Template · Power Platform target architecture
Power Platform Enterprise Blueprint
A reference architecture for running Power Apps, Power Automate and Copilot Studio in a global organisation. It covers how environments are laid out, how data policies stack, how capacity is paid for and charged back, and how the platform reports on itself. Each sheet shows a diagram first, then the detail behind it. Sheet 10 works through common governance scenarios, such as cross-charging and restricting the GitHub Copilot harness. Sheet 11 covers the operating loop: control, monitor, report and cross-charge.
No new AI Builder credits from 1 November 2026
From that date, AI Builder capacity add-ons reach end of life and new or renewed premium licences no longer include seeded AI Builder credits. Credits you already hold are honoured to the end of your contract term. After that, AI Builder features keep working but draw Copilot Credits, and fail if none are available. Inventory AI Builder use now, plan Copilot Credits for the affected environments, and turn off auto-renew of AI Builder add-ons. Sheet 05 has the detail.
Managed environments need premium licences, enforced from February 2027
Every user who runs an app or cloud flow in a managed environment needs a premium licence (Power Apps Premium, Power Automate Premium or a qualifying Dynamics 365 licence) or a pay-as-you-go meter. Microsoft has shown in-app warnings since June 2026. From February 2027, unlicensed users can't open apps in managed environments. This blueprint makes most environments managed (D4), so run the Users requiring licenses in Managed Environments report and budget for the result before you scale out.
Products this blueprint governs
Power Platformadmin center, policies
Power Appscanvas & model-driven
Power Automatecloud & desktop flows
Copilot Studioagents, Copilot Credits
Power Pagessupplier & dealer portals
Dataversedata, security, capacity
AI Builderno new credits from 1 Nov 2026Reference organisation: swap in your own values
The template is drawn for a fictional global manufacturer: about 250,000 people, five operating regions that each own their P&L, plants on several continents, a large supplier base, a dealer network and plans to roll out Copilot Studio agents at scale. The platform has to be governed centrally but paid for and run regionally, and it has to be ready for an agent wave that consumes credits.
| Parameter | Reference value | If yours differs |
|---|---|---|
| Operating regions | 5, each owning its P&L: NA, EU, ME (Middle East & Africa), LA (Latin America), AP | Groups = tiers × regions + 1 (sheet 02). If business units own budgets instead of regions, cut the columns by BU. |
| Power Platform geos | United States, Europe, UAE, South America (Brazil), Asia | Pick the geo nearest each region's users and its residency law (sheets 02, 07). You can create environments in the India geo only if your tenant is in India. |
| Tenant home geo | Europe | The default environment lives here. Choose where most of your Microsoft 365 data already sits. |
| Business unit codes | MFG · PUR · QLT · ENG · SAL · FIN · HR · LEG · IT | Swap in your own three-letter codes (naming convention, sheet 02). |
| Restricted data classes | HR, finance, legal, engineering IP, connected-product and customer data | Map Zone R to whatever carries your "Highly Confidential" sensitivity label. |
| Core systems | SAP ERP, a MES per plant, ServiceNow, Salesforce, an Azure landing zone | Change the connector rows (sheet 03) and the gateway design (sheet 07). |
| Industry overlay | Automotive: TISAX, UN R155, ISO/SAE 21434 | Swap for GxP (life sciences), NERC CIP (energy), PCI DSS (retail) or similar (sheet 07). |
| Licence funding | Central pool, charged back to regions | If regions buy their own licences, drop the central cross-charge and report pools per region (sheet 05). |
| Agent ambition | 100+ production agents within two years | Sets Copilot Credits sizing and how soon the agent controls are needed (sheets 05, 07). |
Ten decisions this blueprint makes
One global tenant. Environment groups are cut by tier × region to mirror the operating regions.
The default environment becomes Personal Productivity: core Microsoft 365 and non-blockable connectors only, routing on, Share with Everyone off.
Three zones: G personal, A business, R restricted, each mapped 1:1 to environment groups. Allowlisting starts in Zone R.
Every environment except the default and Teams environments is managed, so group rules hold the settings. The trade-off: their users need premium licences, enforced from Feb 2027.
Production accepts managed solutions only, deployed by Pipelines as a service principal. Zone R uses pro-dev CI/CD.
A prepaid baseline is pooled and allocated per environment. Growth runs on pay-as-you-go through one billing policy per region × cost owner.
No new AI Builder credits after 1 Nov 2026; existing ones run to contract end. Plan Copilot Credits for every AI Builder use.
Native inventory and data export feed a Fabric governance lakehouse. The CoE Starter Kit is not the base for new build.
Agents are identities: new ones get an Entra Agent ID. Add quarterly access reviews and zone-specific connector rules.
A global Platform CoE, regional hubs and BU champions. Three maker tiers with promotion triggers read from inventory.
