Use core components

These components provide the core to get started with setting up a Center of Excellence (CoE). They sync all your resources into tables and build admin apps on top of that to help you get more visibility of the apps, flows, and makers in your environment. Additionally, apps like the Set App Permissions help with daily admin tasks. The core components solution contains assets relevant only to admins. More information: Set up core components and Watch how to use the core components solution.

What's in the solution

Here's a breakdown of the assets that form the core components:

• Catalog tenant resources
  • Microsoft Dataverse tables: Environments, apps, flows, and more
  • Admin | Sync Template v3 (flows): All apps, cloud and desktop flows, cloud flow action details, custom connectors, connectors, model-driven apps, shared-with information, chatbots.
  • Admin | Welcome email
  • Power BI dashboard
  • Power Platform Admin View (model-driven app)
• Bulk change permissions for apps and flow
  • Set App Permissions (canvas app)
  • Set Flow Permissions (canvas app)
  • App Catalog

Tables

The sync flows of the CoE Starter Kit sync your tenant resources to the following Dataverse tables. All tables provide information about created by/on and modified by/on, in addition to resource-specific information.

• Environment represents the Environment object, which contains apps, flows, and connectors. The following information is available for each environment:

  • Environment ID
  • Display name
  • Dataverse instance URL
  • Created on
  • Environment maker (created by)
  • Region
  • Type (trial, developer, production)
  • Number of apps (rollup)
  • Number of flows (rollup)
  • Number of custom connectors (rollup)
  • Environment Owner (if environments are created by admins, manually store owner here)
  • Business Area
  • Approved Capacity

• PowerApps App represents an app. The following information is available for each app:

  • Display name
  • App ID
  • Environment
  • Owner
  • Created on
  • Modified on
  • Published on
  • Last launched on (if collecting audit log information is configured)
  • App plan classification (standard, premium, extended)
  • Shared users
  • Shared groups
  • Shared with tenant (yes/no)
  • App type (canvas, model-driven, SharePoint form app)
  • App orphaned
  • Excused from archival

• Flow represents a cloud flow. The following information is available for each cloud flow:

  • Display name
  • Flow ID
  • Environment
  • Owner
  • Created on
  • Modified on
  • State (started, suspended, stopped)
  • Flow orphaned
  • Flow trigger
  • Excused from archival

• Flow Action Detail represents the set of actions that occur in a cloud flow. This table has a many-to-one link with the Flow table. The following information is available for each action or trigger:

  • Type (scope, for each, Microsoft 365 users)
  • Operation (for connectors, such as Send Email and List Items)
  • Is trigger (yes/no)

• PowerApps Connector represents a standard or custom connector. The following information is available for each connector:

  • Connector ID
  • Display name
  • Icon background color and URI
  • Is custom connector (yes/no)
  • Maker (for custom connectors)
  • Publisher
  • Tier (standard/premium)

• Power Apps Portal represents a Power Apps portal. The following information is available for each portal:

  • Portal Website ID
  • Portal Website Name
  • Portal Website Record Status
  • Environment
  • Owner
  • Created on
  • Modified on
  • Portal is orphaned

• Connection Reference The linking table for the many-to-many relationships among connectors (PowerApps Connector) and cloud flows (Flows) or apps (PowerApps App).

• Maker represents a user who has created an app, flow, custom connector, or environment. The following information is available for each maker (retrieved from Microsoft 365 Users profiles):

  • Display name
  • ID
  • Email (user principal name)
  • City
  • Country
  • Department
  • Job title
  • Office
  • Number of apps (rollup)
  • Number of flows (rollup)

• Audit Log represents session details for Power Apps. The following information is available for each audit log entry:

  • Operation (launched app, deleted app, deleted flow)
  • App/cloud flow ID
  • User city, country, department, job title (from Microsoft 365)
  • Audit log event time

• Power Platform User represents who an app is shared with. The following information is available for each user:

