Power Platform Center of Excellence: Setup Guide

The Power Platform Center of Excellence (CoE) balances innovation with governance. Without it, citizen developers create ungoverned apps with hardcoded credentials, unmanaged data flows, and no backup strategy. With it, you get controlled self-service that empowers business users while protecting the enterprise.

Organizations without a CoE typically discover hundreds of ungoverned Power Apps and Power Automate flows within 12-18 months of Power Platform adoption. These apps often contain sensitive data, bypass security controls, and lack documentation or succession planning. The CoE provides visibility, guardrails, and a support structure that enables growth without chaos.

CoE Pillars

A well-functioning CoE rests on four pillars, each addressing a distinct organizational need:

Pillar	Focus	Outcome	Key Activities
Governance	Policies, DLP, environment control	Risk reduction, compliance	DLP policy creation, connector management, environment hygiene
Nurture	Training, community, champions program	Adoption growth, skill development	Training paths, hackathons, maker community forums
Admin	Monitoring, inventory, compliance	Operational control, cost management	Resource inventory, orphaned app cleanup, license management
Automation	Self-service, approval flows, ALM	Speed + control, consistency	Environment provisioning, solution deployment pipelines

Common CoE Anti-Patterns

Anti-Pattern	Consequence	Prevention
Governance without enablement	Makers bypass controls, shadow IT increases	Pair every restriction with an approved alternative
No executive sponsor	CoE treated as optional, ignored by business units	Secure VP-level sponsor with budget authority
Overly restrictive DLP	Business users abandon Power Platform entirely	Start permissive, tighten based on actual risks
No maker community	Isolated makers repeat mistakes	Weekly office hours, Teams channel, monthly showcase
Manual governance	Doesn’t scale past 50 apps	Automate with CoE Starter Kit from day one

Environment Strategy

Environment design is the foundation of Power Platform governance. Poor environment strategy leads to data leakage, permission conflicts, and compliance violations.

Power Platform Environments
├── Default (restricted — DLP blocks everything except SharePoint + Office 365)
│   └── Why: All users land here. Lock it down to prevent ungoverned apps.
├── Developer Environments (per-developer sandboxes)
│   └── Why: Personal experimentation without affecting shared environments.
├── Shared Dev/Test (team collaboration)
│   └── Why: Build and test solutions collaboratively before promotion.
├── UAT (pre-production validation)
│   └── Why: Business stakeholder testing with production-like data.
├── Production (governed, change-managed)
│   └── Why: End-user facing. All changes go through ALM pipelines.
└── ALM / CoE (pipelines, CoE Starter Kit, solution deployment)
    └── Why: Separated admin tooling doesn't interfere with business environments.

Environment Best Practices

Lock the Default environment — Every user in your tenant has access to the Default environment. Apply the most restrictive DLP policy here to prevent ungoverned app creation.
One production environment per business unit — Prevents cross-department permission conflicts and simplifies data residency compliance.
Developer sandboxes auto-expire — Set developer environments to auto-delete after 30-60 days to prevent sprawl.
Never develop directly in production — Enforce this through environment maker role restrictions.

DLP (Data Loss Prevention) Policies

DLP policies control which connectors can be used together. They prevent data from flowing between business and non-business systems without explicit approval.

Policy: "Enterprise Default"
Applied to: All environments except developer sandboxes

Business Data Group (connectors can interact with each other):
  ✅ SharePoint, Outlook, Teams, OneDrive
  ✅ Dataverse, Dynamics 365
  ✅ Azure SQL, Azure Blob Storage
  ✅ Power BI
  ✅ Approvals

Non-Business Data Group:
  ⚠️ HTTP connector (webhook only — requires custom connector approval)
  ⚠️ SQL Server (on-premises — requires gateway approval)
  ⚠️ Twitter, other social connectors (limited business use)

Blocked:
  ❌ Anonymous web requests (prevents data exfiltration)
  ❌ Unapproved custom connectors (requires IT review)
  ❌ Desktop flows to unmanaged machines

DLP Pitfall: If you block the HTTP connector entirely, makers cannot call any external API — including legitimate business APIs. Instead, require custom connectors with explicit API endpoints approved by IT. Custom connectors give you visibility and control that raw HTTP does not.

CoE Starter Kit Setup

Microsoft’s free toolkit provides the foundation for Power Platform administration. It inventories every app, flow, and connector in your tenant and provides automated governance workflows.

