(upbeat music)
- Coming up as more of your users build
Power Platform experiences around company data
and processes we're going to take a look at the controls
that you have in IT to manage environments,
monitor across your tenant,
as well as secure data access and more.
So today I'm joined by Julie Strauss,
Director of the Admin and Governance Team
for the Power Platform.
Welcome to the show.
- It's great to be here Jeremy.
Thanks for having me.
- And thanks for joining us remotely today.
So, low code environment such as with
Microsoft's Power Platform has really now
become more and more prolific.
Power Automate, for example,
is one of the most popular automation platforms
now on the planet, with around 25 billion
process flows running every day.
And Power Apps are also super popular,
as we saw with things like Team Rubicon's use
of Power Apps, as well as pharmaceutical company GSK's
implementation that we had recently on Microsoft Mechanics.
Now there's a huge momentum that we're seeing
with around 3 million active makers
of Power Apps every single month,
which is all great for business users,
and citizen developers and pro developers,
but what does this then mean for IT?
- It's great for those of you in IT too.
There's no reason why you can't add your citizen
and pro developers innovate and automate
their business processes and create apps.
And you might be familiar with the controls
we have available for Power BI,
which I know we have shown a few times
here on Microsoft Mechanics.
But we also have controls for the rest of the Power platform
that helps you focus on making sure that you have
the right parameters in place
for those creating apps and flows.
And this is what we are going to be talking about today.
- Okay, so why don't we start from the top here.
And a lot of time you think about the extent of the activity
that's going on in your organization,
you want to get a handle on that,
from an IT perspective of the apps, the flows,
and all the policies that you might need to set.
What do you need to do then from an IT perspective
to know which policies to set?
- Well, we'll been doing a lot of work in the area
of administration and governance, including analytics,
to many make it much easier to oversee
what apps are being created, by whom,
and the impact to the rest of the organization.
The new Power Platform admin center
provides a unified management experience,
which you can get to by going to
admin.powerplatform.microsoft.com.
And from there you can access
a number of built-in reports.
I'll point out a few of the important ones.
Under resources for example,
you can access capacity reporting,
where you can assess the storage consumption
for your tenant.
You can see which type of storage is being consumed
as well as which environments are consuming it.
So you can very closely monitor
who are the heavy consumers in your environments.
Next, let's take a look at analytics.
On the Power Automate, you can see what processes
are being automated and which flows are being created.
And with it, you can either have a different view into
the runs being made daily, weekly, as well as monthly.
And this is useful when you want to see
how active your user community is.
You can also quickly see which data sources
makers are connecting to and who is using them
and in which flows, and you can get the same for apps.
This is useful when you think through
your data loss prevention policies,
and who have permissions
to connect to specific data sources.
This can also give you a feel for the impact
when you start to think about blocking specific connectors.
- Okay, and these provide them a good level of visibility
with specific or within specific environments.
But what if you want a more holistic kind of
cross-tenant view of activity?
- You can do that too,
you can build your own custom dashboards
by taking advantage of the telemetry that the platform
submits to the Microsoft Office 365 activity logs.
And our Center of Excellence Starter Kit
provides you these Power BI templates,
which you can use to create cross-tenant dashboards
that tracks your overall apps and flows.
Here you can see the most active makers creating apps
and what departments they are in
and the most active departments.
I can see the different environments that I've created,
I can look at the different types of apps
and trends over time.
And I can even see what flows are being created.
So both a combination of this out-of-the-box report
and the cross tenant dashboard template
will allow you to very easily monitor the activity
within your tenant and as an administrator
you can have full visibility.
- Alright, so now you can see what's going on.
But what level of controls then do you have in order to
do things like manage access to resources and data?
- There are multiple layers of security.
At tenant level everything is identity-based
with Azure Active Directory,
which offers native integration into the platform.
This allows you to define conditional access policies
for the platform.
The next level is environment.
As people build out their Power Apps and flows,
you can scope permissions further by setting up environments
to further govern access to data sources.
You can determine who has admin level privileges
to perform admin operations within an environment
or who can create content,
what is what we call the maker role.
You can allow or block a connection
to specific data sources.
And with data loss prevention policies
you can prevent the mixing of non-business
and business data sources within a given app.
At the layer beyond that, at the data itself,
by provisioning Common Data Service,
you can control data access right down to the table,
and even field level.
- So this thing gets away from kind of
that one-size-fits-all approach.
And you can make sure that different departments
then within your organization can access resources
and data in a compliant way,
then as they build out new experiences and automations.
- That's right.
And that why setting up environments is key.
