The 2026 Governance Toolbox: How I Track and Manage Power Platform and Copilot Studio at Scale

By Kaustubh Giri, Sr Solution Engineer. ~15 min read. Companion post to Environment Strategy and DLP.

A question I’ve been getting a lot lately is: “We built our governance on the CoE Starter Kit. Is that still the right approach?” The short answer is that the toolbox changed quite a bit in 2026, and most customers I talk to haven’t fully caught up.

The CoE Starter Kit is no longer actively developed, and most of what it did now lives in the Power Platform admin center. The Copilot Studio Kit has been renamed and expanded. Agents now have their own registry, their own identities, and their own authentication policies. In this post I go through each tool: what it is, why it matters, and how I’d use it. I’ve also included a few things I learned the hard way while helping customers.

A quick caveat: The statuses below are current as of October 2026. Microsoft no longer publishes Power Platform features in twice-yearly release waves. New capabilities ship continuously and appear on the Microsoft roadmap. Before relying on anything marked preview in production, check its current status on Microsoft Learn.

In this post:

1. Status at a glance
2. The CoE Starter Kit: what changed
3. Power Platform admin center: the new core
4. Cost and capacity: Copilot Credits
5. Copilot Agent Kit (formerly Copilot Studio Kit)
6. Agent-level observability
7. Agent registry, identity, and authentication
8. Audit, compliance, and threat detection
9. Automation and custom reporting
10. Which tool answers which question
11. Moving off the CoE Starter Kit

1. Status at a glance

Tool or capability	Status (Oct 2026)	What I use it for
CoE Starter Kit	No longer maintained	Existing deployments only. Plan your migration.
PPAC Inventory	Generally available	A tenant-wide list of apps, flows, and agents, with their owners
PPAC Inventory: connector usage	Preview	Finding which resources use a specific connector or operation
PPAC Usage	Rolling to GA	Adoption trends, plus top resources and their owners
PPAC Monitor	GA (apps/flows), preview (agents)	Operational health and recommendations
PPAC Actions	Generally available	Recommendations you can act on directly
Security page & security score	Score in preview	Checking security posture and applying proactive policies
Advanced Connector Policies	Generally available	Controlling individual connector actions and MCP servers
Copilot Studio capacity management	Generally available	Allocating Copilot Credits and tracking consumption
Copilot Agent Kit (formerly Copilot Studio Kit)	Active, open source	Testing, compliance workflows, and KPIs across agents
Copilot Studio analytics + Application Insights	Generally available	Per-agent performance and custom telemetry
M365 admin center Agent Registry	Available	One list of agents, whoever built them
Microsoft Entra Agent ID for Dataverse	Preview	A dedicated identity and least-privilege access for each agent
Authentication policies for agents	Preview	Blocking anonymous or unapproved sign-in methods centrally
Agentic CoE	Announced	AI-generated governance summaries and remediation plans
Microsoft Purview (Audit, DSPM for AI)	Generally available	Audit trail, sensitive data in prompts and responses, compliance
Microsoft Sentinel for Business Apps	Generally available	Threat detection, hunting, and automated response
CLI, APIs, Admin V2 connector	Generally available	Automation and custom reporting

2. The CoE Starter Kit: what changed

For years, the CoE Starter Kit was how most organizations got visibility into Power Platform. It was a collection of apps, flows, and Power BI dashboards that collected inventory, found orphaned resources, audited connectors, and ran maker compliance workflows.

Microsoft has now said the kit is no longer actively maintained. It won’t get new features or bug fixes, and reported issues aren’t reviewed. Security vulnerabilities should still be reported to the Microsoft Security Response Center. The kit still works, but Microsoft recommends the Power Platform admin center as the main place for governance. If you’re still running the kit, I wouldn’t uninstall it today, but I would start planning the move.

What the kit did	Where to find it now
Inventory flows and Power BI inventory	PPAC Inventory, plus the Inventory API
Adoption dashboards	PPAC Usage
Operational health	PPAC Monitor
Compliance and orphaned-resource findings	PPAC Actions (full detail in Managed Environments)
Custom automation built on the kit’s flows	Power Platform CLI, Power Platform API, Power Platform for Admins V2 connector

Gaps to plan for: Microsoft acknowledges that the kit still does some things Managed Environments don’t, such as bulk permission updates, cleaning up abandoned resources, maker surveys, and calculating the ROI of ideas. Partners also point to DLP impact analysis and longer reporting history. If you rely on any of these, keep that part of the kit running, or rebuild it with the APIs, until a native replacement is available.

