Episode Details

Power Platform makes it possible for people across an organization to solve problems, automate processes, and build business applications faster than traditional development approaches. But that accessibility also creates difficult enterprise questions: Who can build what? Where does company data go? How should environments be structured? And how can organizations prevent shadow IT without becoming the department that says no to every new idea?
In this episode of M365 FM, Mirko Peters talks with Michael Roth [MVP] about building Power Platform governance that protects the organization without killing innovation. They explore security, Data Loss Prevention policies, environment architecture, inventory, application lifecycle management, citizen development, and the responsibilities organizations take on when Power Platform becomes part of their business infrastructure.
ㅤ
FROM ORGANIZATIONAL CONSULTING TO POWER PLATFORM GOVERNANCE
Michael shares his unconventional journey from organizational development and change management into the Microsoft ecosystem. After working on information-classification projects and experiencing the limitations of managing enterprise information through enormous Excel files, he became increasingly interested in the technical side of digital transformation.
His work with Microsoft 365, SharePoint, Power Automate, and Power Apps eventually brought together two complementary perspectives: technical platform knowledge and an understanding of people, communication, organizational change, and adoption. Today, Michael uses this combination to help organizations establish sustainable governance, administration, and security models for Power Platform.
ㅤ
POWER PLATFORM IS NOT A HOBBY TOOL
Power Platform is frequently presented as a collection of approachable low-code services, including Power Apps, Power Automate, Power Pages, Dataverse, and Copilot Studio. Michael explains why organizations must also understand the platform underneath those individual services.
For users, these products can feel like simple software-as-a-service applications. For administrators and platform owners, however, Power Platform is an enterprise application platform embedded across the Microsoft cloud. It requires configuration, security, maintenance, ownership, monitoring, and operational processes.
The fact that someone can create an application quickly does not mean that the resulting solution is automatically secure, maintainable, scalable, or ready for production.
ㅤ
WHEN SMALL AUTOMATIONS BECOME BUSINESS-CRITICAL
A Power Automate flow or Power Apps application may begin as a harmless personal productivity project. Once colleagues start depending on it, sharing it, modifying it, or using it to access enterprise systems, its risk profile changes dramatically.
Michael discusses examples in which apparently simple solutions expanded far beyond their original purpose. A personal integration with an enterprise database can eventually give dozens of users automated read or write access. Even a harmless seasonal application can create governance problems when hundreds of employees are added and its user list is never maintained.
Business criticality is therefore not determined only by what an application does. It is also influenced by the number of users, the sensitivity of the connected data, external dependencies, business reliance, ownership, and the consequences of failure.
ㅤ
CITIZEN DEVELOPMENT NEEDS CLARITY AND INTENTION
Citizen development does not have to mean uncontrolled development. A strong governance model gives makers clear boundaries, suitable environments, understandable responsibilities, and a reliable path for turning useful ideas into supported business solutions.
Governance should help employees understand where they can experiment, which connectors they may use, when a solution requires professio