Power Platform Governance: CoE Kit, Managed Environments and DLP (2026)

Last updated: November 2, 2026

By ZapAI Team

Power Platform governance changed more in 2026 than in the three years before it. The CoE Starter Kit is no longer maintained, advanced connector policies turn DLP into an allowlist, and Managed Environments now carry a hard licensing deadline in February 2027. Our Power Platform consulting team sees the same order work every time. Get visibility first, then lock down the default environment, then build structure with environment groups and rules.

Here’s a hypothetical that won’t feel hypothetical to anyone who has run a Microsoft tenant. A tenant with 600 employees turns on Power Apps in 2022. Nobody plans environments, so everything lands in the default one. Four years later there are 900 flows, 140 canvas apps, and a dozen Copilot Studio agents, and the person who built the flow that posts invoices into Dynamics 365 left in March. Nobody knows what it touches. Nobody wants to turn it off.

That’s the problem Microsoft Power Platform governance exists to prevent. And the tools for it moved a lot this year. Several pages ranking for this topic still tell you to install the CoE Starter Kit and sort connectors into Business and Non-business buckets. Both pieces of advice are dated now. This guide covers what changed in 2026, which controls need Managed Environments and premium licenses, and a 90-day rollout plan for a mid-market tenant. Every product fact comes from Microsoft Learn, checked on November 2, 2026.

What Is Power Platform Governance?

It’s how you decide where people build, which connectors they can combine, who can share what, and how apps reach production. Done well, makers move fast inside guardrails. Done badly, IT either blocks everything or finds out about problems from auditors.

Think of it in five layers. Environments decide where things live. Data policies decide which connectors can talk to each other. Managed Environments add premium controls like sharing limits and solution checker enforcement. Inventory tells you what exists and who owns it. ALM, meaning pipelines and solutions, decides how anything reaches production.

People sit on top of all five. A Center of Excellence sounds grand, but at a 300-person company it can be one admin, one business sponsor, and a shared mailbox. Fine. The structure matters less than having someone whose job includes saying no, and saying yes quickly when the answer should be yes, because a governance team that takes three weeks to approve a connector request teaches every maker in the building to stop asking and start working around it.

What Changed in Power Platform Governance in 2026?

Five things. The CoE Starter Kit stopped being maintained, advanced connector policies arrived, Managed Environments got a licensing enforcement date, pipelines started requiring managed targets, and unmanaged developer environments face suspension on December 15, 2026.

Six dates. One product line. Most of them land on tenants that never asked for any of this, run by an IT team of three who found out about the February 2027 licensing block from a pop-up a user screenshotted and forwarded to the help desk with the subject line asking whether this was a phishing email.

Is the CoE Starter Kit Deprecated, and What Replaces It?

Not deprecated, but no longer actively maintained. It still installs and runs. It just won’t get new features, and Microsoft won’t review its issues. Its jobs now live in the Power Platform admin center under Inventory, Usage, Monitor, and Actions.

Microsoft’s CoE Starter Kit transition page spells this out, and it maps each kit scenario to a native admin center feature. That page went up in May 2026. A good chunk of the ranking advice on this topic predates it, which is why you’ll still see the kit described as a foundation to build on.

Our advice? If you installed the kit and your team actually reads its reports, leave it alone until the admin center covers the same ground for you. If you were about to install it fresh, don’t. Spend that week on the default environment instead.

What Are Managed Environments, and Do You Need Them?

Managed Environments are a premium switch you turn on per environment. It adds sharing limits, solution checker enforcement, usage insights, environment groups, routing, IP firewall, and more. The catch is that every active user in that environment then needs a premium license.

The Managed Environments overview on Learn calls it a suite of premium capabilities, and the feature list keeps growing. Long list. Sharing limits. Weekly usage insights. Maker welcome content. Solution checker enforcement. Environment groups and routing. IP firewall and IP cookie binding. Customer-managed keys, Lockbox, extended backup, and virtual network support.