3. Power Platform admin center: the new core

Inventory, Usage, Monitor, and Actions, together with the Security page and Managed Environments, now cover most of what the kit did. First, check permissions, because this trips people up. These pages require a tenant-wide Entra role: Global Administrator, Power Platform Administrator, Dynamics 365 Administrator, or Global Reader. The AI Administrator and AI Reader roles only see AI-related resources. Environment admins won’t see these pages at all.

Inventory

Generally available · PPAC -> Manage -> Inventory

A tenant-wide view of apps, flows, and agents, including Copilot Studio and Microsoft 365 Copilot Agent Builder agents, with their owners. Changes show up within about 15 minutes, you can filter on any attribute, and you can export to Excel.

Why I care about it: It replaces the CoE inventory flows, and you don’t have to run a Dataverse environment to keep it working. The connector column (in preview) shows which connectors and operations each resource uses. If a connector is deprecated or involved in an incident, you can find everything affected in seconds.

How I recommend using it:

1. Start with the default environment. Filtering on it usually shows how much has built up there.
2. Filter for resources whose owners are missing or have left, and reassign them.
3. Filter by connector to find anything using HTTP or consumer services.
4. Export a monthly snapshot so you can see trends over time.

My tip: Make the Inventory review a standing item in your monthly governance meeting. The data is already there. What matters is reviewing it regularly.

Usage

Rolling to GA · PPAC -> Usage

Adoption analytics, including app launches, flow runs, and active users over time, along with your top resources and their owners.

Why I care about it: It shows which solutions the business has come to depend on, often without anyone deciding that it should. It gives you the evidence to move a popular personal solution out of the default environment.

How I recommend using it:

1. Look at the top resources in the default environment every month. Anything heavily used is a candidate to move.
2. Invite the owners of high-usage solutions into your champions program.
3. Use adoption trends when you report platform ROI to leadership.

Monitor

GA for apps & flows, preview for agents · PPAC -> Monitor

Operational health metrics and recommendations for canvas apps, model-driven apps, cloud flows, and desktop flows, with Copilot Studio agents in preview. Metrics are aggregated daily, so they aren’t real time, and tenant-level analytics must be turned on.

Why I care about it: You find out about performance problems before users report them. It gives specific recommendations, which Application Insights doesn’t do on its own, and it doesn’t need an Azure subscription.

How I recommend using it:

1. Turn on tenant-level analytics.
2. Pin your business-critical resources.
3. Set up alert rules for apps and flows whose health is getting worse.
4. Share recommendations directly with the makers who own those resources.

Actions

Generally available · PPAC -> Actions

Recommendations you can act on directly, such as assigning an owner to an ownerless app or setting up DLP for Copilot Studio.

Why I care about it: This is what moves you from just seeing problems to fixing them, which is the most common complaint I hear about inventory tools. One recommendation, Secure agents by setting up data loss prevention policies for Copilot Studio items, is rated high severity and refreshes in real time.

How I recommend using it:

1. Review high-severity recommendations every week.
2. Reassign ownerless apps directly from the recommendation.
3. Plan for Managed Environments. Non-managed environments only show a summary, while managed environments get full detail and one-click fixes.

My tip: Most of the useful proactive capabilities, including full Actions detail, the weekly digest, and sharing limits, depend on Managed Environments. If governance is a priority for you, budget for them.

Security page & security score

Score in preview · PPAC -> Security

Security recommendations, a security score (Low, Medium, or High), and proactive policies, all in one place. The score depends on which security features you’ve turned on, such as IP firewall, tenant isolation, and environment security groups.

Why I care about it: It gives you one posture metric you can share with your CISO. It points you to the next most valuable security feature to turn on.

How I recommend using it:

1. Turn on tenant-level analytics. The page can take up to 24 hours to show data.
2. Work through the recommendations, starting with the ones that affect the most resources.
3. Apply security settings at the environment group level so they stay consistent.

