What a Gauge Readout Looks Like
Sample deliverable · Power Platform Health & Governance Gauge · focused tier
Every IMP0WER assessment ends in a readout: a written report and a working session where your team pressure-tests it. This page is a condensed sample of that report for Contoso, a fictional 900-seat regional insurer, so you can judge the deliverable before you pay for it. The names, counts, and findings are invented for illustration. The structure, the depth, and the candor are exactly what a real Gauge produces.
The engagement at a glance
- Client: Contoso (fictional), regional insurer, about 900 Microsoft 365 seats
- Tier: Focused, $3,500, two weeks
- Scope: three environments, every app and flow in them, DLP and connector policy, ownership, lifecycle
- Inputs: tenant admin read access, admin-center exports, two working sessions with the IT owner and the finance operations lead
- Method: the Gauge stage of the IMP0WER GRID, scored against the Ø Standard
- Outputs: estate workbook, this findings report, the 90-day roadmap, and the readout workshop
Executive summary
Contoso's Power Platform estate is productive and ungoverned. Ninety-six makers have built 214 apps and 388 flows across three environments, and the business quietly depends on a dozen of them: invoice intake, claims approvals, vendor onboarding, and the month-end close all run through Power Automate today. Nobody had a list of those twelve before this engagement.
The risk concentrates in three places. First, the flows that matter most run on the personal credentials of five people, two of whom have changed roles since the flows were built. Second, the Default environment is production for finance work, with one tenant-wide DLP policy from 2022 that leaves HTTP and custom connectors unclassified. Third, there is no path from development to production: edits go live the moment they are saved, and 210 of the 214 apps sit outside solutions, so nothing can be moved, versioned, or rolled back cleanly.
None of this argues for shutting the platform down. It argues for three fixes, sequenced over ninety days, none of which slow the makers down.
The good news is that the estate is smaller and more concentrated than it looks. Nineteen percent of items have no active owner, but only 23 of those are in real use. The DLP fix is a policy split, not a rebuild. And the twelve critical flows can move to service identities in a week of focused work. Contoso does not need a governance program before it needs those three fixes; it needs the fixes, then the habits that keep them fixed.
Estate inventory
The estate workbook lists every environment, app, flow, owner, connector, and usage signal. This is its summary page.
| Environment | Apps | Flows | Makers | No active owner | Critical, on personal credentials |
|---|---|---|---|---|---|
| Default (everyone) | 171 | 302 | 96 | 101 | 9 |
| Contoso Prod (created 2024, no DLP of its own) | 29 | 61 | 11 | 8 | 3 |
| Sandbox-Finance (a personal environment promoted to production use) | 14 | 25 | 4 | 5 | 0 |
Two patterns jump out of the workbook. The Default environment is doing three jobs at once: personal productivity, departmental apps, and finance production, with a single policy governing all three. And "Sandbox-Finance" tells its own story: an environment created for experimentation that now runs the month-end close, because nobody drew the line between trying and relying.
Risk register
Ten risks are scored in the full report by likelihood and impact. These are the top six; the remaining four are lower-severity hygiene items.
| # | Finding | Evidence | Severity |
|---|---|---|---|
| 1 | Twelve business-critical flows run on personal credentials | Connection owners include two people who have changed roles; a password reset would stop invoice intake | High |
| 2 | Finance production runs in the Default environment | Invoice Intake, Vendor Onboarding, and the close flows share an environment with 96 makers' experiments | High |
| 3 | HTTP and custom connectors are unclassified in DLP | Data can move from SharePoint and Dataverse to any external endpoint without a policy stopping it | High |
| 4 | 114 items have no active owner; 23 are in regular use | Owner accounts disabled or departed; nobody is accountable when they fail | Medium-high |
| 5 | No Dev/Test/Prod path; 210 of 214 apps outside solutions | Edits publish directly; no versioning, no rollback, no way to promote safely | Medium |
| 6 | No monitoring or exception handling on critical flows | Failures are discovered by the people waiting on the output, days later | Medium |
Ø Standard gap check
Our published bar for production-ready work is seven checks. Contoso's critical estate passes one of them today, which is typical for an estate that grew without a standard, and the gap is what the roadmap closes.
