Power Platform makes it possible for people across an organization to solve problems, automate processes, and build business applications faster than traditional development approaches. But that accessibility also creates difficult enterprise questions: Who can build what? Where does company data go? How should environments be structured? And how can organizations prevent shadow IT without becoming the department that says no to every new idea?
In this episode of M365 FM, Mirko Peters talks with Michael Roth [MVP] about building Power Platform governance that protects the organization without killing innovation. They explore security, Data Loss Prevention policies, environment architecture, inventory, application lifecycle management, citizen development, and the responsibilities organizations take on when Power Platform becomes part of their business infrastructure.
ㅤ
FROM ORGANIZATIONAL CONSULTING TO POWER PLATFORM GOVERNANCE
Michael shares his unconventional journey from organizational development and change management into the Microsoft ecosystem. After working on information-classification projects and experiencing the limitations of managing enterprise information through enormous Excel files, he became increasingly interested in the technical side of digital transformation.
His work with Microsoft 365, SharePoint, Power Automate, and Power Apps eventually brought together two complementary perspectives: technical platform knowledge and an understanding of people, communication, organizational change, and adoption. Today, Michael uses this combination to help organizations establish sustainable governance, administration, and security models for Power Platform.
ㅤ
POWER PLATFORM IS NOT A HOBBY TOOL
Power Platform is frequently presented as a collection of approachable low-code services, including Power Apps, Power Automate, Power Pages, Dataverse, and Copilot Studio. Michael explains why organizations must also understand the platform underneath those individual services.
For users, these products can feel like simple software-as-a-service applications. For administrators and platform owners, however, Power Platform is an enterprise application platform embedded across the Microsoft cloud. It requires configuration, security, maintenance, ownership, monitoring, and operational processes.
The fact that someone can create an application quickly does not mean that the resulting solution is automatically secure, maintainable, scalable, or ready for production.
ㅤ
WHEN SMALL AUTOMATIONS BECOME BUSINESS-CRITICAL
A Power Automate flow or Power Apps application may begin as a harmless personal productivity project. Once colleagues start depending on it, sharing it, modifying it, or using it to access enterprise systems, its risk profile changes dramatically.
Michael discusses examples in which apparently simple solutions expanded far beyond their original purpose. A personal integration with an enterprise database can eventually give dozens of users automated read or write access. Even a harmless seasonal application can create governance problems when hundreds of employees are added and its user list is never maintained.
Business criticality is therefore not determined only by what an application does. It is also influenced by the number of users, the sensitivity of the connected data, external dependencies, business reliance, ownership, and the consequences of failure.
ㅤ
CITIZEN DEVELOPMENT NEEDS CLARITY AND INTENTION
Citizen development does not have to mean uncontrolled development. A strong governance model gives makers clear boundaries, suitable environments, understandable responsibilities, and a reliable path for turning useful ideas into supported business solutions.
Governance should help employees understand where they can experiment, which connectors they may use, when a solution requires professional support, and what happens when an application becomes important to the organization.
The objective is not to block makers. It is to help them build with greater confidence while ensuring that security, compliance, ownership, supportability, and business continuity are considered from the beginning.
ㅤ
START GOVERNANCE WITH AN INVENTORY
Organizations cannot govern assets they cannot see. Michael explains why an inventory should be one of the first steps in any Power Platform governance initiative.
A tenant may already contain hundreds of applications and flows, numerous environments, unmanaged custom connectors, abandoned experiments, and solutions without active owners. Opening the Power Platform Admin Center and inspecting the real tenant estate is like switching on the light in a dark room: only after seeing what exists can administrators make sensible decisions.
The conversation examines the native inventory capabilities available in the Power Platform Admin Center, the changing role of the Center of Excellence Starter Kit, the Copilot Studio Kit, and the option of creating a customized inventory ...