One Microsoft Entra tenant for all regions; tenant home geo in Europe; Microsoft 365 E3/E5 as the user baseline; sovereign-cloud jurisdictions (for example mainland China) handled separately, outside this design. Environment names and examples are illustrative.
Sheet 01 · Architecture
Reference architecture
Five layers. People configure a tenant-wide control plane, which enforces policy on environments grouped into zones. Environments reach data through a few governed paths, and every layer emits telemetry that returns to the people who run the platform.
Power PlatformPower AppsPower AutomateCopilot StudioDataverseWhy five layers
Each layer has one owner and one change process. The control plane changes through the CoE change board; zones change through group rule templates; integration paths change through Security. That keeps a change in one place from silently weakening another.
Where agents fit
Copilot Studio agents live in Zone A for read-only assistants and in Zone R as soon as they take actions on business systems. Their tools (connectors and MCP servers) are governed by the same data policies as apps and flows, and each agent has its own Entra identity.
Sheet 02 · Environments
Environment strategy
Environments are the security, data-residency and cost boundary, so the topology follows those three needs. Columns are the regions, each pinned to the nearest Power Platform geography. Rows are tiers. Every cell is an environment group whose rules lock the settings of each environment in it.
Power PlatformDataverseGroup rules by tier
Microsoft now offers 28 group rules, picked from a rules gallery. They include sharing controls for canvas apps, solution-aware flows and agents; solution checker enforcement; unmanaged customizations; back-up retention; advanced connector policies; knowledge sources and skills for agents; generative AI settings; and the cost control Draw from tenant credit pool. IP firewall and IP cookie binding aren't rules, but you can apply them to a whole group from Security › Overview. Customer-managed keys, Lockbox and VNet are still set per environment by the provisioning script. Back-up retention above the 7-day default applies only to production managed environments. Sharing rules can exclude security groups and cap individuals; they can't allow-list named groups.
| Group | Zone | Canvas sharing | Solution checker | Backup | Set per environment | Who creates |
|---|---|---|---|---|---|---|
| EG-G-PDEV-{R} | G | ≤ 5 individuals, no groups | Warn | 7 days | — | Routing (auto) |
| EG-A-SHDEV-{R} | A | ≤ 50 individuals, no groups | Warn | 7 days | — | Regional hub |
| EG-A-NP-{R} | A | Security groups allowed, no cap | Block critical | 7 days | — | Regional hub |
| EG-A-PRD-{R} | A | Security groups allowed; Everyone blocked tenant-wide | Block critical | 28 days | Group rule: block unmanaged customizations | Regional hub |
| EG-R-PRD-{R} | R | Security groups allowed; named groups agreed at review | Block (critical); high findings reviewed in CI | 28 days | CMK, Lockbox, VNet; IP firewall applied to the group | Platform CoE |
| EG-P-PLATFORM | P | Environment security group limits access | Block critical | 28 days | IP firewall applied to the group | Platform CoE |
Naming convention
PRD-EU-MFG-ShiftLog
- Stage: DEV · SHD · UAT · PRD · PIPE · GOV · QRN
- Region: NA · EU · ME · LA · AP
- BU: MFG · PUR · QLT · ENG · SAL · FIN · HR · LEG · IT
- Groups: EG-{ZONE}-{TIER}-{REGION}
- Keep confidential project names out: anyone with admin center access can see environment names.
Creation & clean-up
- Creation is restricted. Only admins create production, sandbox and trial environments. Developer environments come only through routing; everything else goes through an intake form.
- Licence auto-claim is on. A user who opens a premium or managed-environment app gets a Power Apps licence, if one is free in the pool. Keep headroom in the pool, because unlicensed users are blocked in managed environments from February 2027.
- The default environment gets cleaned out. Shared multi-maker assets move to shared dev, then production. Single-maker assets move to the owner's dev environment. Anything unused for 90 days goes to quarantine after the owner is told.
Sheet 03 · Data loss prevention
Data policy layering
Data policies are evaluated together and the most restrictive result wins. Three layers use that on purpose: a thin tenant baseline, a zone policy per environment group, and in Zone R an advanced connector policy (ACP) that turns the model into an allowlist with action-level and MCP-server-level control.
