Power Platform governance means setting an environment strategy, data loss prevention (DLP) policies, app ownership rules and a small Centre of Excellence (CoE) before the app count grows. Put in place early, it is a few weeks of work. Retrofitted across an estate of unowned apps, it becomes a project that starts with working out what exists and who owns it.
The first Power App in an organisation is a good news story. Someone close to a painful process builds a fix in a fortnight, the process improves, and IT gets to say yes for once. Nothing about that story needs governance, which is why governance rarely starts there.
The fortieth app is different. By then there are apps nobody remembers building, flows moving data to places the security team has never reviewed, licences accumulating in ways nobody models, and at least one business-critical process running on an app owned by someone who resigned in March. None of it comes from bad intent. Forty reasonable decisions were made with no framework around them. We get called in at both ends of this curve.
Environment strategy comes first. The default, where everything lands in one environment, is how sprawl starts. A working structure separates personal productivity, team development and production, with promotion between them as a deliberate step. Once an app matters to more than its maker, it moves into managed application lifecycle management, with source control and deployment pipelines in place of edits in production.
Data loss prevention policies come second, and early, because they are much harder to tighten than to loosen. Deciding which connectors can be used together, and which are blocked outright, is a one-hour conversation before the app count grows. After it grows, every tightening breaks something someone depends on.
Ownership rules come third. Every app has a named owner and a named backup, recorded somewhere that survives the maker leaving. An app whose recorded owner has left the organisation is already a risk.
A Centre of Excellence sounds like a committee. At mid-size it is two or three people with a clear remit: keep the environment strategy current, review what citizen developers are building, run the graduation path for apps that start to matter, and coach makers so quality rises without IT becoming a bottleneck.
The coaching matters most. Governance exists to make it safe for makers to keep building. Well-governed estates end up with more citizen development than ungoverned ones, because IT can see what is being built and has no reason to fear it.
The other surprise at the fortieth app is the bill. Premium connectors and Dataverse capacity turn apps that cost nothing extra at pilot into apps with real per-user costs at scale. Licensing modelling belongs in governance, because the cheapest fix is usually an architectural change made before the app ships. Our post on modelling Power Platform licensing covers how to price it.
Our Power Platform practice sets up the environment strategy, DLP policies and Centre of Excellence for estates anywhere between the first app and the fortieth, and then steps back.
It is a plan for which environments exist and what goes in each. A typical structure separates personal productivity, team development and production, with deliberate promotion between them.
They control which connectors can be used together and which are blocked outright, so apps and flows cannot move data to services the organisation has not approved.
At mid-size, two or three people with a clear remit is enough. Microsoft also publishes a free CoE Starter Kit that gives the team an inventory of apps, flows and makers.
Within the first handful of apps. DLP policies and ownership rules are cheap to set before apps depend on the connectors and owners in question.
Marcel Rizzolo is Director of Coder Trove.