Secure, Scalable, Governed: Power Platform Best Practices with Craig White [MVP]

In this episode of the m365.fm podcast, Mirko Peters sits down with Craig White, double Microsoft MVP, AI Platform Lead, governance specialist, and co-host of the Power Platform Panic Room podcast. With more than twenty years of experience across SQL Server, SharePoint, Microsoft 365, Power Platform, and Copilot Studio, Craig shares deep insights into governance, citizen development, AI readiness, scalable Power Platform adoption, and the future of low-code inside the Microsoft ecosystem. This conversation goes far beyond generic Power Platform discussions. Instead, it focuses on the real-world operational challenges organizations face when trying to scale Power Platform safely while still empowering makers and enabling innovation.

WHY GOVERNANCE SHOULD ENABLE — NOT BLOCK

One of the strongest themes throughout the episode is Craig’s philosophy around governance. He explains why governance should never be about stopping people from building solutions. Instead, governance should create guardrails that allow organizations to innovate safely at scale. Craig shares how many companies still approach Power Platform with fear, often worrying that citizen developers will create chaos, expose data, or bypass IT processes. But according to Craig, the real danger is not enabling users at all. When organizations completely block innovation, shadow IT simply moves outside the organization. The discussion explores why governance frameworks should feel almost invisible for makers while still protecting the organization through:

• Environment strategies
• Data Loss Prevention policies
• Security boundaries
• API governance
• Controlled connectors
• Lifecycle managementCraig explains that the goal is not to remove freedom but to create safe paths for innovation.

THE REALITY OF POWER PLATFORM GOVERNANCE

Craig highlights how unique Power Platform governance really is compared to traditional Microsoft technologies. Unlike older systems where access was centrally controlled, Power Platform arrived enabled by default. Many organizations never realized employees already had access to build apps, flows, automations, and AI solutions for years. This creates a completely different governance challenge. Craig explains how organizations often discover thousands of apps, flows, and automations already running inside their tenant before governance processes even exist. The episode explores why governance maturity starts with visibility and understanding what already exists inside the environment. The discussion also dives into:

• Default environment risks
• Tenant settings
• Environment provisioning
• DLP policies
• Governance automation
• Connector restrictions
• Enterprise administrationAI, COPILOT & THE NEXT EVOLUTION OF POWER PLATFORM

The conversation naturally shifts toward AI and Copilot Studio, where Craig shares his excitement about the future of AI inside Power Platform. He explains how organizations are rapidly moving from simple automation into:

• AI agents
• Copilot Studio
• Skills-based automation
• MCP integrations
• AI-assisted governance
• Intelligent business workflowsCraig also discusses how AI is fundamentally changing administration and governance itself. Instead of manually configuring environments, policies, and settings, future administrators may increasingly rely on AI-powered interfaces and intelligent automation. The episode explores how AI is exposing long-standing governance issues that organizations ignored for years, especially around:

• Oversharing
• Permissions
• Data security
• Compliance
• Zero trust architecture
• Information governanceCraig emphasizes that AI does not create governance problems — it reveals the ones organizations already had.

WHY CITIZEN DEVELOPMENT IS NO LONGER OPTIONAL

Another major focus of the discussion is citizen development. Craig strongly believes modern organizations can no longer rely entirely on centralized IT teams to solve every business problem. Employees closest to the business processes often understand automation opportunities better than anyone else. The episode explores why successful organizations:

• Enable internal makers
• Build communities
• Create champions programs
• Support experimentation
• Encourage knowledge sharing
• Provide safe development environmentsCraig explains that when employees understand the tools and feel empowered to solve problems themselves, innovation accelerates dramatically.

THE IMPORTANCE OF ENVIRONMENT STRATEGY

One of the most practical parts of the episode focuses on environment strategy. Craig explains why mature organizations separate:

• Development environments
• Test environments
• Production environments
• Personal experimentation spacesHe shares how many organizations skip this step early on and later struggle with governance, deployment processes, licensing, and operational support. The discussion also ...