Power PlatformPower AppsPower AutomateCopilot StudioConnector classification by zone
| Connector family | Zone G · personal | Zone A · business | Zone R · restricted (ACP) |
|---|---|---|---|
| M365 core: SharePoint, OneDrive, Outlook, Teams, Approvals, Planner, Excel Online | Business | Business | Allow; delete and send-as actions need review |
| Dataverse, Office 365 Users | Business | Business | Allow |
| SQL Server, Azure SQL | Blocked | Business; endpoint filter to approved servers | Allow; reach private endpoints through VNet support |
| HTTP, HTTP with Entra ID | Blocked | Business; endpoint filter to APIM hosts | Layer 2 filter: APIM hosts only |
| Custom connectors | Blocked (URL pattern *) | APIM host patterns only | APIM host patterns only |
| SAP ERP | Blocked | Business via gateway cluster | Allow named actions only |
| Enterprise SaaS: ServiceNow, Salesforce, Workday | Blocked | Business | Case-by-case allow |
| Azure OpenAI and AI services | Blocked | Business; deployments approved at intake | Allow; endpoints approved at intake |
| MCP servers (agent tools) | Blocked | Blocked by default; exception | Allow per named server |
| Consumer social, personal mail & storage | Blocked | Blocked | Not on allowlist |
| Desktop flow modules (RPA) | Blocked (modules must be classified explicitly) | Approved module list | Layer 2: approved modules classified explicitly |
| Copilot Studio channels, authentication, knowledge (virtual connectors) | Teams and Microsoft 365 channels only; authentication required | Adds SharePoint channel; public websites blocked | Layer 2 policy; public websites and Bing search off |
| Newly released connectors | Blocked by default | Non-business until reviewed | Not on allowlist until reviewed |
Microsoft Learn documents ACP as generally available per workload once design-time enforcement reaches that maker portal (Power Automate, then Copilot Studio, then Power Apps). Until then it is enforced at runtime only for that workload. Start in mixed mode (the default). Don't switch Zone R to ACP-only while custom, HTTP, desktop-flow and Copilot Studio virtual-connector controls still live in the classic layer 2 policy. Endpoint filtering is still in preview and doesn't evaluate values held in environment variables.
Sheet 04 · Application lifecycle
Release paths
Two paths share one rule: nothing unmanaged reaches production. Citizen and fusion teams use Pipelines in Power Platform from a host in their own geo. Zone R and Tier 3 solutions use a pro-dev path that builds the managed artifact from source and runs automated tests.
PipelinesPower AppsPower AutomateDataverseSolution standards
- Turn on Create new canvas apps and cloud flows in Dataverse solutions in every dev environment, and have each maker set a preferred solution, so new assets land in a solution.
- Every endpoint, site URL and ID goes in an environment variable. Every connection goes through a connection reference owned by a service account, never a person. Endpoint filtering doesn't evaluate values held in environment variables, so for those endpoints the API gateway is the real control.
- The solution checker is enforced by group rule: Block in every target (Block stops imports with critical issues only). Review high findings in the pull request for Zone R.
Source & identity
- Dataverse Git integration (Azure DevOps, or GitHub in preview; requires managed environments) is on for shared dev and every Tier 2 or Tier 3 solution, so any version can be rebuilt.
- One deployment service principal per geo, owned in Entra by the Platform CoE, with Deployment Pipeline Administrator in the pipelines host and System Administrator in target environments.
- Pipelines targets must be managed environments. From October 2026, Pipelines warns admins about unmanaged targets and blocks deployments to them after 30 days.
- Approvals run as a flow in the Pipelines host, so every gate leaves an audit trail.
Sheet 05 · Credit consumption & FinOps
Paying for capacity
Capacity reaches environments by two routes. The prepaid route pools licences and capacity packs at tenant level and allocates them per environment. The metered route links environments through a billing policy to an Azure subscription. Both end in a chargeback to the region that owns the P&L.
Copilot CreditsAI BuilderDataverseLinking an environment to a billing policy changes what it can use: Process licences, the unattended RPA add-on, app passes and Power Pages capacity are ignored there. Keep RPA and app-pass workloads in environments without a billing policy.
Meters, who pays, what to watch
| Consumption | Paid from | Typical leak | Control |
|---|---|---|---|
| Premium per-user licences | Central pool, cross-charged to regions | Licences held by people who stopped using premium apps | Auto-claim on use (if licences are free in the pool); our process reclaims after 60 days idle |
| Per-app pay-as-you-go | Billing policy → regional subscription | Occasional users of many metered apps | Above roughly two metered apps a month, a per-user licence is usually cheaper. Check your price sheet. |
| Copilot Credits | Prepaid packs allocated per env; PAYG overflow | Generative answers over large knowledge sources; looping topics | Allocation with tenant draw off, agent monthly limits, Azure budgets for alerts |
| Dataverse DB, file, log | Tenant pool (can be allocated per environment, alerts only); PAYG environments get 1 GB DB + 1 GB file, the rest billed to Azure | Audit log and attachment growth; forgotten sandboxes | Retention policies; cold data to Fabric; quarterly sandbox sweep |
| AI Builder credits | Existing credits until contract end; no renewals from 1 Nov 2026 | Usage falls back to Copilot Credits unbudgeted, then fails with an entitlement error when none are left | Inventory now; plan Copilot Credits for affected environments |
| Process & Hosted Process licences (RPA) | Per bot, regional budget | Idle bots on paid licences | Utilisation by machine group; keep RPA out of PAYG-linked environments, where Process licences don't apply |
Inform
- Every environment tagged with region, BU, cost centre and owner
- Daily cost and capacity data in the lakehouse
- Showback dashboard per region
Optimize
- Reclaim idle licences; right-size per-app meter vs per-user
- Move steady PAYG workloads to prepaid packs
- Archive Dataverse data that's growing cold
Operate
- Monthly FinOps board with every region
- Budgets in place before any billing policy goes live
- Unit costs tracked: per active app, per flow run, per resolved agent conversation
Sheet 06 · Reporting & control
Telemetry to action
Native sources land daily in a Fabric governance lakehouse, joined to the Entra org chart and the cost-centre hierarchy. One semantic model serves four audiences at four cadences, and every report links to an action, so the loop closes.