| Check | Contoso today | Gap |
|---|---|---|
| Ø orphans | Fail | 114 items without an active owner; no successor path anywhere |
| Ø personal credentials | Fail | 12 critical flows on individual accounts |
| Ø mystery access | Fail | Connector permissions unaudited; no least-privilege review |
| Ø prod-only | Fail | No Dev/Test/Prod path; nothing in solutions |
| Ø undocumented handoffs | Fail | No documentation a stranger could operate from |
| Ø silent failures | Fail | No monitoring; exception handling on a handful of flows |
| Ø dead ends | Pass, partly | An IT helpdesk queue exists for app issues, though nobody owns fixes |
DLP and connector risk matrix
The full matrix classifies every connector in use. This excerpt shows where the policy split needs to happen.
| Connector | In use by | Classified today | Recommended | Why |
|---|---|---|---|---|
| SharePoint, Outlook, Teams | Nearly everything | Business | Business | The core of the estate; keep it together |
| Dataverse | 31 apps and flows | Business | Business | Finance data lives here; keep it with the core |
| HTTP | 17 flows | Unclassified (defaults to Business) | Blocked in Default, Business in Prod | Open door to external endpoints from the finance data group |
| Custom connectors (4) | 6 flows | Unclassified | Blocked in Default, reviewed per connector in Prod | Two call vendor APIs with credentials stored in the flow |
| SQL Server | 3 apps | Business | Non-business in Default, Business in Prod | Legacy claims database; experiments should not reach it |
| Personal storage (consumer file services) | 9 flows | Business | Blocked | Company data syncing to personal accounts |
The 90-day roadmap
The roadmap is sequenced so each wave reduces risk on its own and makes the next wave easier. Effort is stated as ranges in the full report; the shape is what matters here.
Days 0–30: stabilize.
Move the twelve critical flows to service identities. Split the DLP policy so HTTP, custom, and personal-storage connectors are blocked in Default. Open a two-week claim window for the 114 unowned items, reassign what is claimed, archive the rest. Stand up the ownership register in the estate workbook.
Days 31–60: structure.
Define what each environment is for: Default for personal productivity, Prod for the business, a Test environment beside it, and developer environments per team. Put the nine business-critical apps into solutions with a Dev/Test/Prod path. Add an intake step so new production work starts in the right place.
Days 61–90: operate.
Add monitoring and exception handling to every critical flow, with a named responder. Feed the inventory into a recurring review so the workbook stays true. Run maker enablement against the Ø Standard checklist so the next 200 apps are built to the bar, not retrofitted to it.
What the readout asks you to decide
A Gauge report ends with decisions, not homework. For Contoso, three:
- Identity for critical automation. Service accounts are fast and familiar; application identities are more secure and more work. The report recommends service accounts for wave one and application identities for the flows that touch the claims database.
- What Default is for. Locking it down protects finance but stalls the makers who make the platform worth having. The report recommends keeping Default open for personal productivity and moving production work out of it, which is what the DLP split and the environment strategy achieve together.
- Who runs governance after the project. Someone reads the meters and answers the calls. The report lays out the internal option, the managed option, and the Center of Excellence shape that fits a 900-seat organization, without recommending the one that happens to be ours.
What the extended tier would have added
For an estate like Contoso's, the extended tier's stakeholder interviews would have surfaced the departmental apps the exports cannot see the value of, the ALM and environment architecture review would have turned wave two into a design rather than a direction, and the CoE readiness plan would have answered the third decision in detail. Focused tells you what is true and what to do first. Extended tells you how to build the operating model around it.
Everything on this page is illustrative. Contoso is fictional, the counts are invented, and no real client's data appears here or anywhere on this site. What is real is the shape of the work: measure first, rank by evidence, sequence the fixes, and hand you a plan that works whether or not you hire us to execute it.