Core Components

Component	Purpose	Setup Effort
Inventory	Discovery of all apps, flows, connectors, makers across all environments	2-4 hours
Admin module	Compliance tracking, environment management dashboards	4-8 hours
Governance	Archival policies, approval workflows for premium connectors	4-8 hours
Nurture	Maker community portal, training tracking, welcome flow	2-4 hours
Audit	Usage analytics, orphaned resource detection, license optimization	2-4 hours

Key Automations to Configure

Every CoE should have these automations running from day one:

1. New app created → Notify CoE team + assign compliance review within 5 business days
2. App uses premium connector → Require business justification + manager approval
3. App unused for 90 days → Send warning to maker → Archive after 120 days if no response
4. DLP violation detected → Block execution + notify admin + log violation
5. New maker joins → Welcome email with training resources + community links
6. App shared with > 50 users → Trigger ALM review (should be in managed environment)
7. Custom connector created → Require IT security review before approval
8. Flow error rate > 10% → Notify maker + CoE for investigation

Prerequisites

Before deploying the CoE Starter Kit, ensure:

Premium licensing — The CoE Starter Kit requires Power Apps per-user or per-app licenses (not included in Microsoft 365)
Dataverse environment — The kit stores its data in Dataverse
Service account — A dedicated service account (not a personal admin account) for running CoE flows
Admin consent — Global admin or Power Platform admin role for initial setup

Citizen Developer Program

The citizen developer program is the human side of the CoE. Without structured training and governance tiers, makers create apps that work but cannot be maintained, secured, or scaled.

Governance Tiers

Tier	Who	Can Build	Governance Level	License Needed
Explorer	Any employee who completes fundamentals training	Personal productivity apps (no custom connectors)	Default DLP, self-service, apps auto-expire	Microsoft 365 (included)
Maker	Completed advanced training + code review	Department apps shared with teams	Code review by CoE, monthly audit, managed environments	Power Apps per-app
Pro Developer	IT/Dev team members	Enterprise solutions, custom connectors, integrations	Full ALM pipeline, CI/CD, source control, managed environments	Power Apps per-user

Training Path

Each governance tier requires specific training milestones:

Explorer Path (4 hours):
  1. Power Platform Fundamentals (self-paced, 2 hours)
  2. DLP and Security Basics (self-paced, 1 hour)
  3. CoE Compliance Quiz (30 minutes, must score 80%+)

Maker Path (16 hours):
  4. Power Apps Canvas App Development (instructor-led, 8 hours)
  5. Power Automate Best Practices (self-paced, 4 hours)
  6. Security & Governance Workshop (instructor-led, 4 hours)
  7. Certification: PL-900 (Power Platform Fundamentals)

Pro Developer Path (40+ hours):
  8. Model-Driven App Development (instructor-led, 16 hours)
  9. Custom Connector Development (self-paced, 8 hours)
  10. ALM & DevOps for Power Platform (instructor-led, 8 hours)
  11. Certification: PL-400 (Power Platform Developer)

Champions Program

Identify 1-2 Power Platform champions per business unit. Champions:

Serve as first-line support for makers in their department
Escalate governance issues to the CoE team
Present at monthly maker community meetings
Receive advanced training and early access to new features
Report on adoption metrics for their business unit

Monitoring & Metrics

Metric	Target	Tool	Review Frequency
Total apps in production	Track growth trend	CoE Starter Kit Dashboard	Monthly
Active makers (monthly)	Growing month-over-month	CoE Analytics	Monthly
Orphaned resources	< 5% of total resources	Automated audit flow	Weekly
DLP violations	Trending down after initial setup	CoE Compliance Dashboard	Weekly
Maker satisfaction (NPS)	> 40	Quarterly survey	Quarterly
Time to deploy (dev→prod)	< 2 weeks for standard apps	ALM pipeline metrics	Monthly
Premium license utilization	> 70% assigned licenses actively used	License dashboard	Monthly
Support ticket volume	Stable or decreasing (self-service improving)	Help desk integration	Monthly

Budget Considerations

Item	Cost Range	Notes
Power Apps per-user license	$20/user/month	For Pro Developers and heavy Makers
Power Apps per-app license	$5/app/month	For Explorer-tier apps with limited users
Power Automate premium	$15/user/month	Required for premium connectors
CoE Starter Kit	Free	Microsoft-provided, but requires premium licenses to run
Training (external)	$500-2,000/person	For instructor-led sessions and certifications
CoE team headcount	1 FTE per 200 makers	Dedicated governance and support

Checklist

:::note[Source] This guide is derived from operational intelligence at Garnet Grid Consulting. For Power Platform consulting, visit garnetgrid.com. :::