  • Display name
  • ID
  • Group size (for users, this is set to 1; for groups, this is the group size according to Azure Active Directory)
  • Type (user, group, tenant)
  • User principal name (for users)

• Power Platform User Role represents the role a Microsoft Power Platform user has for a specific app. This has a one-to-many relationship with the Power Platform User and PowerApps App tables. The following information is available for each role:

  • App
  • Microsoft Power Platform user
  • Role name (Owner, CanEdit, CanView)
  • Friendly role name (Owner, Co-Owner, Viewer)

• PVA represents a bot in Power Virtual Agents. The following information is available for each bot:

  • Display name
  • ID
  • Created on
  • Owner
  • Modified on
  • Last launched on
  • Total number of sessions
  • Number of components (rollup)
  • Number of flows (rollup)
  • Status
  • Environment
  • Is bot orphaned (yes/no)

• PVA Component represents a Power Virtual Agents component, such as a topic. The following information is available for each bot component:

  • Name
  • ID
  • Component created on
  • Description
  • Display name
  • Environment
  • Modified on
  • State
  • Type (topic, table)
  • Uses flow (yes/no)

• PVA Component Flow represents a flow triggered as part of Power Virtual Agents. The following information is available for each bot component flow:

  • Name
  • ID
  • Created on/by

• RPA represents a desktop flow. The following information is available for each desktop flow:

  • Display name
  • ID
  • Created on
  • Owner
  • Modified on
  • Desktop flow type (Power Automate Desktop, Selenium IDE)
  • Status
  • Environment
  • Is desktop flow orphaned (yes/no)

• RPA Session represents a desktop flow session. The following information is available for each bot:

  • ID
  • Desktop Flow
  • Status Code
  • Started On
  • Completed On
  • Error Code
  • Error Message

• Environment Capacity stores capacity information for an environment

  • Capacity Type (File, Database, Log)
  • Unit (GB, MB)
  • Actual Consumption
  • Rated Consumption (takes into account minimum capacity reservation required for the particular environment type)

• Environment Add Ons stores add-on information for an environment

  • Add On Type (Per App Pass, AI Builder Consumption)
  • Unit (MB, Logins)
  • Allocation

• Environment Business Area represents the owning business area of an environment, if cross-charging is required

  • Area Name
  • Cost Code
  • Area Lead

Additional to the above listed inventory tables, the following helper tables support application functionality:

• Sync Flow Errors represents the daily occurrence of sync flow errors to provide a summary email to an admin. The following information is available for each sync flow error:

  • Flow instance URL
  • Environment
  • Created on

• Archive Approval stores information on archive requests that have been sent to makers for apps and flows.

• Environment Creation Request represents a request submitted by non-admins to create a new Environment. This has a many-to-many relationship with the Maker and PowerApps Connector tables. The following is available for each request:

  • Approval Date
  • Approval Email
  • Created By (used as Requestor)
  • Database Currency
  • Database Language
  • Database Security Group ID
  • Duration Requested
  • Environment
  • Environment Display Name
  • Environment Region
  • Environment Type
  • Expiration Date
  • Has Database
  • Has Expiration Date
  • Justification
  • Notes
  • Request No
  • Request Status (pending, approved, rejected, fulfilled, live, expired, cancelled, failed)

• DLP Policy Change Request represents a request to change the definition of an existing DLP policy in the tenant. The following is available for each request:

  • Action Requested (Add Environment to Policy, Remove Environment from Policy)
  • Created By (used as Requestor)
  • Environment Creation Request
  • Policy ID
  • Request No
  • Request Status

Security roles

• Power Platform Admin SR Gives full access to create, read, write, and delete operations on the custom tables.

• Power Platform Maker SR Gives read and write access to the custom tables (environments, apps, and so on).

• Power Platform User SR Gives read-only access to the resources in the custom tables.

Flows

Admin | Compliance Detail request v3

This flow works in conjunction with other apps and flows in the CoE Starter Kit to facilitate the process described in App auditing process. Compliance detail request emails are sent for apps and chatbots.