Now the part that surprises people. Per Microsoft’s Managed Environments licensing page, all active usage in a managed environment requires a standalone license or a pay-as-you-go meter. Seeded Microsoft 365 rights don’t count. Admins started getting notices in March 2026, users started seeing in-app warnings in June, and from February 2027 unlicensed users can’t open apps in managed environments at all. Apps aren’t deleted. People just get locked out until somebody buys a license.

So do you need them? Depends where. For production environments that run real business processes, yes, and the users there are probably licensed already through Power Apps Premium or a Dynamics 365 license, which qualifies. For the default environment where 600 people built personal flows on Microsoft 365 rights, think hard first. Run the Users requiring licenses in Managed Environments report under Licensing in the admin center before you touch anything. Our guide on how Power Platform licensing works covers the SKUs and prices.

How Should a Mid-Market Company Set Up Its Environments?

Four tiers cover most mid-market tenants. A renamed default for personal productivity, routed personal developer environments, a shared dev and test tier, and production environments per business area. Group them, and let group rules hold the settings.

Environment groups are the piece that makes this manageable at scale. Microsoft’s environment groups documentation says a group holds only managed environments, one group per environment, no nesting. Rules you publish to a group lock those settings in every member environment. No exceptions per environment, which is either a feature or a headache depending on who’s asking.

Environment routing is the quiet hero here. According to Microsoft’s environment routing guide, it sends makers in Power Apps, Power Automate, and Copilot Studio to their own managed developer environment instead of the default one, and it comes preconfigured with sharing limited to five people. It’s off by default. Building and previewing there is free, but running what you build needs a premium license.

Which brings up the December deadline. Microsoft says unmanaged developer environments are suspended starting December 15, 2026. If you have a developer environment with something important in it, enable Managed Environments on it or move the work out this month.

One more decision belongs in this section, and it’s where the data lives. Business-critical apps belong in Dataverse inside a production environment, not in a SharePoint list in the default one. Our comparison of Dataverse vs SharePoint lists walks through when each holds up.

How Do You Secure the Default Environment?

Rename it, block new connectors by default, keep sharing with Everyone switched off, restrict custom connectors, and set tenant isolation. Every licensed user can build in the default environment, so this is where most governance problems start.

Start with Microsoft’s own guide to securing the default environment. Best checklist we know of. Short enough to finish in a week.

• Rename it to something like Personal Productivity. Free, takes a minute, and stops people treating it as the place real apps go.
• Write maker welcome content that says what’s allowed and who to ask.
• Share with Everyone should stay off. Everyone includes guests, which most people don’t realize.
• Set a data policy for the default with Blocked as the default group, so new connectors arrive blocked instead of allowed.
• Limit custom connectors to approved URLs.
• Email from flows? Exchange transport rules can read the x-ms-mail-application header and stop flows from mailing outside the company.
• Configure tenant isolation with an allowlist of partner tenants.
• Put admin roles behind Privileged Identity Management so nobody holds them permanently.

A blunt note on that list. Turning on Managed Environments for the default environment gives you sharing limits and welcome content there too, but it also puts every active maker in scope for premium licensing. In a Microsoft 365-heavy tenant that bill can dwarf everything else on this page. Price it before you decide. Plenty of the business process automation in Microsoft 365 that lives in the default environment runs fine on seeded rights today.

How Do Power Platform Data Policies Work?

Classic data policies sort connectors into Business, Non-business, and Blocked. An app or flow can’t mix Business and Non-business connectors, and Blocked ones can’t be used at all. Tenant policies always win over environment policies.

The mechanics are in the data policy documentation. A connector sits in exactly one group. New connectors land in Non-business unless you change the default. When policies overlap, the most restrictive one applies, and environment admins can’t loosen a tenant-wide policy. Data policies themselves don’t require Managed Environments, and Microsoft recommends covering every environment with one.

Two things trip teams up. Tightening a policy can break flows that already run, so check impact before you publish changes, and expect a few angry emails anyway. And some connectors, SharePoint and Office 365 Outlook among them, can’t be blocked under the classic model at all. Odd gap. For a data loss tool, especially.

What are advanced connector policies?