InventoryGovernance flowsControl KPIs
| KPI | Definition | Proposed target | Cadence | Owner |
|---|---|---|---|---|
| Governance coverage | Environments managed and in a group, excluding default and Teams | 100% | Weekly | Platform CoE |
| Default env hygiene | Apps in the default env shared with more than 20 people | 0 | Weekly | Regional hubs |
| Orphaned assets | Apps, flows and agents whose owner has left | < 1%, fixed within 30 days | Weekly | Regional hubs |
| Production ALM compliance | Production envs holding only managed solutions | 100% | Weekly | Platform CoE |
| Zone R exceptions | Open connector exceptions, each with an expiry date | < 10 open, none expired | Monthly | Security |
| Licence utilisation | Assigned premium licences used in the last 30 days | > 85% | Monthly | FinOps office |
| Credit burn vs allocation | Copilot Credits used ÷ allocated, per environment | Alert at 80% | Daily | FinOps office |
| Cost ownership | Platform spend with a valid cost-centre tag | 100% | Monthly | FinOps office |
| Time to environment | Request to provisioned environment | < 2 business days | Monthly | Regional hubs |
| Agent identity hygiene | Agents with an Entra Agent ID and a review in the last 90 days | 100% | Quarterly | Security |
Microsoft states the kit is no longer actively maintained: issues aren't reviewed, its last release was February 2026, and the repository was archived in July 2026. Its core scenarios now live in the admin center's Inventory, Usage, Monitor and Actions pages. If the kit is already installed, keep it only until the lakehouse covers the same KPIs.
Sheet 07 · Security & identity
Trust boundaries
Every request crosses three boundaries: identity, tenant and environment. Outbound traffic is designed to leave only through paths the platform team owns. New Copilot Studio agents (since May 2026) get an Entra Agent ID, so they can be reviewed and audited like other workloads. Conditional Access on an agent's identity is enforced only in Teams today.
Copilot StudioDataversePower PlatformRegulatory mapping
The first three rows apply to most global businesses. Rows tagged overlay are industry-specific, shown here for automotive; replace them with your sector's rules.
| Requirement | Applies to | Architectural control |
|---|---|---|
| GDPR | Europe region; EU data subjects anywhere | EU environments pinned to the Europe geo; Purview audit and retention; personal data only in Zone A or R; Bing web search and cross-region AI data movement off in Zone R |
| LGPD (Brazil) | Latin America | LA customer and HR data in South America (Brazil) geo Zone R environments |
| DPDP Act 2023 (India) | Asia Pacific | Personal data of Indian residents in India-geo environments, which need an India-based tenant. Otherwise use the Asia geo after legal review. |
| TISAX (VDA ISA) overlay | Prototype, partner and supplier data | Engineering IP only in Zone R; supplier access as B2B guests with quarterly access reviews |
| UN R155 · ISO/SAE 21434 overlay | Connected-product data and services | Product telemetry reaches Power Platform only through APIM in Zone R. Low-code never sits in an on-product or over-the-air update path. |
| SOX-style controls if listed | Finance automations | Zone R, segregation of duties via pipeline approvals, managed-only production |
Sheet 08 · Operating model
People, tiers & ownership
A small global team owns the platform and its policies; the regions run it. Makers move between three tiers, and promotion is triggered by what inventory observes, not by what the maker declares. A personal app that quietly reaches 300 users gets flagged within a week.
Power AppsPower AutomatePower PagesCopilot StudioPlatform CoE
- Platform owner and architects
- Platform operations: admin, automation, IaC
- Security liaison to the Cyber Defense Center
- FinOps analyst
- Enablement and community lead
Regional hubs
- Regional platform admin with PIM-scoped rights
- Champion network lead
- Licence and capacity coordinator
- Local-language enablement
- Owns the region's KPIs and P&L line
BU champions
About one champion per 50 active makers (proposal). They do the first review for Tier 2, run the default environment clean-out locally, and feed connector requests to their hub.
