How are we doing this?<\/p>\n\n\n\n
With proper governance mechanisms that keep them safe while letting their creativity flow\u2014and our employees are running with it, creating innovative and dynamic solutions that are streamlining our processes and enhancing our productivity.<\/p>\n\n\n\n
And that\u2019s exactly the point\u2014the Power Platform<\/a> democratizes development, allowing the citizen developer in all of us to come out and play. For us, this is an essential ingredient for fostering the kind of innovation that can and will continue to drive our company forward. <\/p>\n\n\n\n Locking in on the right approach to governance is pivotal.<\/p>\n\n\n\n \u201cGovernance provides essential guardrails, by ensuring that we have visibility into what is being built and enforcing policies to maintain security and compliance with the Power Platform,” says Aisha Hasan, a senior product manager in Microsoft Digital. “Governance allows us to balance the freedom to innovate with the need to protect our tenant from risks.\u201d<\/p>\n\n\n\n Governance is a key strategic enabler to our approach.<\/p>\n\n\n\n With the wide variety of users at Microsoft developing solutions in the Power Platform, it’s vital they understand how to develop within governance parameters and deploy their solutions effectively. This ensures that while innovation flourishes, it does so within a framework that maintains security and compliance.<\/p>\n\n\n\n Power Platform environments are the foundation for providing structure and organization with our Power Platform tenant.<\/p>\n\n\n\n “Our governance approach is rooted in a holistic environment strategy,” Hasan says. “We’re applying policies at the environment (or container) level to assess and manage risk uniformly and at scale.”<\/p>\n\n\n\n We use an intentional environment structure to enable good governance practices, and we apply our policies and rules to that structure to ensure that every single environment is governed to our standards. This approach avoids broadly shared environments that are difficult to govern effectively.<\/p>\n\n\n\n \u201cWe\u2019re routing developers out of the default environment. It’s about getting away from that \u2018big bucket\u2019 approach. We want every flow, bot, and app to be in an environment that is purpose-built and intentionally configured.”<\/p>\nAisha Hasan, senior product manager, Microsoft Digital<\/cite><\/blockquote>\n\n\n\n Every environment in our tenant has a specific purpose and we ensure we have the proper information about each environment to maintain proper governance. Every environment in our tenant is tied to an owner who is accountable for everything within that environment. This ownership model ensures clear responsibility and accountability.<\/p>\n\n\n\n To enable this specific approach to environments, we make clear distinctions.<\/p>\n\n\n\n First, the default environment<\/em>\u2014a built-in environment that comes with every single Power Platform tenant\u2014is not the default.<\/p>\n\n\n\n \u201cWe\u2019re routing developers out of the default environment,\u201d Hasan says. \u201cIt\u2019s about getting away from that \u2018big bucket\u2019 approach. We want every flow, bot, and app to be in an environment that is purpose-built and intentionally configured.\u201d<\/p>\n\n\n\n To streamline the process and ensure proper governance, we\u2019ve turned on automated routing. This means that if anyone tries to use the default environment, they\u2019re automatically routed to a specific environment type instead, according to their use case and our environment groupings. This helps in managing the lifecycles of our environments and ensures that every Power Platform solution is in the right place with the right governance.<\/p>\n\n\n\n We group environments based on their usage and apply specific rules to each group. There are groups for personal productivity, team collaboration, and enterprise development; each with its own set of rules and compliance requirements and tied to a specific environment type in the Power Platform.<\/p>\n\n\n\n Personal productivity<\/strong> environments are designed for individual use, where users can create and experiment with applications and automations without the need for extensive governance. These environments are typically developer environments, which are highly restricted in terms of sharing capabilities. Users can build apps, flows, and other solutions for their personal productivity, but they can’t share these solutions with others. This ensures that any experimentation or personal projects remain isolated and don’t impact the broader organization.