A Power Platform Center of Excellence That Governs Makers Without Stopping Them
An insurer found a claims triage app used daily by 4,100 handlers that IT had never heard of. We built the governance on the admin centre and Managed Environments, inventoried 1,240 apps and 3,800 flows, and added a promotion path instead of a ban.
About the Client
The Challenge
It started when a claims operations manager mentioned that her team's triage queue ran on 'the app'. IT asked which app. An underwriter had built a canvas app three years earlier, 4,100 handlers used it daily to prioritise claims, it read and wrote a SharePoint list holding policyholder detail, and its only owner had moved business unit with no idea he still administered a production system.
That app was a symptom of the default environment. Every employee in an organisation using Power Platform has access to it, and every one of them is a potential maker inside it. The documented consequences read like an audit of this tenant: uncontrolled creation, owner-less resources when makers leave, business-critical apps with no lifecycle, over-sharing. One source nobody anticipates: a custom SharePoint list form automatically creates a canvas app there, so much of the inventory came from people who never thought they built an app.
For an insurer the exposure is not theoretical. We found flows pushing claim detail into personal storage accounts, flows emailing policyholder spreadsheets to external addresses, and apps reading lists shared with Everyone Except External Users because that setting made the app work. None of it malicious — all of it people solving real problems with no guidance.
IT's first instinct was to switch off maker access across the tenant, and the executive sponsor was right to refuse. Those apps were doing real work no funded project would replace, and their authors understood the processes better than anyone. The problem was never that business users built things — it was that nobody could see what existed, nothing had a lifecycle, and a good app had no route to becoming dependable.
Our Approach
Governance that only says no gets routed around. We built visibility, then guardrails, then a promotion path — each depends on the last.
Inventory From the Admin Centre (Weeks 1-4)
The CoE Starter Kit is no longer maintained: its capabilities have moved into the Power Platform admin centre, issues are no longer reviewed, and only security vulnerabilities are accepted through MSRC. Existing deployments keep working; nothing new is coming. We used the admin centre, where four capabilities map onto what a CoE has always done: Inventory for resources, Usage for adoption, Monitor for health, Actions for enforcement. Its CLI and APIs cover the automation the kit's flows provided.
Environment Strategy (Weeks 4-8)
Restricted sharing inside the default environment and routed new makers into personal developer environments. Then applied the published tiering: up to ten users with non-confidential data and no business impact can stay in the default environment; confidential data or a few dozen users belongs in a shared one; more than thirty users, regulated data or real business impact needs a dedicated one, as does anything with an ALM requirement. SharePoint form apps went to their own environment with Set-AdminPowerAppSharepointFormEnvironment, which stopped the largest single source of sprawl at the tap.
Managed Environments and Licensing (Weeks 6-10)
Governance capability is delivered through Managed Environments, and the answer people still quote — a governance kit is free but everyone touching it needs premium — is out of date. Managed Environments are an entitlement of premium licences: standalone Power Apps, Power Automate, Copilot Studio, Power Pages and Dynamics 365. They are not included in the Developer Plan when users run those assets, which is the trap for a tenant that seeded its makers on developer plans. We turned on sharing limits, usage insights, solution checker enforcement and default environment routing.
Data Loss Prevention (Weeks 9-13)
DLP sorts connectors into business, non-business and blocked groups, and an app or flow may not combine groups. Every connector starts in non-business on a new policy, which is the right default: promote and block deliberately, after an impact assessment. Two constraints then shaped it. Some connectors cannot be blocked at all — Dataverse, Approvals, Notifications, Copilot Studio and the Microsoft standard connectors including SharePoint, Teams and Outlook — so classification, not prohibition, is the control there. And endpoint filtering, which restricts HTTP and SQL to approved hosts, is still preview and only enforces endpoints static at design time. We ran the classification with the data protection officer and warned makers first.
Orphaned Assets and the Promotion Path (Weeks 12-18)
Orphaned assets were the largest clean-up item at 390 objects, and the failure mode is worth stating accurately: a flow whose owner has left is not disabled or deleted. It keeps running and fails later, when the connections tied to that account go invalid — a silent, delayed failure, which is why nobody reports it. We found them from the empty Owners column and with Get-AdminFlowOwnerRole, reassigned with Set-AdminFlowOwnerRole, used the Actions page to surface apps unused for sixty days, and quarantined rather than deleted where access had to be preserved. Then the part that changes behaviour: a published promotion path. An app crosses into IT support when it passes a user count, touches regulated data, or becomes a dependency for a process with a recovery requirement.
Solution Architecture
Governance platform: Power Platform admin centre — Inventory, Usage, Monitor, Actions — with CLI and API automation in place of the starter kit
Environment topology: A restricted default environment, personal developer environments from maker routing, a dedicated SharePoint form environment, shared business-unit environments, and dev, test and production for supported solutions
Managed Environments: Sharing limits, usage insights, solution checker enforcement, data policies and default environment routing, on the premium entitlement
DLP model: Business, non-business and blocked groups agreed with the data protection officer, and preview-stage endpoint filtering with its design-time-only limitation documented
Operating model: A platform owner, business-unit champions, a monthly licensing review, and maker data classified under tenant data governance policy
Results
Client identity withheld under confidentiality. Figures are representative of engagements of this scope.
Technologies Used
Key Takeaways
If your organization is facing a similar challenge, here's what we learned:
Do not build a 2026 operating model on the CoE Starter Kit. It is no longer maintained and only security reports are accepted. Its functions now live in the admin centre as Inventory, Usage, Monitor and Actions.
Managed Environments come with the premium licence. The old answer — a governance kit is free but needs premium connectors — is out of date. Governance is an entitlement of premium licences, and is not included in the Developer Plan when users run their assets.
Custom SharePoint forms quietly create canvas apps. They land in the default environment whether or not anyone meant to build an app. Point them at a dedicated environment and much of the sprawl stops appearing.
Orphaned flows do not stop, they start failing later. A departing owner disables and deletes nothing. The connections tied to that account go invalid and the flow fails afterwards, silently. Find them from the empty Owners column first.
A promotion path turns shadow IT into pipeline. The apps business users build are free requirements-gathering. Publish the criteria that move one into IT support and the maker community becomes a pipeline. Our Power Apps consulting team runs that intake.
Related Case Studies
Do You Know What Your Makers Have Built?
Most tenants have hundreds of apps and flows nobody has inventoried, in an environment with no policy applied. We give you the inventory, the guardrails and a promotion path.