Power Platform Centre of Excellence: How to Govern Citizen Development in UAE Businesses

The Power Platform is what happens when Microsoft 365 customers start building apps. Power Apps for the form, Power Automate for the workflow, Power BI for the dashboard, Copilot Studio for the bot. Most UAE Microsoft tenants have a few dozen flows and apps within a year of buying their first licence, often built by enthusiastic users without IT's knowledge. The Centre of Excellence (CoE) is how you keep this productive instead of dangerous.

This guide walks through what a Power Platform CoE actually is, why it matters for UAE businesses specifically, and the parts of the Microsoft CoE Starter Kit worth turning on now versus later.

The problem the CoE solves

Without governance, Power Platform usage looks like this within 12 months:

• 200+ apps and flows across the tenant, most of which nobody is sure are still in use.
• Personal connections to Office 365, Outlook, OneDrive, third-party SaaS owned by individuals who may have left the company.
• Apps holding personal data (employees, customers) outside any classification or DLP scope.
• Flows running with elevated permissions because nobody scoped them correctly.
• No way to find who owns what when something breaks, and no way to retire what is no longer used.

This is shadow IT, just dressed up as a feature. The CoE is the framework that makes citizen development safe.

The Microsoft CoE Starter Kit at a glance

Microsoft publishes a free CoE Starter Kit (in fact, a set of solutions) that anyone with Power Platform admin rights can deploy. It is not a product; it is a collection of templates, dashboards, flows, and policies that you install into a dedicated environment. The Starter Kit has three layers:

• Core: inventory and admin telemetry. Auto-discovers every app, flow, bot, environment, and connector across the tenant; identifies owners; tracks usage.
• Governance: approval flows, request processes, DLP policies, environment lifecycle, owner-handover when people leave.
• Nurture: training, champions programme, internal community, gamification. The "make citizen development good" layer.

Most UAE businesses install Core first, then Governance, then Nurture if they are big enough to need it.

What to turn on in the first 30 days

Core inventory and dashboards

Day one: stand up a CoE environment in your Power Platform tenant. Install the Core components. Within a week you will have a tenant-wide inventory of every app, flow, environment, and connector, with last-modified date, last-used date, and ownership. This single visibility step usually surprises everyone: most tenants have 3 to 5 times the artifact count they assumed, and 30 to 50% of items have not been touched in 90 days.

Tenant-wide DLP policies

Data Loss Prevention policies in Power Platform classify connectors into "business," "non-business," and "blocked." A flow cannot mix business and non-business connectors in the same flow. Apply two minimum baseline policies:

• Microsoft 365 connectors (SharePoint, Outlook, OneDrive, Teams) are "business."
• Consumer connectors (personal Gmail, Twitter, Dropbox personal, Telegram) are "blocked" or "non-business" with a separate environment for sandbox use.

This single policy prevents the most common data-leak pattern: a flow that reads SharePoint and posts to a personal Gmail.

Environment strategy

Default environment is for trial and personal builds. Production environments are managed: one or two per business unit or solution area. Solutions are deployed in via ALM (export/import or pipelines), not built directly. This shape keeps trial work isolated from anything mission-critical.

What to add in days 31 to 90

Approval and request process for production apps

Citizen developers request promotion of their app or flow from trial to production via a request form. The form captures: data classification, expected users, business sponsor. CoE team reviews and approves. The Starter Kit ships this workflow; just configure the approvers for your context.

Owner accountability

Every app and flow in production environments must have an active owner. Automation flags ownerless artifacts (the person left the company) and re-assigns or archives them. Without this, you accumulate orphan artifacts that nobody can fix when they break.

Champion programme

Identify the 5 to 10 most active citizen developers across the business. Onboard them as champions: dedicated training, early access to features, voice in roadmap decisions, recognition. This is the Nurture layer. It turns the most-skilled citizen developers into multipliers instead of risks.

UAE-specific considerations

• PDPL data classification: apps and flows holding UAE personal data should be tagged inside the CoE inventory. Combine with Microsoft Purview sensitivity labels for cross-platform classification.
• Regional data residency: Power Platform environments default to your tenant's home region. For UAE businesses set the default environment to UAE region where available, and document the residency posture for any business-unit environment.
• Connector audit for regulated industries: healthcare, banking, professional services should block consumer connectors entirely in production environments. Only Microsoft and approved enterprise connectors allowed.
• Multi-language nurture: if your business is operationally multilingual (Arabic, English, often Hindi or Urdu), build the champions programme to match. Translation matters less than the trainers being available in the right language for the audience.

The team behind the CoE

Most UAE businesses run the CoE with:

• One CoE lead (typically inside IT, sometimes inside business operations).
• One or two technical support people for the governance flows and DLP policy maintenance.
• 5 to 10 champions distributed across business units (part-time).
• Power Platform admin role assigned to 2 to 3 people total (not more).

This is not a full team. The CoE Starter Kit does the heavy automation; humans are needed for judgment calls and for nurturing the champion community.

What "good" looks like at the 12-month mark

• Full inventory of every app, flow, environment, connector, and bot, with owners.
• Zero apps or flows in production without an active owner.
• DLP policies enforced; consumer connectors blocked in production.
• Quarterly retirement cycle: apps not used in 90 days flagged, owners contacted, retired if no business case.
• Champions programme with regular meetings and a published roadmap of what is being built.
• A measurable productivity number: hours saved across the business by Power Platform automation, reported to the executive team.

Common rollout mistakes

• Locking everything down day one. Citizen developers abandon the platform and go back to Excel macros and Zapier. Govern lightly; nurture heavily.
• No executive sponsor. The CoE needs air cover when DLP blocks a senior person's flow. Without an executive sponsor, the CoE loses these arguments and the policies erode.
• Treating it as a one-time project. The CoE is a permanent operating model. Budget for the team and the ongoing nurture work, not just the initial install.

FAQs

Do we need Power Platform Premium licences for the CoE?

The CoE Starter Kit itself uses standard Power Platform licences. Premium per-user or Premium per-app licences are needed only for the citizen-developer apps that connect to premium data sources (SQL, Dataverse, on-prem gateways). Scope licensing based on app needs, not on CoE deployment.

How long does the CoE Starter Kit take to install?

The Core components install in a day. Configuration, environment setup, DLP policies, and the first round of inventory cleanup take 4 to 8 weeks for a mid-size UAE tenant. Most of the work is making decisions about policies, not technical installation.

What if we are too small to need a CoE?

Below 50 Microsoft 365 users you can typically skip the formal CoE and just apply tenant-wide DLP policies plus monthly admin review. Above 50 users with active Power Platform use, you start needing the inventory and governance layer.

Can the CoE manage Copilot Studio bots too?

Yes. The Starter Kit inventory captures Copilot Studio bots (formerly Power Virtual Agents) alongside apps and flows. Apply the same ownership, DLP, and lifecycle policies.

What is the cost of the CoE itself?

The Starter Kit is free. Costs are in setup effort (consulting or internal time, typically 4 to 8 weeks) and ongoing operation (one CoE lead, plus part-time champions). For most UAE mid-market businesses the operating cost is a fraction of the value created by the citizen-development work being safe rather than risky.

If you want to scope a Power Platform CoE for your UAE business, contact us or call +971 56 613 2743. We have stood up CoEs for UAE businesses across construction, retail, finance, and education.