This flow sends an email to users who have apps in the tenant that aren't compliant with the following thresholds:

• The app is shared with more than 20 users or at least one group, and no business justification details have been provided for it.

• The app does have business justification details, but hasn't been published in 60 days (so it's likely not on the latest version of Power Apps) or is missing a description.

• The app has business justification details and an indication of high business impact, but no mitigation plan has been submitted to the attachments field.

This flow sends an email to users who have chatbots in the tenant that aren't compliant with the following thresholds:

• The chatbot has been launched more than 50 times, and no business justification details have been provided for it.

• The chatbot has business justification details and an indication of high business impact, but no mitigation plan has been submitted to the attachments field.

You can customize the criteria for when makers are asked to provide a business justification using environment variables. Default values are provided.

You can customize the email sent out by the flow; by default, it will look like the following image.

Apps

Admin - Command Center

A canvas app used by admins as a starting point to launch other apps in the CoE Starter Kit and review content relevant to admins.

Use this app to:

• Launch CoE Starter Kit apps and other bookmarks.
• Review CoE Starter Kit service health by checking sync flows that have recently failed.
• Update environment variables used in the CoE Starter Kit.
• View Microsoft 365 Message Center news related to Microsoft Power Platform.
• Download the latest CoE Starter Kit version and raise support tickets with the team.
• Launch Microsoft Learn learning paths to learn more about Microsoft Power Platform.
• Launch the latest posts of the Power Apps, Power Automate, Power BI and Power Virtual Agent blogs.
• Configure email subject and body text for emails send through the CoE Starter Kit.

Permission: Intended to be used only by admins. Power Platform Service Admin or Global Admin permission is required. Share this app with your CoE Admins.

Prerequisite: This app uses Microsoft Dataverse. If you have installed this solution in a Production environment, a Premium license is required for every app user. If you have installed this solution in a Dataverse for Teams environment, a Microsoft 365 license is required for every user.

Configurable emails

Use the Admin - Command Center app to configure subject and body texts for emails send by the CoE Starter Kit.

1. Open the Admin - Command Center app and select the email icon in the navigation.

2. Default email body and subject texts are provided. You can edit the email body and subject, which will change the Default Body and Default Subject properties to No. This means that running the Admin | Sync Template V3 Configure Emails flow that sets the default body and subject will not update those records, and your modified text will continue to be used in these emails.

3. Optionally, configure the below for your email:

   1. CC: this will add the user or group to the CC line of the mail.
   2. ReplyTo: this will add the user or group to the Reply To Property for the mail.
   3. Send on Behalf: this will add the person or group to the From (Send as) property for the mail.

   Note

   These properties are reliant on your mailbox permissions, and relevant Exchange properties being configured.

4. You can store localized versions of each mail. If the user has a preferred language set in their Office 365 User profile, mails will be sent in the localized version. If no localized version is found for a language, the default english text is sent. Designate the language with the ISO Language Code: Language Code Table (lingoes.net). Emails are formatted as html, be careful when changing the text so as to not overwrite html tags.

DLP Editor v2

DLP Editor v2 is a canvas app that reads and updates data loss prevention (DLP) policies while showing a list of apps and flows that are impacted by the policy configurations.

Use this app to:

• Make changes to DLP policies.
• See what impact each change will have.
• Mitigate the risk by contacting makers.

More information: Data Loss Prevention policies

Permission: Intended to be used only by admins. Power Platform Service Admin or Global Admin permission is required. Share this app with your CoE admins.

App Catalog

A canvas app that helps give visibility to certain apps in the organization. Admins can choose which apps to highlight in the app catalog if the app meets admin requirements and is meant to be shared broadly.

When you first open the app catalog, you won't see any apps there. There's a field on the Power Apps App table called In App Catalog, which is a two-option set type field (Boolean). If the value is set to Yes, the app will show up in the catalog. To publish an app to the app catalog, follow the app auditing process in the Power Platform Admin View app.

Permission: As soon as you're using this process, you can share the app catalog with the entire organization.