My tip: Microsoft recommends using the preview score for evaluation only. I’d use it to see whether you’re moving in the right direction, not as a compliance KPI.

Advanced Connector Policies

Generally available (June 2026) · PPAC -> Security -> Data and privacy

The next step beyond classic DLP. Instead of allowing or blocking a whole connector, you can control which specific actions and MCP servers apps and AI tools can use.

Why I care about it: Agents increasingly reach external systems through MCP, and this lets you control exactly which tools they can call. The connector platform checks every call against these policies at runtime.

How I recommend using it:

1. Use the Inventory connector column to see which operations are actually in use.
2. Allow only those operations for production agents.
3. Register internal MCP servers through bring-your-own MCP so they’re governed like the official catalog.

4. Cost and capacity: Copilot Credits

Copilot Studio capacity management

Generally available · PPAC -> Licensing -> Copilot Studio

This is where you allocate prepaid Copilot Credits to environments and monitor consumption. It covers every Copilot Studio harness: Copilot Chat, Standard, and GitHub Copilot.

Why I care about it: Credits are pooled across the tenant, but agents can’t use them until they’re assigned to an environment. You get a three-month daily trend and a list of the environments consuming the most credits, so you can catch unexpected spend early. When prepaid capacity runs out, new agent flow runs are blocked. That’s a business continuity risk, not just a billing issue.

How I recommend using it:

1. Allocate credits to each environment based on expected usage.
2. If consumption looks wrong, download the environment report first, then the agent or user report, to narrow it down.
3. Link environments to Azure through pay-as-you-go billing policies so overages are charged to the right cost center.
4. Look for Agent flow actions in the consumption grid to track what agent flows cost.

My tip: Agent design has a big effect on credit consumption. When I write agent instructions, I tell the agent to load only the skills a request needs, reuse what it has already retrieved, and avoid calling the same source twice. Small design choices like these add up quickly at scale.

From the field: When a customer asked me to help with a costing dashboard, we tested the per-agent cost API calls from outside the admin center: with a user that had the Power Platform Reader role, with a service principal, and with Global Admin. All of them returned 403 Forbidden. Only the admin center’s own browser session got a response. I’d still turn on the Reader role, because it gives you tenant and environment totals, but don’t count on per-agent breakdowns through the API yet. Use the downloadable reports in the admin center for those.

5. Copilot Agent Kit (formerly Copilot Studio Kit)

Power CAT has renamed the Copilot Studio Kit to the Copilot Agent Kit. It’s still free, open source, and actively maintained. It adds to Copilot Studio rather than replacing anything, and you only install the modules you need. These are the ones I find most useful:

• Compliance Hub (Govern) - checks agent configurations against controls you define, opens compliance cases for violations, tracks them against SLAs, and can quarantine or delete agents. Makers are notified in Teams or Outlook.
• Agent Inventory (Govern) - a tenant-wide view of custom agents, including the features they use, their authentication mode, and their knowledge sources, with a dashboard and export.
• Power Shield (Govern) - an approval workflow for DLP connector access. Makers request access and admins approve or reject it, with optional compliance questionnaires.
• Test automation & Rubrics (Quality) - batch tests for response match, topic match, attachments, and generative answers, scored against rubrics you define and can refine.
• Agent Review Tool (Quality) - static analysis that flags configuration problems and anti-patterns before you deploy.
• Pipeline testing (ALM) - runs tests automatically as part of Power Platform pipelines, before an agent is promoted.
• Agent Insights Hub (Insights) - combines Application Insights telemetry with conversation transcripts to show usage, quality, and operational trends.
• Conversation KPIs & Analyzer (Insights) - KPIs aggregated across agents in Dataverse, plus AI analysis of transcripts using your own prompts.
• Agent Value & Debugger (Insights) - classifies agents by business value and lets you step through how an agent produced a specific response.

How I’d adopt it: Install it in a dedicated admin or tools environment, not the default environment. Start with Agent Inventory and Compliance Hub. Then add test automation to the pipelines for your production agents, and add Conversation KPIs when leadership starts asking for numbers.