Responsibilities
| Activity | Platform CoE | Regional hub | BU champion | Cyber Defense | FinOps office |
|---|---|---|---|---|---|
| Tenant settings & data policies | A / R | C | I | C | I |
| Group rule templates | A / R | C | I | C | — |
| Environment provisioning (Zone A) | A | R | C | — | I |
| Zone R provisioning & exceptions | R | C | I | A | I |
| Licence & capacity allocation | R | C | I | — | A |
| Chargeback | C | C | I | — | A / R |
| Tier 2 review | I | A | R | — | — |
| Tier 3 architecture review | A / R | C | C | C | I |
| Incident response | R | R | I | A | — |
A = accountable · R = responsible · C = consulted · I = informed
Sheet 09 · Roadmap
Getting there
Four steps, starting with the one deadline that can't move. Each phase leaves the tenant safer than it found it, so the programme can pause between phases without leaving gaps.
Stop the bleeding
- Inventory AI Builder use; plan Copilot Credits for when existing credits end
- Run the managed-environment licence report; budget before Feb 2027
- Baseline Power Platform Inventory; set up data export (preview)
- Rename and lock down the default environment
- Run cross-tenant isolation reports (preview) to draft the allowlist
Foundation
- Create the 26 environment groups and apply six rule baselines by script
- Environment routing for one pilot region, the one with the most active makers
- Billing policies and Azure subscriptions per region, each with a budget
- Pipelines host per geo; deployment service principals
- Enforce tenant isolation with a partner allowlist
Scale
- Routing in every region
- Default environment clean-out by the migration rules
- ACP in mixed mode on Zone R groups
- Governance lakehouse and Power BI app live; chargeback in the monthly close
- Tier promotion triggers automated
Optimise
- ACP extended to Zone A
- Agent access reviews and Conditional Access (Agent 365 licence; CA enforced in Teams only today)
- Playwright test automation standard for Tier 3
- Unit-cost FinOps targets per region
- Retire any CoE Starter Kit components that remain
Open decisions
- Confirm the tenant home geo, and whether any region needs its own personal-productivity environment.
- Sovereign-cloud jurisdictions (for example China): a separate tenant, or no Power Platform there.
- Premium licence funding: central with chargeback, or bought by each region.
- Dataverse for Teams: allow it as a team-collaboration option, or route teams to shared dev.
- How fast to move Zone A from classic data policies to ACP once Zone R is stable.
Sheet 10 · Governance scenarios
Governance scenarios
Worked answers to governance questions that come up again and again. Each scenario shows the mechanism, the steps in order, and the traps that catch teams out. All three use the zones, groups and capacity model from sheets 02–05.
Power PlatformCopilot StudioDataverseHow do we charge each business unit for the Power Platform and Copilot Studio capacity it actually uses?
Steps
- Register a cost owner for every environment: environment ID, region, BU, cost centre and owner, kept in the governance environment. The naming convention already carries region and BU.
- Choose how each environment is funded. Use a prepaid allocation for predictable workloads and a pay-as-you-go billing policy for variable ones. Create one billing policy per cost owner per region, and tag its Azure subscription with the cost centre.
- Allocate Copilot Credits per environment and switch off "Draw from the available capacity in my tenant" so each environment's prepaid spend stops at its allocation. Enforce it at scale with the environment-group rule Cost controls – Draw from tenant credit pool.
- Set the tenant's add-on capacity assignment setting to "Only specific admins". If environment admins are allowed, they can allocate credits to every environment in the tenant, not just their own.
- Land the data monthly in the governance lakehouse (sheet 06): Azure cost exports, the Copilot Studio consumption report, licence reports and inventory.
- Publish the statement per region, BU and cost centre. Review it at the FinOps board and settle disputes before the books close.
Common traps
- An allocation alone isn't a boundary. If the environment can still draw from the tenant pool or has a billing policy, it keeps spending.
- Azure budgets alert but don't stop usage. Where a workload needs a hard stop, add an agent monthly limit with Stop usage, with a margin: it isn't applied instantly and doesn't stop the agent flows the agent calls.
- Prepaid credits are shared with Microsoft 365. Credits allocated to Power Platform environments reduce what Copilot Cowork and Work IQ can use. Agree the split with the Microsoft 365 admin.
- Reports lag. Copilot Studio consumption data is aggregated daily and can be delayed, and Azure costs take up to 24 hours. Close the month from exported data, not dashboards.
Charge basis by cost type
| Cost type | Measured by | Charged as | Owner of the number |
|---|---|---|---|
| Pay-as-you-go meters | Azure Cost Management, filtered by the Power Platform account resource and tags | Actual cost, passed straight through | FinOps office |
| Prepaid Copilot Credits | Copilot Studio consumption per environment and agent | Credits consumed × internal rate (prepaid cost ÷ credits bought) | FinOps office |
| Premium per-user licences | Licence reports joined to each user's Entra cost-centre attribute | Licence count × list price | Regional hub |
| Dataverse capacity | Capacity report per environment | GB above the environment's share of tenant entitlement × rate | Platform CoE |
| Shared platform cost | Platform CoE budget | Split by active makers or active apps per BU (agree once a year) | Platform CoE |
How do we let finance makers use SAP and sales makers use Salesforce, without opening either connector to everyone?
