When your organization works with Microsoft Power Platform, a strong strategy for technical governance is essential. In this post, we will go over some of the key aspects to ensure that the platform is managed in a secure and efficient way – from environment management and DLP rules to governance and monitoring. We will also take a look at the process of creating a Power App and how to ensure that the right users have the right access at the right time.
Management of different environments in Power Platform
Having a clear strategy for managing different environments is crucial to ensuring stability, security, and efficiency. By organizing and using development, testing, and production environments correctly, you can minimize the risk of disruptions and errors.
Here is a quick overview of what you should consider:
- Development environment: This is where your makers (app creators) can experiment and build solutions without affecting the business. It provides a safe space to test ideas.
- Testing environment: After development, solutions are moved here to verify that they function as intended, including security testing.
- Production environment: The most critical environment, where only approved apps and flows go live. Administrators should maintain strict control here to ensure stability and security.
Through the Power Platform Admin Center, administrators can easily create and manage these environments. By setting up policies regarding who has access to which environment and adhering to these guidelines, you can effectively reduce the risk of errors.
Why is this important? Well-structured environment management results in fewer production errors and increased security, which in turn saves both time and resources.
Data loss prevention (DLP)-rules
What are DLP rules and why are they necessary?
DLP (Data Loss Prevention) rules are a critical tool for protecting sensitive data from being shared or reaching insecure platforms. By defining DLP rules, you ensure that data is not transferred between apps or services in an insecure manner.
- Creating and applying DLP rules: Through the Power Platform Admin Center, you can create and implement DLP rules to block the transfer of data to unauthorized services.
- Categorization of connectors: Connectors in Power Platform are divided into categories such as Business and Non-Business. This classification helps ensure that sensitive data is only used in business-critical apps and flows.
How do you ensure DLP rules are followed? Power Platform offers automated monitoring that continuously checks for compliance with DLP rules..
Governance och styrning:
Who is allowed to do what, and how is Power Platform governed?
Governance is at the core of securely managing Power Platform, and it is essential to have clear roles and responsibilities to ensure that the right people have the correct access.
- Role-based access: Users are granted access to specific functions within Power Platform based on their role. Makers have access to create apps and flows, while Admins handle monitoring and ensure that everything adheres to the organization’s guidelines.
- Monitoring and compliance: Through Power Platform Admin Center, administrators can monitor all activity. Automated reports provide insights into which apps and flows are being used and whether any of them violate DLP rules or other policies.
How is compliance monitored and enforced? Administrators can schedule regular audits and reports to ensure that all processes and users comply with established rules. It is also possible to set up alerts that are automatically triggered if a flow violates a security policy.
The roles
When working with Microsoft Power Platform, it is important to understand the different roles and their respective responsibilities to ensure security, efficiency, and compliance.
Here is an overview of the different roles in Power Platform and what each role entails:
1. Makers
Makers are users who create apps, flows, and other solutions within Power Platform. They are responsible for developing the tools needed to automate workflows and improve business operations.
Makers can:
- Use Power Apps Studio, Power Automate, and Power BI to create and edit apps and flows.
- Use approved data sources and connectors to build solutions.
- Build and customize flows, apps, and dashboards within development environments.
Makers cannot:
- Manage the platform’s overall settings or policies (this responsibility lies with admins).
- Publish apps or flows directly in production environments without approval from administrators.
2. Admins
Admins are responsible for managing and overseeing the entire Power Platform environment. They ensure that the platform operates smoothly, that security rules are followed, and that users work according to the organization’s guidelines.
Admins can:
- Have full access to the Power Platform Admin Center and can monitor and manage all aspects of Power Platform.
- Create and apply Data Loss Prevention (DLP) rules to protect sensitive data.
- Manage environments (create and administer development, test, and production environments) and determine which users have access to different environments.
- Conduct audits and ensure that all apps and flows adhere to the organization’s security standards and policies.
Admins cannot:
- Typically participate in the creative development of apps and flows, unless they are also granted Maker access.
3. Environment Admins
Environment Admins are responsible for specific environments within Power Platform, such as development or production environments. They manage apps, flows, and user roles within the assigned environment.
Environment Admins can:
- Create and manage environments.
- Determine which users have access to a specific environment and configure security settings within those environments.
- Control the flows and apps running within their specific environment.
Environment Admins cannot:
- Manage environments or policies outside their specific area of responsibility (e.g., if they are responsible for the development environment, they have no control over the production environment)
4. System Admins
System Admins have the highest level of access within Power Platform. They manage the entire platform’s system and ensure that the platform functions as a whole.
System Admins can:
- Have full control over Power Platform, including creating and managing DLP rules and security settings
- Deploy apps and flows across all environments.
- Monitor and manage users, apps, and flows across the entire organization.
- Manage integrations between Power Platform and other systems (e.g., Microsoft 365 and external services).
System Admins cannot:
- They are usually not restricted in terms of access or responsibility over the platform, but they are often accountable for adhering to security standards and regulations.
5. Environment Makers
Environment Makers are users who are allowed to create apps, flows, and solutions in specific environments. They can create and experiment, but have limited control over production environments.
Environment Makers can:
- Create apps and flows in assigned development and testing environments.
- Test and develop solutions without affecting production.
- Collaborate with administrators to ensure that their apps and flows receive approval before being published.
Environment Makers cannot:
- Publish apps or flows in production environments without administrator approval.
- Access certain data connections or services if they are restricted by DLP rules and security settings.
6. Power BI Admins
Power BI Admins have specific control over the Power BI service, which is used to create data visualizations and reports.
Power BI Admins can:
- Manage Power BI user permissions.
- Monitor the usage of Power BI reports and dashboards.
- Ensure that data visualizations comply with the company’s security policies and terms of use.
Power BI Admins cannot
- Participate in the management of apps and flows within Power Apps or Power Automate, unless they have been granted these permissions separately.
Process for creating a new Power App
When a business wants to develop a new Power App, it is important to have a well-defined process to ensure that everything complies with the existing technical and security guidelines.
- Needs analysis and approval: The first step is to conduct a needs analysis where the business determines what the app should achieve and what data it needs to handle. After the analysis, the app is approved by an admin or another responsible person.
- Development and testing: Once approved, the app is created in the development environment. When it’s ready, it is tested in the testing environment to ensure that it works properly and meets security requirements.
- Review and publishing: Before the app goes live, it is reviewed by admins to ensure it complies with all DLP rules and policies.
Watch this video to see how it’s done:
Reach out to us if you need support!