<\/p>\n\n\n\n Team collaboration<\/strong> environments are intended for team-based projects and workflows. These environments are usually built within Dataverse for Teams, which integrates with Microsoft Teams. Dataverse for Teams environments are tied to a Microsoft 365 group, which helps manage governance and lifecycle through the group’s settings. These environments are perfect for team productivity solutions that are used within a specific team but aren’t meant to be shared companywide. While Dataverse for Teams environments have some quirks and limitations, they provide a balance between flexibility and governance, making them suitable for moderate governance and security controls.<\/p>\n\n\n\n Enterprise development<\/strong> environments are used for large-scale, enterprise-level projects that require stringent governance and compliance. These environments are typically sandbox or production environments and are subject to a rigorous request and approval process. Users must provide detailed information about their project, including data sensitivity, regulatory requirements, and business justification. These environments are governed by stricter usage policies, custom ownership policies, and regular security reviews. The goal is to ensure that any enterprise-level solutions are secure, compliant, and properly managed.<\/p>\n\n\n\n Microsoft runs on trust, and our success depends on earning and maintaining it. Our Secure Future Initiative<\/a> ensures that security is first in everything that we do, and that extends to how we govern the Power Platform.<\/p>\n\n\n\n Our governance strategy revolves around applying controls at the environment level. We categorize environments, using the three main groups already identified. There are specific security controls and approaches in place in each group:<\/p>\n\n\n\n Group<\/strong><\/p>\n<\/div>\n\n\n\n Purpose<\/strong><\/strong><\/p>\n<\/div>\n\n\n\n Security controls<\/strong><\/strong><\/p>\n<\/div>\n<\/div>\n\n\n\n Personal productivity<\/p>\n<\/div>\n\n\n\n Individual use<\/p>\n<\/div>\n\n\n\n Team Collaboration<\/p>\n<\/div>\n\n\n\n Team-based projects<\/p>\n<\/div>\n\n\n\n Enterprise development<\/p>\n<\/div>\n\n\n\n Widespread use<\/p>\n<\/div>\n\n\n\n \u201cOur security controls and policies are really about enablement as much as possible,\u201d says Jake Visser, a principal architect manager at Microsoft. \u201cIf you create a developer environment, we’ll assign an appropriate DLP policy for you to work with your solution and send you a Teams message indicating what policy we’ve assigned and what you can do there. It’s about making sure that people can build and innovate while staying within the guardrails of our governance policies.\u201d<\/p>\n\n\n\n DLP policies are crucial for preventing data breaches and ensuring that data remains within the organization’s boundaries. We apply DLP policies at various levels to control which connectors and actions are allowed within different environments to prevent the unintentional sharing of sensitive information and ensure that data stays within the organization. These policies control which actions and endpoints connectors are allowed to interact with. For instance, if a connector is used to write data, the policy ensures that the data is protected and only interacts with approved endpoints.<\/p>\n\n\n\n For enterprise development environments, teams can request custom DLP policies if they need to use specific connectors or actions that aren\u2019t covered by the standard policy. This involves providing a threat model and other relevant information to justify the need for the custom policy.<\/p>\n\n\n\n Within each environment group, we apply a set of practices that apply our governance strategy. These practices maintain a balanced approach that incorporates both reactive and proactive measures.<\/p>\n\n\n\n We use a proactive governance<\/em> approach to anticipate issues before they arise. Gaining visibility into what\u2019s being built within our environment is a critical first step. Our inventory data collection processes collect data on apps, connectors, flows, and shared resources. By having a clear picture of our digital landscape, we can enforce policies that ensure security and compliance from the outset. We collect and integrate this data with the following methods:<\/p>\n\n\n\n Reactive governance<\/em>, on the other hand, deals with issues that arise after the fact. Even with stringent policies in place, there’s always a need to monitor and manage ongoing activities. The general application of our reactive measures is similar to the proactive measures\u2014they even share some categories. However, our reactive governance measures are built around quickly identifying\u2014as quickly as possible\u2014events in the tenant that might compromise the integrity of our governance.<\/p>\n\n\n\n By combining proactive measures to prevent issues and reactive measures to address them, we can provide environments that allow our developers to innovate freely while safeguarding our digital assets. It\u2019s a win for everyone involved and it\u2019s truly enabling innovation at Microsoft.<\/p>\n\n\n\n \u201cWith Sentinel, we can perform real-time monitoring of all activities within the Power Platform. We must have visibility into what\u2019s being built and how the platform is being used.”