Four pillars, one foundation
The pillars look like separate products but share the same plumbing — environments, Dataverse, connectors and DLP:
| Pillar | Does | Shares |
|---|---|---|
| Power Apps | Canvas & model-driven apps (UI) | Environments, Dataverse, connectors |
| Power Automate | Cloud & desktop flows (automation/RPA) | Same connectors, same DLP |
| Power Pages | External-facing websites over Dataverse | Dataverse, its own auth for anonymous/external users |
| Copilot Studio | Custom copilots/agents & topics | Connectors, Dataverse, and now generative actions |
Adjacent but related: Power BI (analytics) is often grouped in but has its own governance surface; AI Builder adds prebuilt/custom models consumed by apps and flows.
Why the shared foundation matters for governance
Because all four run inside environments and call the same connectors, one DLP policy and one environment strategy govern the whole platform. A connector blocked for flows is blocked for apps, pages and copilots too. This is the leverage point: you do not govern four products, you govern the foundation.
Failure modes
- Copilot Studio widens the surface. A copilot can call connectors and, with generative actions, reach data and take actions on a user's behalf — the same exfil and over-privilege questions as flows, in a conversational wrapper that feels 'safe'.
- Power Pages exposes Dataverse to the internet. Table permissions and web roles govern anonymous/authenticated external access; a misconfigured page can publish internal rows publicly (see external sharing).
- The 'it's just a chatbot / just a form' framing hides that each pillar is another maker-built asset reaching the same corporate data — inventory must cover all of them, not just canvas apps.
What to watch (proofs)
- Full asset inventory across pillars per environment:
Get-AdminPowerApp(apps),Get-AdminFlow(flows) plus admin center listings for Power Pages sites and Copilot Studio bots — the complete maker surface, not just apps. - Shared DLP coverage:
Get-DlpPolicy— one policy bounds connectors for every pillar; an uncovered environment leaves all four open. - New pillar activation: a Power Pages site going live, or a Copilot Studio bot published — Power Platform admin center signals a new internet/agent surface.
- Environment strategy as the control plane:
Get-AdminPowerAppEnvironment— every pillar lives in an environment, so the env inventory is the map.