6. Agent-level observability

Copilot Studio analytics + Azure Application Insights

Generally available · Copilot Studio -> Analytics · Agent Settings -> Advanced

Copilot Studio’s built-in analytics show usage and KPIs for each agent. Connecting Application Insights adds the full runtime picture: messages, which topics triggered, errors, and any custom events you send.

Why I care about it: Built-in analytics give makers quick feedback. Application Insights lets the platform team analyze behavior in depth with KQL and set up alerts.

How I recommend using it:

1. Make sure the Application Insights connector is allowed in that environment’s data policy.
2. Create an Application Insights resource dedicated to Copilot Studio telemetry.
3. Build KQL queries and alerts for the error patterns and conversation volumes you care about most.

From the field: When an agent misbehaves, the most useful thing to have is a conversation ID. Ask the user to type /debug conversationid in the chat, then include it in the support case. With conversation IDs from a working and a failing scenario, support can trace exactly what the agent did. Without them, everyone is guessing.

7. Agent registry, identity, and authentication

Microsoft 365 admin center: Agent Registry

Available · Microsoft 365 admin center -> Agents -> All agents -> Registry

A central list of every agent available in your organization: Microsoft agents, partner-built agents, agents your organization publishes, and agents shared by individual creators. Copilot Studio agents are added automatically when they’re created.

Why I care about it: It covers every agent, not just ones built in Power Platform, so it’s where you see your whole agent footprint. You can filter by publisher, channel, platform, or data source, find agents without owners, and block, reassign, or remove agents.

How I recommend using it:

1. Review the list of agents without owners regularly.
2. Filter for agents with embedded knowledge, meaning files makers uploaded directly, and check those files for sensitive content.
3. Use the Graph API (in preview) or the Excel export to include registry data in your own reports.

Microsoft Entra Agent ID for Dataverse

Public preview · Microsoft Entra admin center, PPAC

Gives each agent its own Entra identity and a Dataverse agent user with a least-privilege security role. When an agent is published, the Power Platform connectors it uses appear on its identity as API permissions.

Why I care about it: Agents no longer run with their creator’s broad permissions. Entra admins can see what an agent can call. For agents running in Teams, they can also apply Conditional Access.

How I recommend using it:

1. Pilot it in a non-production environment with a single, well-scoped scenario.
2. For each agent, document the business owner, its purpose, and how it will be retired.
3. Be aware that custom connectors, MCP servers, and REST API tools don’t add permissions to the agent’s identity yet.

Authentication policies for agents

Public preview · PPAC -> Security -> Identity and access -> Authentication for agents

Sets which authentication methods makers can use for their agents, per environment or environment group, from no authentication up to requiring Entra authentication.

Why I care about it: The policy is enforced when an agent is published and while it runs. A published agent that doesn’t comply stops responding until it’s fixed. It works alongside Entra Agent ID. This policy controls how users sign in to the agent, and Agent ID controls what the agent can do.

How I recommend using it:

1. Require Entra authentication for internal environment groups.
2. Allow anonymous access only in a reviewed group for public-facing agents.
3. Before tightening the policy, check which agents would be affected.

Worth watching: Agentic CoE. Microsoft has announced three AI agents for the admin center: Highlights, Insights, and Action Plan. They’re designed to provide daily tenant summaries, prioritize risks, and propose fixes that an admin approves before anything happens. As of early October 2026, it wasn’t marked as delivered. It’s expected to turn on automatically for tenants that have at least one Managed Environment.

8. Audit, compliance, and threat detection

Microsoft Purview: Audit and DSPM for AI

Generally available · Microsoft Purview portal

Purview logs Copilot Studio activity, covering both agent authoring and agent usage. DSPM for AI shows sensitive information that appears in prompts and responses. Sensitivity labels, DLP, Insider Risk Management, eDiscovery, and retention policies all support Copilot Studio interactions.

Why I care about it: You can see who changed which agent, and when. You can tell whether sensitive data is showing up in conversations with agents.

How I recommend using it:

1. Confirm Purview Audit is on. Copilot Studio admin activity is logged by default.
2. Turn on DSPM for AI and review the activity explorer.
3. Note that covering agents published to non-Microsoft channels requires pay-as-you-go billing.
4. For agents with Entra Agent IDs, also check sign-in activity in the Entra admin center.

