Two Governance Checks Worth Building Yourself After the CoE Starter Kit
Diesen Beitrag auf Deutsch lesen
Dependency checks before decommissioning and automatic inactive-owner detection for flows - two concrete ideas, regardless of which tool you use.
TL;DR
With the CoE Starter Kit gone, two concrete governance gaps are worth plugging yourself: before removing a SharePoint site or environment, check what flows, reports or agents actually depend on it; and for departed employees, auto-detect flows whose owners are no longer active and route reassignment to a designated admin instead of letting them fail silently.
Original by Matthias Einig, on Rencore. Read the original
This is our own summary, not a republication or full translation.
Governance takeaway
- Admins/CoE: build both checks with Power Automate and the admin connectors alone, no separate governance product required, starting with a dependency lookup before decommissioning anything.
- Makers: benefit directly from the inactive-owner scan — a departed colleague’s flow gets rerouted to a designated admin instead of failing silently the next time it runs.
- Security/Compliance: push for the decommissioning check specifically, since removing a site or environment without checking dependent flows, reports, or agents is exactly the kind of gap that turns into an unplanned outage.
Frequently asked questions
How current is a governance inventory for Microsoft 365 and Power Platform?
It is not real time. Graph API endpoints are throttled, so for larger tenants live data across many services is, according to Rencore, not technically possible for any vendor apart from Microsoft.
Can governance tooling intercept an app or flow before it is created?
Not at the moment it happens, because Microsoft does not expose that event to third-party tools. What works is detecting new apps and flows afterwards and notifying the creator.
What data does a governance tool like Rencore collect and where is it hosted?
It collects metadata only, with no file content, message bodies or user-generated content. The data goes into a dedicated Azure resource group per customer, encrypted with a customer-specific key.