Advanced connector policies replace the three-bucket model with an allowlist. Everything is blocked by default, including connectors Microsoft releases next month, and you approve the ones you want. Per Microsoft’s advanced connector policies page, they apply to single environments or whole environment groups, they can block individual MCP servers, and on managed environments they can block any connector, SharePoint and Outlook included.

Our recommendation is mixed mode first. Run both side by side on one environment group, where the most restrictive answer wins, then switch to advanced policies alone once your allowlist has stopped changing every week. The MCP piece matters more than it looks. If makers are wiring agents to tools through something like the Dataverse MCP server, server-level blocking is how you approve one server without approving every server.

Desktop flows deserve their own policy review too. If your team runs RPA through Power Automate rather than a separate tool, our Power Automate vs UiPath comparison covers where desktop flow controls differ.

How Do You Find Orphaned Apps, Flows and Agents?

Open Inventory in the Power Platform admin center. It lists every app, flow, and agent across environments with owners, updates within about 15 minutes, exports to CSV, and lets admins block published agents and canvas apps directly.

Coverage is broad, per the Power Platform inventory page. Copilot Studio and Agent Builder agents. Canvas, model-driven, and code apps. Cloud flows and agent flows. Connectors are in preview. It replaced the main reason most teams installed the CoE Starter Kit in the first place.

One catch. The Owner column for flows shows whoever created the flow, and it doesn’t update when ownership changes. So filter by departed users, then check co-owners before you assume a flow is truly orphaned.

A monthly rhythm works. Export Inventory, filter on people who left, reassign or retire what you find, and block anything nobody claims within two weeks. We’d rather see a blocked flow cause one complaint than an unowned flow keep posting journal entries into Business Central for a year.

How Do You Govern Copilot Studio Agents in Power Platform?

The same way you govern apps, with two additions. Managed Environments sharing rules control who can edit or use an agent, and connector policies decide which tools and MCP servers agents can call. Agents also show up in Inventory.

Sharing rules for agents are specific. Microsoft’s sharing limits page says you can stop makers from granting Editor or Viewer access, block sharing with security groups, and cap the number of viewers. Existing access isn’t revoked when you change the rule, so set limits before agents spread, not after.

Budget is governance too. Every agent conversation burns Copilot Studio credits, so an agent that a well-meaning maker shared with all 2,000 employees instead of the 20 people in accounts payable can run up a bill nobody budgeted for before anyone notices it was shared at all. Ouch. Our Copilot Studio pricing guide covers how credits get consumed. For tenant-wide agent governance across Microsoft 365, Microsoft now sells Agent 365 as a separate control plane, which sits on top of these Power Platform controls rather than replacing them.

Do Power Platform Pipelines Require Managed Environments?

The target environments do. Since October 2026, admins get notified about unmanaged pipeline targets and have 30 days to enable Managed Environments, with one 30-day extension, before deployments to that target are blocked.

That’s from Microsoft’s pipelines admin documentation, which also offers an auto-conversion setting under Deployment settings. The development environment and the pipelines host don’t need to be managed. Production does. For governed deployments, set up a custom pipelines host rather than letting makers create personal pipelines, and use delegated deployments with a service principal for production so releases don’t depend on one person’s account.

Pipelines only move solutions, by the way. Loose apps can’t ride them. If your team is still deciding how to build, our comparison of canvas vs model-driven apps covers how each fits a solution-based release process.

Where Did the Power Platform Security Score Go?

Microsoft retired the preview Security Score on May 29, 2026. The Security page in the admin center stays, and its recommendations still work, but they can only be acted on in managed environments.

The retirement came through Microsoft 365 message center notice MC1310690, as reposted here. Confusingly, Microsoft’s Security overview page still describes the score. Trust the notice. Docs lag. Use the recommendations as a monthly to-do list and ignore any old screenshots with a Low, Medium, or High rating.

Which Governance Controls Need Managed Environments?

Data policies, tenant isolation, inventory, and renaming the default environment don’t. Sharing limits, solution checker enforcement, environment groups, routing, IP firewall, and pipeline targets do. Every row marked yes puts that environment’s users in scope for premium licensing.

