licenses and manage environments, you have the advanced connector policies. And these are really cool because they offer you a lot more freedom and granularity to really define what is allowed and what not. Once again, I don't want to get in too deep, but DLP's are one of the main pillars of governance and security absolutely. I think, now let's see. We have tenant security. There's tenant settings. Then you have the environments. You have DLP's, then roles and responsibilities. And I think that are the big four. So the basics. That is not everything governance and security is about. But those are the big four pillars that you should have at least a vague idea of what they are, what this does and how to use it. There are the tools that you need to have in your toolbox or in your pocket to make it a little bit more. And maybe the first one is the hidden one. That is the, let's say the knowledge that the default is always bad. And I don't mean default environment, but I mean default settings. That is something where I'm sometimes a little bit, I argue with Microsoft sometimes, because they deliver their products and their platforms. And especially with a local platform, like power platform, they want every user or almost every user to have access to use their product. Right. If you, if you develop a product and you give it to users, you want them to use it. The problem is if everyone has access, then all the people who don't know what they do or they don't want to do it, they also have access and that is the security gap. So access for everyone is just a no-no insecurity. And quite often people don't see this right now. I work a lot with dynamics customers and what dynamics customers do is they focus on dynamics. And they don't even know that if they have a dynamics license, there is a whole power platform underneath that is just as open as it is. No DLP, no environments, everyone has access and every administrator who is is like, oh my god, now, never. And that is something. So if you use Microsoft products, then even if it's a platform as a source and not a software as a source and there is a difference from the very beginning, you know that you have some effort to do in terms of setting up and securing it according to your business needs. It's not like, switch it on, everything is fine, like DLP, as you just mentioned, that is maybe the fifth key knowledge card for governance and security in the Microsoft universe. Microsoft gives you lots of great opportunities and cool tools, but you have to check them out and understand them and set them up according to your needs. Otherwise, it can get risky. Okay. I have in every session a rapid fire round, so I give a short question and you give a short answer. So, um, once sentence describe good power platform governance for you. Clarity and intention. Okay. The biggest mistake make us do on the power platform. Assuming that it's easy. The biggest mistake that IT does on the power platform? Ignoring it because it's just low code. What's the best coach in Cologne? Best coach. A coach. Oh, tricky. Zion. Okay. One governance topic that gets too far to a little attention. The whole government stop it gets to his attention. What did you think? Yeah, either one of the small words, shadow IT or blocked innovation. Ah. Um, shadow IT. Okay. If such a analysis comes to you and say, Michael, you get all the resources and money you need to make a feature on the power platform governance. What feature will you develop? I would decline that offer. And maybe, maybe I can give a reason for that because what I'm good at is working on specific solutions with people and finding out their needs and their setup. I help them become the experts for their own work environment and for their own work. And I'm not someone who develops features. Others can do that. Maybe I will take the resource and give that to someone else, but help them figure out what they want to do and why. That's, that's a point. Yeah. So, yeah. Um, then, uh, who shall I invite next and what questions should I ask? I have a good, good, good names, uh, a few good names, but I don't know who's been in your show recently. So I would have to check that. But, um, from the top of my head, I'm thinking about my brilliant UK colleagues, like Simon Owen or, um, Craig White, for example. Um, and someone who is a real power platform hero that I hardly see someone in the community is native to Adolf. Okay. And he is just great. He's from the UK as well. Um, never met him before, I think, but he is great. And I'm just living on his, um, on his blog post recently because he is really good at ALM. The whole, the whole guitar pipeline thingy. That is something where I learn a lot right now. Yeah. So, yeah. I can thank you so much for being here. I think this was an excellent talk. Yeah. We have a lot of, yeah, we have the big five. Uh, done. Yeah. And I think, yeah, this was, was really great. I think that we have a lot, a lot, we have good takeaways. And we have, uh, also, I think the reframing for the governance, it's really, really cool. And yeah, so thank you for, for staying here. The hour with me and on the podcast. Yeah. Thanks for having me. It was fun. Let's do it again sometime. Yeah. Yeah. I'm open. I'm open. So then we can do the security part. Oh, yeah. That's another story. [BLANK_AUDIO]