Low-code promises rapid development and democratized access to app development. But how do you scale this in a large enterprise with hundreds of developers and thousands of apps?

The Enterprise Challenge

Typical Problems

Without governance, problems arise quickly:

• Shadow IT: Uncontrolled apps and flows
• Data silos: Each department has its own data sources
• Security risks: Sensitive data in insecure apps
• Performance issues: Poorly designed flows burden systems
• Support chaos: Nobody knows who maintains which app

The Middle Ground

The art lies in balance:

• Too much control = Innovation is slowed
• Too little control = Chaos and risks
• Right balance = Controlled creativity

Center of Excellence (CoE)

What is a CoE?

A central team that enables and governs Power Platform development:

• Enablement: Training, templates, best practices
• Governance: Policies, reviews, compliance
• Support: Help for citizen developers
• Innovation: Evaluate new possibilities

CoE Starter Kit

Microsoft offers a free toolkit:

• Inventory: Inventory all apps, flows, makers
• Analytics: Measure usage and adoption
• Cleanup: Identify orphaned resources
• Nurture: Build maker community

Building a CoE

Phase 1: Foundation (Month 1-3)

• Define core team
• Create basic policies
• Install CoE Starter Kit
• Conduct first trainings

Phase 2: Scale (Month 4-6)

• Build champions network
• Offer advanced training
• Establish review processes
• Provide self-service portal

Phase 3: Optimize (continuous)

• Analyze metrics
• Improve processes
• Evaluate new features
• Nurture community

Environment Strategy

Environment Types

• Default: For quick wins and experiments
• Developer: Per developer for isolation
• Sandbox: For tests and demos
• Production: For productive applications

Recommended Structure

For larger enterprises:

• 1 Default Environment: For simple personal apps
• N Developer Environments: Automatically for each maker
• 1 Sandbox per Team/Project: For testing
• 1 Production per Team/Project: Controlled rollout

ALM (Application Lifecycle Management)

Professional development requires:

• Source Control: Solutions in Azure DevOps/GitHub
• CI/CD Pipelines: Automated deployment
• Environment Variables: Configuration per stage
• Connection References: Abstraction of credentials

Data Loss Prevention (DLP)

Why DLP is Critical

Without DLP, flows can for example:

• Post SharePoint data to Twitter
• Send company data to private email
• Store sensitive info in unapproved cloud services

Configuring DLP Policies

Group connectors into:

• Business: Approved enterprise connectors
• Non-Business: For personal productivity
• Blocked: Explicitly forbidden

Recommended Strategy

• Default Policy: Restrictive for all environments
• Exceptions: Specific policies for trusted teams
• Monitoring: Regularly check for violations

Security and Compliance

Identity and Access

• Conditional Access: MFA for Power Platform
• Security Groups: Control access to environments
• Maker Permissions: Who can create what?
• Data Permissions: Role-based data access

Audit and Logging

• Unified Audit Log: Track all activities
• Power Platform Admin Center: Usage analytics
• Azure Monitor: Detailed monitoring
• Custom Alerts: Notify on critical events

Compliance Features

• Data Residency: Keep data in Switzerland
• Retention Policies: Enforce retention periods
• Customer Lockbox: Control over Microsoft access
• Managed Environments: Enterprise governance features

Training and Adoption

Training Paths

Citizen Developer

• Power Apps Basics
• Power Automate Fundamentals
• Understanding governance policies

Pro Developer

• Advanced Power Fx
• Custom Connectors
• ALM and DevOps

IT Admins

• Tenant configuration
• DLP and Security
• Monitoring and Troubleshooting

Community Building

• Champions Program: Local experts in business departments
• Lunch & Learn: Regular knowledge sharing
• Hackathons: Foster innovation
• Showcase Events: Share success stories

CNEXT Enterprise Services

We accompany large enterprises:

• CoE Setup: From strategy to implementation
• Governance Design: Policies that work
• Training: Scalable training programs
• Managed Services: Ongoing support

Learn more: marcel.haas@cnext.ch