A 90-Day Power Platform Governance Rollout

Days 1 to 30 are about seeing what you have and stopping the obvious leaks. Days 31 to 60 build structure. Days 61 to 90 turn it into a routine somebody owns. Most of the first month costs nothing extra in licenses.

First month. See it and stop the bleeding.

• Cut Power Platform admins to two or three people, behind Privileged Identity Management. Name one governance owner and one business sponsor.
• Export Inventory. Count apps, flows, and agents per environment, and flag anything owned by people who left.
• Run the Users requiring licenses in Managed Environments report before enabling anything.
• Rename the default environment and confirm Share with Everyone is off.
• Publish a tenant-wide baseline data policy with Blocked as the default group, plus a custom error message that tells makers who to email.
• Set tenant isolation with your partner allowlist.
• Find developer environments worth keeping and enable Managed Environments on them before December 15.
• List unmanaged pipeline targets and convert them.

Second month. Build the structure.

• Agree the environment tiers from the table above, with production environments split by business area, for example one for Finance and Dynamics 365 work.
• Create environment groups and publish rules. Solution checker on warn in dev, block in production.
• Turn on environment routing so new makers land in managed personal environments.
• Pilot advanced connector policies in mixed mode on one group, and block MCP servers nobody has reviewed.
• Set agent sharing rules for Copilot Studio.
• Move business-critical apps and flows out of the default environment into production through solutions.

Third month. Make it a habit.

• Stand up a custom pipelines host with delegated deployments for production.
• Add Exchange rules for flow email and turn on IP firewall in audit mode for production Dataverse environments.
• Book a monthly 30-minute review of Inventory, Security recommendations, and Actions.
• Switch stable groups to advanced connector policies only, keeping classic policies for custom and HTTP connectors.
• Confirm every user in a managed environment is licensed before February 2027.
• Publish a short maker hub page. Where to build, what’s allowed, how to request a connector or a production environment.

Don’t skip that last item. Most shadow IT is just people who couldn’t find out how to ask. Moving recurring work into proper flows is covered in our guide to automating business processes on Power Platform.

Is Heavy Governance Worth It for a Small Tenant?

Not all of it. A company with 40 makers needs a renamed default, a baseline data policy, a monthly inventory check, and managed production environments. Environment groups, routing, and advanced connector policies earn their keep as maker counts and data sensitivity grow.

Bias disclosed. We sell Power Platform governance work, so you’d expect us to recommend every control on this page. We won’t. Overbuilt governance has a cost too, and it shows up as makers quietly moving their work back into spreadsheets and personal OneDrive folders where nobody governs anything. Start with the first 30 days. Add structure when the inventory tells you it’s needed.

Wrapping Up

Power Platform governance in 2026 runs through the admin center, not the CoE Starter Kit. Data policies are turning into allowlists, Managed Environments carry a February 2027 licensing deadline, pipelines need managed targets, and unmanaged developer environments get suspended on December 15. Get visibility first, secure the default environment second, and add structure third.

ZapAI is a Microsoft Dynamics 365, Power Platform, Fabric, and AI consulting firm based in Irving, Texas, working with US businesses. Our Power Platform services team runs governance setups for tenants where Power Apps, Power Automate, and Copilot Studio grew faster than anyone planned, and our Copilot Studio team handles agent governance specifically. If you’re not sure what’s in your tenant or what Managed Environments would cost you, book a Power Platform governance assessment. We’ll export your inventory, size the licensing impact, and give you a 90-day plan. Curious what that kind of engagement involves first? Here’s what a Power Platform engagement looks like.

What Power Platform Admins Ask About Governance

Is the CoE Starter Kit still supported in 2026?

Do Managed Environments need a premium license for every user?

What happens in February 2027 if users aren’t licensed?

Can a data policy block SharePoint or Outlook connectors?

Should we turn on Managed Environments for the default environment?

Data policy vs advanced connector policy, which one do we use?

Do Power Platform pipelines need Managed Environments?