Steps
- Define connector packs: a baseline every maker gets, plus add-on packs per business need, such as finance (SAP, SQL), sales (Salesforce) and engineering.
- Create one environment group per pack per region (for example EG-A-FIN-{R}). Give each an advanced connector policy equal to the baseline plus its pack. Use the Power Platform API to copy the baseline policy between groups so they stay in step.
- Restrict risky connectors by action. Set them to SomeAllowed and list only the permitted actions, such as read-only Salesforce or named SAP calls.
- Bind each environment to an Entra security group and give its members the maker role through a Dataverse group team.
- Publish an access package per pack in Entra ID Governance. Require approval from the BU champion, set a 180-day expiry and add a quarterly access review.
- Start in mixed mode. Watch for blocked attempts, then switch each group to ACP-only once it's stable.
Common traps
- Everyone in an environment gets all of its connectors. Don't mix audiences in one environment.
- Policies stick. Each environment has one effective connector policy. If you move an environment out of a group or remove the group rule, the last policy stays in place until you remove it on the environment.
- Keep these groups managed. On non-managed environments, nonblockable connectors stay nonblockable.
- New connectors are blocked by default. Publish a request path so makers aren't stuck.
- Custom, HTTP and MCP: keep the classic data policy for custom and HTTP connectors. MCP servers can only be allowed or blocked whole.
How do we stop agents built on the GitHub Copilot harness from running up Copilot Credits or reaching data they shouldn't, while still letting approved teams use them?
Posture by environment class
| Environment class | Who can build | Credit posture | Agent limit | Result |
|---|---|---|---|---|
| Personal dev G | The owner only | No allocation, tenant-pool draw off (group rule), no billing policy | — | Harness agents can't consume credits, so they're effectively unavailable. Other credit-consuming features stop working here too. |
| AI lab A EG-A-AILAB-{R} | Approved makers via access package | Small fixed allocation, tenant-pool draw off, no billing policy | Development limit applied by automation, Stop usage on | Exploration within a fixed monthly budget |
| Test A | Product team | Time-boxed allocation for the test period | Sized for the test, reviewed at the end | Real evaluation without open-ended spend |
| Production A R | Deployments only, via pipelines | Allocation plus pay-as-you-go for continuity, with an Azure budget and a named cost owner | Set from expected demand, notify at 80% | Funded, monitored and charged back (scenario A) |
Steps
- Set the add-on capacity assignment tenant setting to "Only specific admins", and limit the Copilot Studio authors security group in tenant settings.
- Publish the rule Cost controls – Draw from tenant credit pool = off on Zone G and AI lab groups, and don't link a billing policy to them.
- Create AI lab groups per region. Allocate credits, then bind each environment to a security group and an access package.
- Tighten what lab agents can reach. In the classic data policy, block Knowledge source with public websites and data and unneeded channel connectors, and turn off Bing search on the environment. Use the group rules Knowledge sources for agents and Skills in Copilot Studio. In ACP, allow MCP servers by name only in Zone R.
- Automate daily: find agents with harness = GitHub Copilot in inventory, apply your development limit with Stop usage, and notify the owner. Admin center has no tenant-wide default agent limit, and the inventory API needs a delegated admin account.
- Promote to production only through a Tier 3 review (sheet 08) with a cost owner, funding and a demand-based limit.
Common traps
- Building isn't free. Building, previewing, testing and evaluating all consume credits, before anything is published.
- Developer and trial environments are billed. They moved to usage-based billing on 1 Sep 2026, so routed personal dev environments need the zero-credit posture above.
- Capacity controls hit everything in an environment: standard agents, agent flows, prompts and harness agents alike. Check before you change them.
- The Harness column is admin-center only. Automation has to derive the harness from inventory fields until properties.harness is returned.
Sheet 11 · Run the platform
Control, monitor, report, cross-charge
The day-to-day operating loop. Controls stop problems before they happen, monitoring catches what gets through, reports show each owner where they stand, and the monthly cross-charge makes each business unit pay for what it uses.
Power PlatformCopilot StudioDataverseWhich controls prevent problems, at which scope, and where do you set them?