Microsoft Sentinel solution for Business Apps

Generally available · Microsoft Sentinel / Defender portal

Brings Power Platform, Power Automate, and Dataverse activity logs into Sentinel. It includes built-in analytics rules, hunting queries, playbooks, and workbooks that detect activity such as mass data deletion, sign-ins from blocked IP addresses, and unusual application-user behavior.

Why I care about it: Your SOC sees Power Platform threats alongside identity, endpoint, and network signals. A separate Copilot data connector (in preview since early 2026) brings Copilot audit events into Sentinel as well.

How I recommend using it:

1. Deploy the solution, configure Dataverse auditing on the tables you care about, and use KQL to confirm data is arriving.
2. Turn on the built-in rules and update the watchlists for your VIP users and network ranges.
3. Connect playbooks so high-risk events trigger an automated response.

9. Automation and custom reporting

If you built custom workflows on top of the CoE Starter Kit, rebuild them on supported interfaces. When the admin center doesn’t do something you need, I’ll often build a small, focused tool that calls these APIs. That’s how I ended up building the ALM guide and the role manager page I share with customers.

• Power Platform for Admins V2 connector: admin flows in Power Automate, such as reassigning ownership or sending cleanup reminders.
• Power Platform Inventory API and Azure Resource Graph: tenant-wide inventory queries for custom Power BI reports or your CMDB.
• Power Platform API and CLI (pac): scripted environment provisioning, policy assignment, and pipeline checks.
• Office 365 Management API: audit events streamed into your own data platform.

10. Which tool answers which question?

Question	Where I’d look
What exists, and who owns it?	PPAC Inventory, M365 Agent Registry
What is the business actually using?	PPAC Usage, Copilot Studio analytics
Is it healthy and performing well?	PPAC Monitor, Application Insights, Agent Insights Hub
What’s risky, and how do I fix it?	PPAC Actions, Security page, Compliance Hub
What can an agent call or access?	Advanced Connector Policies, Entra Agent ID
Who can talk to an agent?	Authentication policies for agents, sharing limits
What is it costing us?	PPAC Licensing -> Copilot Studio, billing policies
What happened, and was it malicious?	Purview Audit / DSPM for AI, Microsoft Sentinel
Is this agent ready to ship?	Copilot Agent Kit tests, Agent Review Tool, pipeline gates

11. Moving off the CoE Starter Kit

Step 1: Map

• List the kit components you actually use
• Map each one to its native replacement (section 2)
• Mark any gaps

Step 2: Run in parallel

• Assign the right Entra admin roles
• Turn on tenant-level analytics and Managed Environments
• Compare the native pages against the kit for one review cycle

Step 3: Cut over

• Rebuild the gap workflows with the Admin V2 connector and APIs
• Move reports to the Inventory API
• Retire the kit’s flows and free up capacity

Where I’d start

Governance is now mostly built into the product, so you’re no longer maintaining your own solution to get visibility. If I were starting today, I’d focus on the admin center for visibility and fixes, the Agent Registry and Entra for agent identity, Purview and Sentinel for audit and threat detection, and the Copilot Agent Kit for quality and compliance automation.

Happy to go deeper on any of this.

K.G.

Back to “Environment Strategy and DLP: What I Recommend”

Sources

• Microsoft Learn: CoE Starter Kit transition to Power Platform admin center (updated May 2026)
• Microsoft Learn: Copilot Agent Kit overview (updated July 2026)
• Microsoft Learn: Monitor the health of your resources; Security overview; View security recommendations
• Microsoft Learn: Manage Copilot Credits and capacity for Copilot Studio
• Microsoft Learn: Agent Registry in Microsoft 365 admin center; Agent registry integration for Copilot Studio
• Microsoft Learn: Purview for Copilot Studio; Audit Copilot Studio activities; Microsoft Sentinel solution for Business Apps
• Industry analysis: Holert, “Power Platform Governance 2026”; FutureAbility, “What to use now the CoE Starter Kit is retired”

---

Statuses reflect publicly available information as of October 2026. Preview features may change. Customer examples are anonymized.

Get new posts by email

Email addressSubscribe

Provider: your email provider