The admin toolset
Power Platform administration is fully scriptable through several layers:
| Tool | Use |
|---|---|
| Microsoft.PowerApps.Administration.PowerShell | Tenant-wide admin — environments, apps, flows, DLP, roles |
| Microsoft.PowerApps.PowerShell | Maker-scoped operations |
BAP REST API (api.bap.microsoft.com) |
The underlying environment/tenant management API |
| Power Platform for Admins connector | The same operations from inside a flow (what the CoE kit uses) |
pac CLI (Power Platform CLI) |
ALM, solutions, admin from the command line/CI |
| Dataverse Web API | Data and security-role operations per environment |
Governance-as-code and app-only access
The durable pattern is to run governance non-interactively under a service
principal (an Azure AD / Entra app registration) rather than a named admin.
Register the app, grant it the Power Platform admin role via
New-PowerAppManagementApp (register the service principal as a Power Platform
management application), and it can then enumerate and configure the tenant
app-only — no human in the loop, credentials in a vault, actions attributable to
the app identity. That is what lets DLP baselines, environment provisioning and
inventory run on a schedule.
Failure modes
- The governance service principal is a top-tier target. It can read and reconfigure the whole platform; a leaked secret is tenant-wide exposure. It needs a vaulted, rotated credential and its own monitoring.
- Over-scoped app registrations. Granting more Graph/Dataverse permission than the automation needs widens blast radius.
- Personal-account automation. Scripts run under an admin's own account break at offboarding and are unattributable — the same orphan problem as flows.
- No credential rotation on the service principal secret/certificate — a standing, long-lived key.
What to watch (proofs)
- Registered management apps:
Get-PowerAppManagementApplists service principals granted platform-admin access — each is a high-privilege identity to account for. - What the automation identity can do: its Entra app-role/API-permission grants — scope creep is the finding.
- Credential hygiene: the service principal's secret/cert expiry and rotation (Entra app registration) — long-lived secrets are the risk.
- Attributable admin actions:
Search-UnifiedAuditLogfor the app identity — proof automation runs as the app, not a shared human account.