So let's go back into the Power Platform Admin Center.
And I'll make this real for you by showing you
how you would set up an environment.
Now you can see here I've set up a few environments already
based on data boundaries, for example,
geographic location and specific departments.
I'll set up a new one,
I'll click New, I'll give it a name.
Next, as you set up the environment,
you're presented with three different environment types;
a sandbox where people can develop and test
with limited impact on your resources,
your trial, which expires after 90 days for experimentation.
Most often you'll be setting up production environments.
So I'll select that.
I'll pick a location.
You'll typically pick a region that is close to
where your users will be.
And then I have the option to pick a database,
which typically means that you'll be provisioning
the Common Data Service, but I'll skip that for now.
And I'll go ahead and I'll provision the environment.
- Alright, so then how do you define
who has access then to this environment?
- Well, once my environment is provisioned,
I can see the details associated with it.
And as an admin, I can perform different admin operations
such as managing and assigning users.
I can define whether users should have
environment admin privileges
or whether they should have maker privileges.
I'll go in and assign and maker role to a user.
Now, something to point out here
is that any user in Azure Active Directory
is effectively a potential maker
but you can further define privileges.
I'll search for a user, in this case Sam,
and you'll see that it is pulling directly
from Azure Active Directory, and I'll add her.
And now she can create apps and flows in this environment.
Next, I'll go back in the environment,
and I'll add Common Data Service.
I'll keep the language as English,
and currency as US dollars.
I'll go ahead and hit Create.
And once the Common Data Service is provisioned,
I have more granular control
over what data Sam can access in this environment.
- Great, so now you've got additional controls
than if you tie your data to the CDS
but how do those controls then work?
- Well, on the settings,
you can see all the additional capabilities
that lit up as we provision Common Data Service.
To set specific data access controls,
I can create a new security role, I'll give it a name,
and then I have the option to define
more fine grained access rights depending on
what that entity is
and what I want the user to be able to do.
I can decide if I want the user to read and write
or delete data, etc.
I'll allow Sam to create accounts.
And I will allow her to read and write and to delete.
You can see as I click at these pies,
they change look and feel.
One click allows Sam to read accounts
she has created herself.
If I click twice,
she can read accounts created by her business unit.
And if I fill in the pie by clicking four times,
she can read account records created
by anyone in her organization.
- Okay, so you've created the environment,
you've kind of assigned the user to it
out of the Common Data Service database
for more fine grained control and security.
But how then do you govern the access to the data that's
living outside of CDS, for example, external data sources?
- Well, the Power Platform gives you the ability
to connect your apps to any data source
and we have more than 350 available connectors
that takes care of the integration for you.
And, so this time, we can go take a look at the policies
to govern which users can access which type of data.
So under data policies, you can define the data sources that
a maker in a role can connect to
within a specific app or flow.
I've defined a few policies here
for the different departments already creating apps.
Let's take a look
so you can see what it looks like.
So by default, all connectors are added into non business.
But once you re-categorize to business,
you're able to isolate the specific data sources
the user can connect to in a single application.
Because this is the marketing department,
I'll allow the user to access data from both
Twitter and Common Data Service.
But they cannot in the same app, for example,
connect to Adobe Signup Act.
I've also chosen to block SAP.
This means that the user can't connect
to this data source at all.
Had this been the finance department
that was creating a policy for
I would likely reverse the two.
When I'm done with my policy,
I can go ahead and define which environment
I want to apply to.
In this case, the environment
is for my marketing department.
- Okay, so there's really a lot here
that I didn't even know about before.
And this could be really good news,
I think for admins that are watching everywhere.
But what's your team then working on next
to even further the story?
- We are continuing to build out capabilities
in the Power Platform admin center,
such as management controls for new resources
that are being on boarded,
as well as additional analytic views
and government capabilities.
Also, you'll see us do more in the area of alerting.
Today we publish sample scripts and flows
for common alerts through our
Center of Excellence Starter Kit.
For example, this flow helps you set up an alert
to get notified when you see an app being shared
with a high number of users.
We also give you a Power Automate template for users
to submit a business justification to create apps and flows
so you can potentially determine
to set up an environment for them.
- Okay, thanks so much again for joining us today, Julie.
And also to get access to the sample apps and flows
and our cross-tenant Power BI dashboard template,
check out aka.ms/COEStarterkitDownload.
And also join the Power Platform community
to see how your peers might be using these capabilities
and that's at aka.ms/power-users.
And of course, don't forget to subscribe
to Microsoft Mechanics for the latest tech updates.
That's all the time we have for this show.
Good bye for now.
(upbeat music)