Power Apps, Power Automate, and Copilot Studio make it easy to build your own solutions. Employees automate approvals, send data via flows, or set up an agent to handle customer inquiries. IT often doesn’t find out about this until something stops working or a flow sends data to a personal email address.
With the SmartGovernance365 Check, we assess the health of your Microsoft 365 tenant and quantify risks. The check is read-only, makes no changes, and runs entirely within your environment. The first module covers the Microsoft Power Platform.
We explain the basic meaning of IT governance in our glossary. The article “9 Tips for a Successful Governance Strategy” shows you how to implement governance in Microsoft 365. Microsoft describes the basics of Data Loss Prevention (DLP) in the Power Platform on Microsoft Learn.
The result is a report based on numbers rather than assumptions. A statement such as “57 flows are still running even though their owner has left the company” provides a foundation that management can use to make decisions.
[Image placeholder: Header image “SmartGovernance365 Check: Power Platform”: will be uploaded to WordPress and replaced]
Key Points at a Glance
- Read-only: The check requests read permissions only. Every call to a Microsoft service goes through a list of permitted read accesses.
- Local: Your data, log files, and reports remain on your device. There are no cloud components and no telemetry.
- No content: Only metadata such as owner, shares, and connectors are collected; no emails, files, or chats.
- Power Platform First: 21 exams on environments, DLP policies, apps, flows, connections, and Copilot Studio agents.
- Transparent Disclosure: Items that could not be audited are marked as “unaudited” in the report, along with an explanation.
- A report for two audiences: key takeaways for senior management, supporting documentation, and recommendations for the IT department.
The assessment is not a substitute for governance. It shows where you stand today and provides the foundation for the next steps.
Why a check for the Power Platform?
In many tenants, the Power Platform has grown over the years without anyone keeping track of it. Any licensed user can create apps and flows in the default environment. Typical consequences:
- Flows are running under the account of someone who left the company a long time ago.
- Apps are shared with all employees or guests.
- Flows send data to external HTTP endpoints, to hard-coded email addresses, or to Dropbox and Google Drive.
- DLP policies are missing or leave HTTP, SMTP, and custom connectors unprotected.
- Agents from Copilot Studio are accessible without logging in and can access internal SharePoint content.
Taken individually, many things seem harmless. Taken together, however, they paint a picture that isn't visible in the Admin Center. This means there is no solid foundation, particularly when it comes to providing evidence for audits, data protection, and compliance.
How the SmartGovernance365 Check Works
Preparation: App Registration and Preflight
The Check logs in via app registration using a certificate. You set this up yourself; we provide instructions and an overview of all required permissions. We have deliberately not included a script that automatically creates the registration, as that would require write access.
Before the actual run, a preflight check verifies that everything is ready: PowerShell version, configuration, login, permissions, and licenses. It also detects whether the app has too many permissions and issues a warning. The result is “Ready,” “Partially Ready,” or “Blocked,” each accompanied by specific instructions for action.
Survey: Collecting and Analyzing Data
The Collector reads data via Microsoft Graph, the Power Platform Admin API, and the Dataverse Web API. It evaluates each check and writes the result to a local database file. If a check fails, the rest of the process continues. After logging in, it compares the tenant ID with the configuration and aborts if there is a discrepancy, ensuring that the wrong tenant is never checked.
Report: An HTML file with no external dependencies
You can generate the report from the database using the included program. The result is a single HTML file that works offline, can be shared via email, and can be printed as a PDF. Usernames can be masked in the report.
What the report shows
The report begins with an executive summary: the number of findings by severity level, the most important findings, and a brief recommendation for action. This is followed by key takeaways with figures from your tenant.
| Topic | Example of a key message |
|---|---|
| Inventory and Shadow IT | How many makers have built how many flows, apps, and agents, and what percentage of them are in the default environment? |
| Orphaned Objects | How many flows continue to run even though the owner has left? |
| Identities | How many flows run using privileged or private accounts? |
| Data Outflow | How many flows send data to external endpoints, email addresses, or cloud storage? |
| DLP | Are HTTP, SMTP, and custom connectors restricted? How many apps and flows violate a reference policy? |
| Approvals | How many apps are shared with everyone or with guests? |
| Agents | How many agents can be reached without logging in? |
Each finding includes a description, the impact, the number of affected objects, a list of those objects, and a recommendation. This allows your IT team to begin remediation immediately.
Where are the limits?
- No automatic correction: The check identifies issues; it does not correct them. You plan and implement the necessary measures—with our assistance, if you wish.
- No content analysis: Flows are examined for destination hosts, connectors, and email destinations, not for the content of the transmitted data. The check does not search for passwords or keys in flow definitions.
- Flows outside of solutions: If a flow is not part of a Power Platform solution, its definition is not readable by the check. The report identifies these flows instead of silently counting them as harmless.
- Commercial Cloud only: Sovereign Clouds such as GCC or GCC High are not supported.
- One tenant per run: If you operate multiple tenants, run the check for each tenant.
Frequently asked questions
Could the check make any changes to our tenant?
No. It only requests read permissions, and each request is checked against a list of permitted read accesses. Unauthorized requests are never executed.
Does our data leave the company?
No. The database, log files, and report are stored locally on your system. The check does not send any data to innobit or third parties. It is up to you whether you share the report with us for the meeting. This also makes it easier to comply with the Swiss Data Protection Act.
Does the check read emails, files, or chats?
No. It collects metadata such as names, owners, shares, and connector types.
What happens if we don't have a license or authorization?
Preflight reports this before the run. The affected checks appear in the report as "not checked" with an explanation, rather than as "passed."
Does the check also test Teams and SharePoint?
Not yet. A check module for collaboration is currently in development. The SmartGovernance365 Collaboration module is already available for governing teams, SharePoint, and workspaces. The SmartTenant365 Tenant Health Check provides a broader view of the configuration of your entire tenant.
How long does a run last?
Usually just a few minutes. The exact duration depends on how many environments, apps, flows, and agents your tenant contains.
The core information at a glance
Core benefits
Risks in the Power Platform are made visible through numbers: orphaned flows, open approvals, data leakage, missing DLP policies, and unprotected agents
Target group
Company executives and IT staff who use Microsoft 365 and the Power Platform and want to know what's actually running in their tenant
Innovation
21 tests, including Copilot Studio agents; read-only access via a list of permitted calls; local report as a single HTML file
Costs
Upon request; we will coordinate the scope of the report and the joint review with you
Conclusion
For many companies, the Power Platform is a blind spot. Apps, flows, and agents are created in a decentralized manner, and the risks are spread across owners, approvals, connectors, and identities. The SmartGovernance365 Check quantifies these risks without interfering with the tenant.
It's a starting point. Rules, responsibilities, and processes for the Power Platform will still be needed afterward.
Establishing Microsoft 365 Governance with innobit
The assessment is the first step in SmartGovernance365: understanding the current situation. Based on the report, we’ll discuss with you which findings are a priority and which governance module is the best fit. For the Power Platform, this is typically the SmartGovernance365 Platform module. Together, we’ll review:
- which findings pose a real risk to your company,
- which DLP policies and which environmental strategy are right for you,
- how to systematically take over or disable orphaned flows and apps,
- what rules should apply to makers and agents in the future.
If you’d like to further develop your Power Platform solutions professionally, we’ll support you with our expertise in process digitization. Upon request, we can handle day-to-day operations as part of our Managed Services.
Your contact person
Contact Alexander Dietrich directly
