How the sprawl happens
Power Platform is included in licences your organisation already holds, and makers can build genuinely useful things without involving IT. That is the point, and it works. Eighteen months later there are two hundred apps, forty of which matter operationally, several built by people who have since left, most connecting to production data through personal connections, and none with a support model.
Environments are the primary control
A single default environment where everyone builds is the root cause of most Power Platform problems. We establish a tiered model: personal productivity environments with restrictive DLP and no production connectors; team development environments; and managed test and production environments where deployment happens only through pipelines. The boundary does the governing, so policy does not have to rely on goodwill.
DLP policies that permit rather than forbid
Data loss prevention policies in Power Platform work by classifying connectors as business, non-business or blocked, and preventing data flowing between groups. Written as an allow-list per environment tier, they are effective and comprehensible. Written as an ever-growing block-list, they are neither, and makers will find the gap.
ALM is not optional above a threshold
Any app that a business process depends on needs managed solutions, source control, and pipeline-based promotion between environments. Editing directly in production is acceptable for a personal tracker and unacceptable for anything with an audit trail obligation. The line has to be drawn explicitly, published, and enforced by environment permissions rather than by asking nicely.
The inventory nobody wants to build
The Centre of Excellence starter kit will tell you what exists, who created it, when it was last used and what it connects to. Running it usually produces an uncomfortable meeting. The output is a triage list: promote to managed, assign an owner, or decommission. In our engagements roughly a third of discovered apps turn out to be abandoned, which is the easiest governance win available.
Enable, do not police
Governance that only restricts drives makers to build in Excel and email instead, which is strictly worse. Pair the controls with a maker community: published standards, reusable components, a template library, office hours, and a genuine path to get a valuable app adopted and supported by IT. Adoption you can see is safer than adoption you cannot.