Control catalogue
| Control | Scope | What it prevents | Where you set it | How you prove it's on |
|---|---|---|---|---|
| Tenant isolation | Tenant | Connections to and from other tenants using Entra-authenticated connectors | Tenant settings | Security › Overview recommendation clears |
| Environment creation and developer environment assignment | Tenant | Unaccounted environments and capacity use | Tenant settings | Inventory: no new environments outside groups |
| Copilot Studio authors group | Tenant | Anyone building agents | Tenant settings | Setting shows the security group |
| Add-on capacity assignment: Only specific admins | Tenant | Environment admins moving credits between environments | Tenant settings | Setting value |
| Advanced connector policy | Group or environment | Any certified connector or action not on the allowlist, including MCP servers | Group › Rules | Policy status shows Applied |
| Classic data policy | Tenant, or a list of environments | Mixing business and non-business data; custom, HTTP and Copilot Studio virtual connectors | Security › Data policies | Policy scope matches the group's environment list |
| Sharing rules (apps, flows, agents) | Group | Oversharing; sharing with security groups where excluded | Group › Rules | Rule published; Security score |
| Solution checker: Block · Unmanaged customizations | Group | Critical-issue imports; direct edits in production | Group › Rules | Rule published |
| Draw from tenant credit pool: off | Group | An environment spending prepaid credits beyond its allocation | Group › Rules | Licensing › Copilot Studio shows the cap |
| Agent monthly limit with Stop usage | Agent | One agent consuming far more credits than planned (not instant; doesn't stop agent flows) | Licensing › Copilot Studio › Manage agents | Agent status: Within limit |
Principles
- Prefer a tenant setting or group rule over an environment setting. Rules lock the setting so environment admins can't change it.
- Put controls in code: the Power Platform API and admin SDKs can apply allocations, advanced connector policies and group membership, so every region gets the same baseline.
- Pair every restrictive control with a request path and an owner who can approve exceptions.
Common traps
- Managed-only features. Group rules, sharing limits, IP firewall and alerts need managed environments, and managed environments need premium licences for every user (enforced from Feb 2027).
- Removing a rule doesn't undo it. Environments keep the last applied connector policy until you remove it on each one.
- Exceptions drift. Review approved exceptions quarterly and give each one an expiry date.
Which signals tell us something is going wrong, how quickly do they arrive, and who acts on them?
Alert catalogue
| Alert | Source | Threshold | Freshness | Routed to |
|---|---|---|---|---|
| High-use app, flow or agent unhealthy | Monitor, predefined by Microsoft, on by default | Fixed: availability or success rate under 90% for high-use resources | Daily | Platform operations |
| Production flow or app degraded | Monitor custom alert rule (managed environments only) | Proposal: success rate under 95% | Daily, or hourly for some metrics | App owner + regional hub |
| Flow run failures | Application Insights + Azure Monitor alert | Proposal: 3 failures in 15 minutes | Minutes | App owner on-call |
| Agent nearing its credit limit | Copilot Studio agent limit notification | Proposal: 80% of monthly limit | Daily | Agent owner + FinOps |
| Environment out of Copilot Credits | Copilot Studio enforcement and admin notification | Allocation exhausted; prepaid tenant enforcement at 125% | Daily | FinOps office |
| Dataverse capacity low | Microsoft email and banner | Fixed: under 15%, under 5%, overage | Weekly | Platform CoE |
| Environment near its Dataverse allocation | Opt-in daily email per allocation | Proposal: 80% of allocation | Daily | Environment owner |
| Budget or cost anomaly | Azure Cost Management budget and anomaly alerts | Proposal: 50 / 80 / 100% | Up to 24 h | FinOps office |
| Risky activity in Zone R | Sentinel analytics rule over Purview audit | New connector use, bulk export, sharing to large groups | About 24 h | Cyber Defense Center |
| Licence shortfall | Admin center notifications and Actions recommendations | Raised by Microsoft | As raised | Regional hub |
Set-up checklist
- Turn on tenant-level analytics. Monitor metrics and the security score need it.
- Enable managed environments where you need custom alerts, recommendations and Application Insights export.
- Install the Power Apps app in Teams to get the weekly Actions summary card.
- Set agent limits with notification thresholds on every agent outside personal dev.
Common traps
- Audit isn't real-time. Don't build incident response on Purview events alone.
- Alerts need managed environments, so the unmanaged default environment is watched through inventory and usage reports instead.
- Agent limits lag. An agent can keep responding for a while after reaching its limit, so set thresholds with a margin.
Which questions can the admin center answer on its own, and which need our governance lakehouse?
