Power Platform Governance and SharePoint Online

[aaroh_bits]

Hi all, 

These Background, challenges, and recommendations for our rockstar community 

1. Background 
   1. The client has 5k end users/business users.
   2. Power Platform is relatively new to this client and used for less than 1 year
   3. It is global client offices are in major offices.
   4. The key data source is SharePoint Online. 
      
      
2. Challenges 
   1. Many business users have built many apps and flows in a couple of countries very rapidly. 
   2. Global IT / Infra has no visibility of how apps and flows are used.
   3. A many users' default environments, there is no control over the number of apps and flows. 
3. Recommendations  
   1. The client established a Power Platform CoE. 
   2. The Infra team wants to streamline users who can create apps and flows for better governance.
       
   3. Question: If the Global IT team creates a new environment called  Contoso Apps and Flows, considering the IT team purchased 5 Power App Premium licenses for environment capacity, all users 5K users are added to this new environment, and specific users are assigned to makers for governance,  will this solution work? 
      
      
   4. Question:   Does the client need any additional licenses for this  Contoso Apps and Flows environment? 
      The Power Platform licensing guide is pretty confusing and does not address this query of mine. 
      
      Thanks in advance. 
      
      @WarrenBelz   @ANB  @Amik  @Pstork1 

[WarrenBelz · Accepted solution]

@aaroh_bits ,

For both questions, normal user licences are at a Tenant level (and can actually use them to work in other Tenants if shared), not per environment, so all current users with licences can simply work in the new environment with what they have.

I found your other comments interesting and I am sure you will have opinions divergent to mine (and I have posted this to encourage the sharing of those opinions), but this is what the Power Platform low-code facility is about - empowering users (the business) to do their job without needing the assistance of support (whose role is to do just that) services. 

It is not coincidental that generally in the past I have never seen any push for governance control or streamlining restricting of the myriad of at times scary things stored and actioned by huge unsecure Excel files in shared OneDrive folders, yet when the same functions are replaced with Power Apps, it becomes a "system" needing some sort over overwatch by support services rather than being owned by the business operations who rely on the its efficiency to do the job (it is a business tool).

This might seem a bit of a rant, but I am passionate about this and your post asked all the right questions to generate a healthy debate.

[aaroh_bits]

@WarrenBelz ..thanks a ton for your insightful replies. 

for comments, I am with you completely on that debate. 😁
Microsoft opens doors to end users to create new artifacts such as

1. a new Microsoft Teams team and later you see 1100 Teams pop up at Teams Admin Center with the most innovative names created by business users.  I have seen team names such as Snowwhite, Ironman 😀  in a large leading manufacturing company.  
2. the same logic goes to the Default environment 
   However, working in banking, finance, and healthcare (the serious business organizations), a lot of IT folks did have some restrictions and compliance in these industries. 
   
     
   
   

[Pstork1 · Accepted solution]

A couple specific points that you'll need to take into consideration.

Yes, adding everyone to a new environment will let you restrict who are makers in that environment.  But

• There is no way to stop everyone from using the existing default environment as a maker. The best workaround is to create data policies that block most of the connectors in the default environment.
• Managing that system using the COE starter kit is the right way to do it. But they will probably need more than 5 premium licenses for that. In addition to the admins all the people who will be makers will need premium licenses to interact with the apps in the COE starter kit.  Regular users won't need premium licenses.
• Regular users who aren't makers in the environment will only be able to start apps from a URL link sent to them when the app is shared. They won't be able to see the environment or the app in the Power Apps client. This is probably the biggest issue with their proposed solution.

[aaroh_bits]

Thanks for your amazingly good insights @Pstork1 

• data policies that block most of the connectors in the default environment. - This is indeed a golden nugget that helps my client. 
  
  
•  Regular users won't need premium licenses. The client's Finance dept will love this. 
  
  
• Regular users who aren't makers in the environment will only be able to start apps from a URL link sent to them when the app is shared. - Indeed. The business users are owners of apps/flows and with no data policy whatsoever. This exercise will more time for IT and business to have a middle ground so that IT can support Power Platform in their client's Org.  

[Pstork1]

My point on the last comment was that if users aren't makers it becomes more difficult for them to use the apps that are shared with them since they don't show up in the Power Apps client or my apps list in Power Apps. When the app is shared the user will receive an email with a link. They will need to save that email to be able to access the app that is shared with them. This is not particularly intuitive or most users. It will tend to depress user adoption.