Apps & Automation
From the field archive · Learned in 2023
Answering a Low-Code Platform RFP: Lessons From Utility Pursuits
How I structure answers, run a proof of technology with a partner, and handle the governance, security, and AI questions that now show up in every platform RFP.
In mid-2023 a utility released an RFP for an enterprise low-code platform, and I raised my hand to lead our technical response so we could finish it faster. A systems integrator partner joined us soon after. A year later, a second utility sent an RFP for process intelligence. Both taught me that a platform RFP isn't a feature checklist. It's a test of whether you can explain how the platform will be run safely for years.
This post covers how I organize the team, structure answers, run a proof of technology, and handle the sections that decide these evaluations: governance, security, and AI-guided workflows. I won't share anything specific to either customer. The patterns are what matter.
Several answers I wrote then would read differently now. Power Virtual Agents became part of Microsoft Copilot Studio in November 2023, and Copilot Studio now builds agents and workflows on different "harnesses." Managed Environments have grown into a broad set of governance features, and Learn notes that unmanaged developer environments are deprecated, with a December 15, 2026 deadline to enable Managed Environments on ones you keep. Process mining in Power Automate now has a process intelligence experience with customizable dashboards. Learn now uses "data policies" for what we used to call DLP policies. Re-pull every boilerplate answer from current docs before you reuse it.
01Set up the response like a project
RFP windows are short and questions arrive in hundreds. Here's how I approach it in the first 48 hours.
Own it
- Name one technical lead
- Create a shared workspace with clear folders: customer documents, working drafts, submitted
- Lock down sharing to named people
Split it
- Build a tracker: question, owner, status, source
- Tag each question by category (see section 03)
- Send clarifying questions before the deadline
Run it
- Short daily touch base while the work is heavy
- Reduce the cadence once it settles
- One reviewer for tone and consistency
In the first utility pursuit we started with a daily touch base across our team and the partner. A few weeks in, the group agreed the calls had become too frequent and moved to a lighter cadence. That was the right call. The early days need daily coordination. Later, a tracker and async updates work better. In my experience, adjust the cadence on purpose rather than letting calls drift.
02A structure for every answer
Evaluators read hundreds of answers. Make theirs easy. I use the same four-part pattern for almost every response.
| Part | What goes in it |
|---|---|
| 1. Direct answer | Yes, No, Partially, or Via partner or add-on. First sentence. No hedging. |
| 2. How | Two to four sentences on how it works, using product names exactly as they appear in current docs. |
| 3. Evidence | The public Microsoft Learn article title, or a note that it's shown in the proof of technology. |
| 4. Assumptions | Licensing, configuration, or scope assumptions the answer depends on. |
The fourth part saves you later. If an answer depends on a specific environment setting or an add-on, say so in the response. Don't leave it for the contract stage.
Answer first, explain second, prove third. And only cite what's publicly documented today. Never answer with a roadmap item.
03The question categories to expect
Across both utilities and an earlier low-code RFI, the questions fell into the same buckets. I now pre-build a short, sourced answer bank for each.
| Category | What they're really asking |
|---|---|
| Architecture and tenancy | How is our data separated from other customers? One tenant or many? |
| Identity and access | How do users sign in, and how is access controlled by role? |
| Data protection | Residency, encryption, keys, Microsoft access to data. |
| Governance and ALM | Who can build, where, and how changes reach production. |
| Integration | APIs, connectors, on-premises systems, network controls. |
| Field and mobile | Offline use, devices, GIS and work order scenarios. |
| AI and automation | Where AI is used, who stays in control, how it's governed. |
| Scale and operations | Limits, monitoring, support model, adoption. |
In a 2022 low-code RFI for a manufacturer, a colleague and I first read a tenancy question as "single tenant or multi-tenant for your apps?" and answered with a recommendation to stay in one tenant for integration with the rest of Microsoft 365. On review we realized it was really about how the cloud service separates customers' data. Today I'd answer with Learn's current wording: Power Platform runs on Azure as a multitenant service, and logical isolation keeps each customer's data separate. Then I'd add tenant isolation and customer-managed keys as controls the customer owns. Read the question twice before you answer it once.
04Running a proof of technology
Most platform RFPs now include a scripted demo, often called a proof of technology. The customer sends use cases and a script. You build, then show each step live.
- Map every script line to a status: out of the box, configuration, low-code build, partner build, or not supported. Share that map internally on day one.
- Test connections first. When the customer provides test credentials or an API, confirm it works before anyone builds screens on top of it.
- Handle credentials properly. Use the secure channel the customer specifies. Never paste secrets into email threads or shared documents.
- Manage access deliberately. Partner team members need accounts in the demo environment. Track who has access and remove it at the end.