Report pack
| Report | Question it answers | Audience | Cadence | Built from |
|---|---|---|---|---|
| Executive scorecard | Is the platform delivering value safely, and what does it cost by region? | CIO, regional COOs | Quarterly | Lakehouse: inventory, cost, org |
| Regional operations | Adoption, default-environment hygiene, orphaned assets, time to environment | Regional hubs | Weekly | Lakehouse with row-level security by region |
| FinOps statement | What does each cost centre owe this month, and why? | FinOps office, BU finance | Monthly | Lakehouse: Azure cost, Copilot Studio consumption, licences |
| Licence compliance | Who runs apps in managed environments without a premium licence? | Regional hubs | Monthly, and weekly before Feb 2027 | Native: Users requiring licenses in Managed Environments report |
| Agent spend | Which agents use the most credits, and which are near their limit? | FinOps office, agent owners | Weekly | Native: Licensing › Copilot Studio, downloadable by environment, agent or user |
| Operational health | Which business-critical apps, flows and agents are degraded? | Platform operations | Daily | Native: Monitor, with pinned critical resources |
| Security posture | Risky sharing, new connectors in Zone R, score trend | Cyber Defense Center | Daily | Native security score + lakehouse over Purview audit |
Rules for every report
- One semantic model, with row-level security by region.
- Every number shows its source and its as-of date, because most sources lag by up to a day.
- Every report names the action it drives and who owns that action.
Common traps
- Data export is in preview and covers apps and flows only. Use the Inventory API for agents.
- The Inventory API needs a delegated admin account. Plan how the scheduled job signs in.
- Licence reports use 30-day windows. Don't compare them directly with calendar-month cost.
How do we run the monthly cross-charge, and when do we back-charge?
Worked example: one cost centre, one month
Illustrative figures only. Use your own price sheet and agreed rates.
| Line | Basis | Calculation | Amount |
|---|---|---|---|
| Pay-as-you-go (Azure) | Actual cost on the subscription tagged FIN-EU | Passed through | €4,200 |
| Prepaid Copilot Credits | Credits used in FIN-EU environments | 180,000 × €0.008 internal rate | €1,440 |
| Premium licences | Users whose Entra cost centre is FIN-EU | 120 × €19 | €2,280 |
| Dataverse above share | GB above the environments' share of entitlement | 40 GB × €38 | €1,520 |
| Shared platform cost | 8% of active makers × platform budget | 8% × €60,000 | €4,800 |
| Back-charge (last month) | Agreed overage that drew from the tenant pool | 30,000 × €0.008 | €240 |
| Total cross-charge | €14,480 |
Back-charge rules
- Overage: credits drawn from the tenant pool above an environment's allocation are back-charged at the internal rate the following month.
- Corrections: errors found after close are fixed by back-charge or credit in the next cycle, never by reopening a closed month.
- Unowned spend: charged to the platform budget, and the environment goes to quarantine until it has an owner.
- Disputes: raised by the regional hub in the dispute window, and decided by the FinOps board.
Maturity path
- Showback for two or three months, until regions trust the numbers.
- Cross-charge direct costs: pay-as-you-go and licences.
- Add prepaid credits and Dataverse at agreed internal rates.
- Add shared platform cost and back-charges with an allocation key agreed once a year.
References
Sources
Product facts reflect Microsoft documentation and message-center posts available on 16 October 2026. Confirm licensing figures and dates against your agreement before budgeting.
- Tenant environment strategy at scale, Microsoft Learn (updated 12 Oct 2026)
- Environment groups, Microsoft Learn
- Managed governance, Microsoft Learn
- Environment group rules gallery, message center mirror
- Design a data policy strategy, Microsoft Learn training
- Advanced connector policies GA, message center mirror
- Pay-as-you-go overview and usage costs, Microsoft Learn
- MC1163767: AI Builder end of sale and transition to Copilot Credits
- MC1485055: AI Builder capacity add-on retirement
- Entra Agent IDs for Copilot Studio agents, Microsoft Learn
- MC1478488: automatic migration to Entra Agent ID
- Secure access to Azure resources (VNet), Microsoft Learn
- Power Platform landing zones, Microsoft industry repo
- Delegated deployment with a service principal, Microsoft Learn training
- CoE Starter Kit transition to the admin center, Microsoft Learn
- Microsoft Power Platform icons and their terms of use, Microsoft Learn
- Harnesses in Copilot Studio, Microsoft Learn
- Manage costs for agents powered by the GitHub Copilot harness, Microsoft Learn
- Govern Copilot Credit consumption, Microsoft Learn
- Advanced connector policies and programmatic management, Microsoft Learn
- Configure data policies for agents, Microsoft Learn
- Usage-based billing for Copilot Credits, Microsoft Learn
- End of AI Builder credits, Microsoft Learn
- Licensing requirements for managed environments (February 2027 enforcement), Microsoft Learn
- Rules for environment groups (28 rules), Microsoft Learn
- Security overview: group-level sharing, IP firewall and cookie binding, Microsoft Learn
- Monitor and alerts, Microsoft Learn
- Dataverse capacity-based storage, Microsoft Learn
- License consumption reports, Microsoft Learn
- Pay-as-you-go meters, Microsoft Learn
- Regions and automatic environment cleanup, Microsoft Learn
- Important changes (Test Engine deprecation), Microsoft Learn
- Agent identities and Conditional Access, Microsoft Learn
- Connector endpoint filtering (preview), Microsoft Learn