Prerequisite: This app uses Microsoft Dataverse. If you have installed this solution in a Production environment, a Premium license is required for every app user. If you have installed this solution in a Dataverse for Teams environment, a Microsoft 365 license is required for every user.

Set App Permissions

Set App Permissions is a canvas app that an admin can use to discover apps by app name, environment, or owner name, and to change app permissions.

Use this app to:

• Set a new app owner.
• Add new viewers and editors.
• Remove app permissions.
• Change app permissions from editors to viewers or viewers to editors.

You can also use this app to find apps that have been orphaned by the owner's having left your organization, and clean them up. More information: Share a canvas app in Power Apps

Permission: This app is intended to be used only by admins. Microsoft Power Platform Service Admin or Global Admin permission is required. Share this app with your CoE admins.

Set Flow Permissions

Similar to Set App Permissions, Set Flow Permissions is a canvas app that admins can use to discover flows by flow name, environment, or owner name.

Use this app to:

• Add new viewers and editors.
• Remove flow permissions.

Note that the ownership of a flow can't be changed.

You can also use this app to find flows that have been orphaned by the owner's having left your organization, and clean them up. More information: Share a flow

Permission: This app is intended to be used only by admins. Microsoft Power Platform Service Admin or Global Admin permission is required. Share this app with your CoE admins.

Power Platform Admin View

Power Platform Admin View is a model-driven app that provides an interface used to browse items in Dataverse custom tables. It provides access to views and forms for the custom tables in the solution.

Use this app to:

• Get a quick overview of resources in your tenant.
• Learn about your makers, connectors, apps, and flows.
• Find out who apps are shared with.
• Add additional information, such as notes and risk assessments, to your resources.
• Set approved capacity for environments, and see capacity and add-on information per environment.
• Complete app audits.

Permission: This app is intended to be used only by admins. Power Platform Service Admin or Global Admin permission is required. Share this app with your CoE admins.

You can use this app to see who an app is shared with, what roles (editor or viewer) the users have, and—for groups—what the size of the group is, all in a quick glance.

You can use this app to see Microsoft Teams environments.

Admin - Power Platform Resource RMS (Request Management System)

A canvas app used by admins as an interface to view and approve or reject requests to create or modify Power Platform development resources. Supports Environment Creation Requests and changes to DLP Policies are logged in the DLP Policy Change Request table.

Use this app to:

• View all Environment Creation Requests in detail.
• Approve or reject Environment Creation Requests.
• View if connectors will be blocked or restricted by existing or modified DLP Policies. Modifications made in the app will update those Policies.

Permission: Intended to be used only by admins. Power Platform Service Admin or Global Admin permission is required. Share this app with your CoE Admins.

Prerequisite: This app uses Microsoft Dataverse. If you have installed this solution in a Production environment, a Premium license is required for every app user. If you have installed this solution in a Dataverse for Teams environment, a Microsoft 365 license is required for every user.

Power Platform Request Center

A canvas app designed to easily submit requests for Power Platform resources (such as Environment Creation Requests).

Use this app to:

• Submit new Environment Creation Requests.
• View existing requests in any state that was submitted by that user. Expiration timeline and link to the Live environments can be found here.

Permission: As soon as you're using this process, you can share the app with all authorized Makers or the entire organization, depending on which users you want to allow Environment ownership. Requires the Power Platform Maker SR (security role) to use the Dataverse tables.

Prerequisite: This app uses Microsoft Dataverse. If you have installed this solution in a Production environment, a Premium license is required for every app user. If you have installed this solution in a Dataverse for Teams environment, a Microsoft 365 license is required for every user.

Power BI report

With Power BI reports, you can get a holistic view of Dataverse data with visualizations and insights for Environment, PowerApps App, Flow, Connector, Connection Reference, Maker, and Audit Log tables.

Follow the setup instructions to set up the Power BI dashboard. More information: Gain deep insights into your Microsoft Power Platform adoption with the CoE Power BI dashboard