<\/p>\nJake Visser, principal architect manager, Microsoft<\/cite><\/blockquote>\n\n\n\n Microsoft Sentinel<\/a> plays a crucial role in our governance strategy. It’s an essential tool that helps us monitor, detect, and respond to various activities within the platform, ensuring that our governance policies are enforced effectively.<\/p>\n\n\n\n Sentinel integrates with Microsoft Purview<\/a> audit feeds to monitor all activities within the Power Platform. This integration allows us to capture events such as bot creation, environment creation, flow runs, and edits. Essentially, any action performed by a user or admin within the Power Platform generates an event that is captured by Sentinel.<\/p>\n\n\n\n \u201cWith Sentinel, we can perform real-time monitoring of all activities within the Power Platform,\u201d Visser says. \u201cWe must have visibility into what\u2019s being built and how the platform is being used. For instance, if a user creates a new environment or modifies an existing one, Sentinel captures this event and allows us to cross-reference it with our governance policies.\u201d<\/p>\n\n\n\n Sentinel enables us to automate governance actions based on the events it captures. For example, when a user creates a personal developer environment, we use the Sentinel events and an Azure Logic App to automatically assign a DLP policy to that environment and send a Teams message to the user, informing them of the assigned policy and what they can do within that environment.<\/p>\n\n\n\n Sentinel’s integration with the Power Platform’s inventory service allows us to maintain an up-to-date inventory of all environments, apps, and flows within the platform. This inventory is crucial for proactive governance, as it provides us with the necessary metadata to enforce policies and ensure compliance. If an environment’s configuration is altered against policy, Sentinel can trigger an alert and send an email to the environment owners, asking them to rectify the issue.<\/p>\n\n\n\n Microsoft Copilot Studio<\/a> is part of the Power Platform. If you’re building agents using Copilot Studio, the same governance principles that apply to Power Apps and other capabilities apply to building and governing sgents. See our article “AI-powered agents in action: How we\u2019re embracing this new \u2018agentic\u2019 moment at Microsoft”<\/a> for a deeper dive into governance considerations for agents.<\/p>\n<\/div>\n\n\n\n Appropriate governance and environment ownership has opened up a whole new wave of collaboration between departments and teams at Microsoft. The controls and assurances provided by an effective governance strategy have enabled our teams to work side-by-side in the Power Platform with confidence.<\/p>\n\n\n\n \u201cInternally, our employees and our team, especially in Microsoft Digital, are building solutions to look at different aspects of how we can continue to improve productivity,\u201d Hasan says. \u201cThe Power Platform offers so much freedom to create quickly and with the introduction of AI and Copilot, we can add more intelligence and use all Power Platform tools to create more robust solutions across the organization.\u201d<\/p>\n\n\n\n The finance team at Microsoft has been using the Power Platform to streamline their processes. By collaborating with us in Microsoft Digital, they’ve developed a series of Power Apps to automate financial reporting and budget tracking. This collaboration allowed the finance team to reduce manual data entry and improve accuracy in their reports. <\/p>\n\n\n\n We provided the necessary technical support to ensure the apps were secure and compliant with company policies. For instance, they created an app that pulls data from multiple sources, consolidates it, and generates real-time financial reports. This has significantly reduced the time spent on manual data consolidation and reporting.<\/p>\n\n\n\n The marketing and legal teams have also found common ground on the Power Platform. They worked together to create a Power Automate flow that simplifies the approval process for marketing materials. The flow ensures that all marketing content is reviewed and approved by the legal team before publication. <\/p>\n\n\n\n This collaboration has significantly reduced the time it takes to get marketing materials approved, allowing the marketing team to be more agile and responsive. For example, the flow includes automated notifications and reminders, ensuring that the legal team reviews and approves content promptly.<\/p>\n\n\n\n The HR and support teams have used the Power Platform to enhance employee onboarding and support processes. By building a Power App, they created a centralized onboarding portal where new hires can access all the necessary resources and complete required tasks.