The core tension
The Power Platform's value is that anyone can build; its risk is that anyone does. Ban it and shadow IT moves to spreadsheets and unsanctioned SaaS; leave it open and business-critical processes end up running on an intern's personal flow. Governing citizen development is about channelling makers, not blocking them.
The sanctioned-vs-shadow line
An asset is sanctioned when it has a named owner, lives in a governed environment, has been reviewed against DLP, and someone is accountable for it. It is shadow IT when it is business-critical but none of that is true — most often a flow or app that grew quietly in the default environment.
| Enablement lever | Control lever |
|---|---|
| App-in-a-Day / maker training | Locked-down default environment |
| Developer environments per maker | Tenant-wide DLP baseline |
| A request-a-production-env path | Managed Environments + sharing limits |
| A supported connector catalogue | CoE compliance attestation |
The onboarding model
The durable pattern: give makers a sanctioned on-ramp — training, a personal developer environment to experiment in, and a lightweight request process to promote a proven app into a governed production environment with DLP and an owner. That way the easy path is the governed path.
Failure modes
- Default-environment sprawl — the number-one failure: everyone can build there, nothing is governed, and critical apps hide in the noise.
- Key-person risk — an app or flow owned by one maker who then leaves; connections break, nobody can edit it (the orphan problem).
- Over-sharing — a maker shares an app with 'everyone' or a broad security group, exposing its connections and data far beyond intent.
- Governance-as-blocker backlash — controls so heavy that makers route around them entirely, which is worse than visible sprawl.
What to watch (proofs)
- Maker population and where they build:
Get-AdminPowerAppEnvironment+ per-environment maker/role assignments — how many people can create in the default environment is the headline risk metric. - Orphaned/high-risk ownership:
Get-AdminPowerApp/Get-AdminFlowOwnerRolefor assets owned by departed or single owners. - Over-shared apps:
Get-AdminPowerAppRoleAssignment— apps shared to broad groups or 'everyone'. - The sanctioned-path adoption: production-env requests vs new default-env assets (CoE / admin center) — if default keeps growing, the on-ramp isn't working.