- Show limits honestly. If a script line goes beyond documented capability, say so and show the supported alternative.
In the first utility's proof of technology, one use case was offline work for field engineers. The script went well beyond forms: local storage, files tied to work orders, conflict handling, map and GIS layers offline. We mapped each line against documented offline capabilities and flagged the items that belonged to other products. I'd rather show an honest map than a stretched demo. I wrote up the offline lessons separately in Power Apps Offline: What Works and What to Plan For.
05Governance and security sections
For utilities, this is where evaluations are won or lost. Evaluators want to know the platform can be opened to many makers without losing control. I structure the section in layers and cite a Learn article for each.
Where things live
Environment strategy, environment groups, and default environment routing so makers land in the right place.
What can connect
Connector classification and data policies, plus tenant isolation for cross-tenant connections.
How it's run
Limit sharing, usage insights, pipelines, solution checker, IP firewall, CMK, and Lockbox.
Who sees what
Security roles, teams, business units, column security, and data masking.
I also describe the operating model, not just features: who approves new environments, how a maker's app moves to production, and how inventory and usage are monitored. My posts on environment strategy and DLP and the governance toolbox are the long versions of what I put in these sections.
Features answer "can it?" The operating model answers "will it stay safe?" Utilities score the second question higher.
06AI-guided workflow questions
In 2023 the AI questions were mostly "do you have a chatbot?" By late 2024, the second utility's RFP asked how AI would help analyze and improve processes like procurement, payables, and work orders. Today, nearly every RFP asks about agents. I answer these in four parts.
- Where AI is used. Name the capability. For example, process mining in Power Automate to discover how a process really runs from event logs, and Copilot Studio agents to guide users through steps.
- Who stays in control. Show the human approval points. An agent can draft or recommend. A person approves anything that commits money, changes a customer record, or touches safety.
- How it's governed. Agents follow the same environments, data policies, and authentication settings as everything else. Point to Copilot Studio's security and governance docs.
- How you'll measure it. Baseline the process first, then compare. Process mining makes that baseline concrete.
The second utility's questions covered integration, scalability, compliance, and specific AI use cases for the processes they wanted to analyze. In my experience the strongest answers start with their process, not our product: what event data each process needs, how it gets connected, and where people act on the insight. Any improvement you describe at that stage is only a hypothesis until you see real data, so say so.
07Working with an SI partner
When a systems integrator partner co-responds, agree the split early. Here's the one I use.
| Area | Platform team | SI partner |
|---|---|---|
| Platform capabilities and limits | Owns | Reviews |
| Security, compliance, data protection | Owns | Reviews |
| Solution design and use case builds | Advises | Owns |
| Implementation approach and team | Advises | Owns |
| Proof of technology | Co-owns | Co-owns |
Route questions to the right owner fast. When I hit a question I couldn't answer from docs, I sent it to the right specialist the same day with the exact wording. Then one person edits everything into a single voice before submission.
08Response checklist
- One technical lead, a locked-down workspace, and a tracker with owners and status.
- Every question tagged by category, with clarifying questions sent before the deadline.
- Every answer follows: direct answer, how, evidence, assumptions.
- Every product name and behavior checked against current Microsoft Learn. No roadmap items.
- Proof of technology script mapped line by line to a support status.
- Test connections verified early; credentials handled only through the customer's secure channel.
- Governance section covers features and the operating model.
- AI answers name the capability, the human control point, the governance, and the measure.
- Platform and partner responsibilities agreed and reflected in the response.
- No pricing details outside the commercial section the customer specified.
Where I'd start
Before the next RFP arrives, build your answer bank. Take the eight categories above and write one short, sourced answer for each, using current Learn articles. Add a one-page governance operating model and a reusable proof-of-technology tracker. When the RFP lands, you'll spend your time on the customer's real use cases instead of rewriting the basics.
Happy to go deeper on any of this.
— K.G
Sources
- Microsoft Learn: Establish data protection and privacy controls (Power Platform guidance)
- Microsoft Learn: Microsoft Power Platform security and governance documentation; Security in Microsoft Dataverse
- Microsoft Learn: Managed environments overview
- Microsoft Learn: Data policies; Cross-tenant inbound and outbound restrictions
- Microsoft Learn: Overview of process mining in Power Automate; Overview of process mining and task mining in Power Automate; Process intelligence experience overview
- Microsoft Learn: Copilot Studio overview; Copilot Studio security and governance
- Microsoft Learn: Mobile offline limitations for canvas apps
- Microsoft Copilot Blog: Microsoft Power Virtual Agents, now part of Microsoft Copilot Studio (November 2023)
Get new posts by email
Provider: your email provider