<\/p>\n\n\n\n The support team integrated this app with their existing systems to provide seamless support for new employees. This collaboration has improved the onboarding experience and ensured that new hires have all the support they need from day one. The app includes features like task checklists, document uploads, and direct links to support resources.<\/p>\n\n\n\n One of the most exciting examples of collaboration is the use of Copilot Studio across various departments<\/a>. Teams from finance, marketing, CELA, HR, and IT have all contributed to developing AI-infused solutions using Copilot Studio. <\/p>\n\n\n\n For instance, the marketing team created an AI-powered agent to handle customer inquiries, while the HR team developed an AI assistant to help employees with common HR-related questions. Using Copilot Studio, we’ve been able to increase discoverability and productivity by using Copilot as our “UI for AI”, bringing the power of these specialized agents to answer frequently asked questions, provide product information, and even assist with troubleshooting.<\/p>\n\n\n\n Governance on the Power Platform at Microsoft is poised to become even more robust and comprehensive. As the platform continues to evolve, so will our strategies for ensuring its secure and effective use.<\/p>\n\n\n\n We\u2019re working to develop and implement more granular governance controls. Currently, our governance strategy revolves around applying rules at the environment level, using environment groups and rules to manage security and compliance. However, the future holds the promise of even more detailed control mechanisms and as customer zero, we’re working with the Power Platform PG to ensure that our learnings related to governance are reflected in the product. This includes the ability to nest environment groups, allowing for more specific governance based on criteria such as geography, data sensitivity, and regulatory requirements.<\/p>\n\n\n\n The Power Platform has proven to be a transformative tool for fostering collaboration and innovation across various departments at Microsoft. From streamlining the approval process for marketing materials to enhancing employee onboarding and creating AI-driven solutions, the platform has enabled teams to work more efficiently and effectively. Our focus on robust governance helps ensure that the Power Platform remains a secure and innovative environment for all users\u2014and Microsoft customers.<\/p>\n\n\n\n Key takeaways<\/p>\n<\/div>\n\n\n\n Do you want to implement effective and enabling governance in your Power Platform? Apply these best practices:<\/p>\n\n\n\n Try it out<\/p>\n<\/div>\n\n\n\n Discover security and governance considerations in Power Platform.<\/a><\/p>\n<\/div>\n\n\n\n Related links<\/p>\n<\/div>\n\n\n\n At Microsoft, our employees are using the Microsoft Power Platform to bring their ideas and visions to life. It\u2019s our low-code development suite that anyone\u2014not just developers\u2014can us to create apps, automate workflows, and analyze data. In Microsoft Digital, the company\u2019s IT organization, we\u2019ve implemented a Power Platform governance strategy and vision that is empowering […]<\/p>\n","protected":false},"author":92,"featured_media":18388,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_hide_featured_on_single":false,"_show_featured_caption_on_single":true,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[882,1],"tags":[199,920,883,928,237,927],"coauthors":[550],"class_list":["post-18386","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it-strategy","category-microsoft-digital","tag-ai","tag-ai-and-copilot","tag-citizen-development","tag-developer-and-automation","tag-governance","tag-modern-work","m-blog-post"],"yoast_head":"\nOur strategic approach to governance on the Power Platform<\/h2>\n\n\n\n
Starting at the top with environments<\/h3>\n\n\n\n
![\"A](\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2025\/11\/Aisha-Hasan.png\")
<\/figure>\n\n\n\n\n
Shifting to environment routing<\/h2>\n\n\n\n
![\"Placing](\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2025\/02\/10645_graphic.png\")
Using groups, roles, and policies<\/h3>\n\n\n\n
\n
\n
\n
Harnessing proactive and reactive governance<\/h3>\n\n\n\n
\n
\n
\n
Integrating with Microsoft Sentinel detection and response<\/h3>\n\n\n\n
Collaborating and innovating in the framework of governance<\/h2>\n\n\n\n
Streamlining financial reporting with Power Apps<\/h3>\n\n\n\n
Simplifying legal reviews with Power Automate<\/h3>\n\n\n\n
Enhancing onboarding with integration and collaboration<\/h3>\n\n\n\n
Creating cross-functional innovation with Copilot Studio<\/h3>\n\n\n\n
Looking forward<\/h2>\n\n\n\n
![\"\"](\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2025\/07\/Key-takeaways-badge.png\"){kind=icon}
<\/figure>\n\n\n\n\n
![\"\"](\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2025\/07\/Try-it-out-badge.png\"){kind=icon}
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2025\/07\/Related-links-badge.png\"){kind=icon}
<\/figure>\n\n\n\n\n