#PowerPlatformTip 56: 'Empowering Tools in CoE'

TL;DR: In the CoE Starter Kit, the Manage Permissions app changes app and flow ownership, security roles and connections, and Power Platform Admin View shows who an app is shared with. The weekly Orphaned Makers cleanup flow marks resources of people who left, and the governance flows Request Orphaned Objects Reassigned ask their manager what to do with them. Microsoft no longer actively maintains the kit; for new setups, start with the Power Platform admin center.

💡 Challenge

It is hard to see who has access to which flow or app, and when people leave the company, their apps and flows stay behind without an owner. Nobody notices until something breaks.

✅ Solution

Use the permission and orphan tools of the CoE Starter Kit: the admin apps of the core components for visibility and permission changes, and the orphan cleanup flows of the governance components to route ownerless resources to the right manager.

🔧 How It’s Done

1. Check the prerequisites.

🔸 The core components are installed in a dedicated environment and the inventory sync flows run, so the kit’s Dataverse tables contain your environments, apps, flows and makers.

🔸 The admin apps are intended for admins only (Power Platform administrator or an account with admin permissions). Share them with your CoE admins, not with makers.

🔸 The apps use Dataverse and premium connectors, so every admin who uses them needs a premium license.

2. See who has access.

🔸 Open Power Platform Admin View and open an app to see with whom it is shared: users, their role (editor or viewer) and groups, including the size of a group.

🔸 For flows and apps, select Manage Permissions in the command bar to change the permissions of an individual resource.

3. Change ownership and permissions in bulk.

🔸 The Manage Permissions app changes canvas app ownership, cloud flow ownership, security roles in your environments, and connections across the tenant. In earlier kit versions this was split into the separate Set App Permissions and Set Flow Permissions apps.

4. Detect orphaned resources.

🔸 The core flow **CLEANUP - Admin

Sync Template v3 (Orphaned Makers)** runs weekly. If a maker can’t be found in Microsoft Entra ID / Office 365 Users any more, their apps, cloud flows, desktop flows, environments and chatbots are marked as orphaned.

5. Send orphaned resources to the manager.

🔸 Install the governance components and turn on Request Orphaned Objects Reassigned (Parent) and (Child). The parent flow associates orphaned objects with the manager of the former owner and sends that manager a Teams bot message. The child flow lets the manager take ownership, delete the objects, assign them to someone else, or decide item by item.

🔸 Objects without a resolvable manager go as a list to the admin email for manual cleanup.

🎉 Result

You see who can access your apps and flows, change ownership in one place, and orphaned resources reach a person who can decide about them instead of running unnoticed.

🌟 Key Advantages

🔸 Visibility: sharing per app, including group sizes.

🔸 One place for permissions: ownership, security roles and connections in the Manage Permissions app.

🔸 Automatic orphan handling: detection weekly, decision by the manager.

⚠️ Good to Know

🔸 The CoE Starter Kit is no longer actively maintained. Its core capabilities are part of the Power Platform admin center, issues are no longer reviewed, and the admin center’s Actions page helps to govern environments, apps and flows. For a new governance setup, start in the admin center and use the kit only for gaps.

🔸 The orphan cleanup flows post adaptive cards to Teams and do not work in GCC High and DoD.

🛠️ FAQ

1. What is the CoE Starter Kit?

A collection of solutions with Dataverse tables, flows and apps that inventories your Power Platform tenant and supports governance processes such as compliance, inactivity and orphan cleanup.

2. Where are the “Set Flow Permissions” and “Set Apps Permissions” tools?

Their functions are in the Manage Permissions app of the core components, and individual resources can be changed from Power Platform Admin View via Manage Permissions in the command bar.

3. How does the orphan handling work?

The weekly Orphaned Makers flow marks resources of makers who no longer exist in the directory. Request Orphaned Objects Reassigned then sends the former owner’s manager a Teams message, and the manager takes over, reassigns or deletes the objects.

🔗 Related Tips

🔸 #PowerPlatformTip 2: ‘Transfer PowerApp Ownership’ - the manual admin steps to run once orphan detection flags an app.

🔸 #PowerPlatformTip 48: ‘Sharing of Flows and Power Apps’ - set up collaborator access so a single departure doesn’t create an orphan in the first place.

🔸 #PowerPlatformTip 20: ‘Change Flow-Owner’ - change the owner of a single flow by hand.