How to Govern Power Platform Environments, Portals and Data Policies

Retrospective: this article looks back at events from August 2021, written in 2026 with the benefit of hindsight.

Power Platform lets anyone build apps, flows and now AI agents. Without governance, data can leak through connectors, public portals or overshared apps. Here is a practical governance setup.

Step 1: Structure environments

• Keep the default environment for personal productivity only, with restrictive data policies.
• Create separate development, test and production environments for business-critical solutions.
• Use Managed Environments for greater control (sharing limits, usage insights, solution checker enforcement).

Step 2: Create data policies (DLP)

In the Power Platform admin center, create data policies that classify connectors as Business, Non-business or Blocked. Apps and flows can't combine Business and Non-business connectors.

• Put Microsoft 365, SharePoint, Dataverse and approved line-of-business connectors in Business.
• Put consumer services (personal email, social media, file sharing) in Non-business or Blocked.
• Block HTTP connectors in the default environment unless needed.

Step 3: Secure Power Pages sites

• Confirm table permissions are enforced for every site.
• Review site visibility and authentication settings.
• Use the Power Pages security scan and checker before go-live.

Step 4: Control sharing

Limit sharing of canvas apps with "Everyone" and large groups in Managed Environments.

Step 5: Govern Copilot Studio agents

Apply data policies to agents, control which knowledge sources and connectors they can use, and restrict who can publish agents.

Step 6: Monitor

Use the CoE (Center of Excellence) Starter Kit or Managed Environments insights to inventory apps, flows and agents and identify owners.

Verify

Review inventory quarterly; remove orphaned apps and flows.