DLP execution after Connector Classification: reduce and refactor the DLP policy estate in the tenant based on the agreed connector classification.

Define and agree on the data storage solution that will be used as the foundation for the Power Platform Audit & Monitoring platform. The selected solution should support centralized storage, historical data retention, structured data transformation, and future Power BI reporting. The agreed solution is Azure SQL Database, using a Bronze / Silver / Gold data architecture to separate raw collected data, normalized data, and reporting-ready datasets.

Create a data collection process to retrieve the Copilot Studio credits capacity allocated to each Power Platform environment. The process will provide centralized visibility of how Copilot Studio credits are distributed across the tenant and store the resulting data in the storage solution defined in T-01. The collected allocation data will later be correlated with the consumption data from T-08 to provide allocated versus consumed capacity reporting. Resource Group: rg-gso-powerplatform-app-analytics App Registration: EuAh-S06-Prd-Scau-All-01 Secret Name: GSO-PP-Governance Automation Account: GSO-PP-Automation-Account Runbook: TBD

Create an ETL process to retrieve the complete Copilot Studio inventory across all Power Platform environments identified in T-02. The process will collect all available Copilot Studio agents and their relevant metadata and store the resulting data in the storage solution defined in T-01. The Copilot Studio inventory will later be correlated with environments, users, DLP policies, connectors and other governance datasets. Resource Group: rg-gso-powerplatform-app-analytics App Registration: EuAh-S06-Prd-Scau-All-01 Secret Name: GSO-PP-Governance Automation Account: GSO-PP-Automation-Account Runbook: TBD

Create a data collection process to provide centralized visibility of Power Apps licenses available and assigned across the tenant. The collected data will be used to monitor license allocation, identify assigned and available licenses, correlate licenses with users, and support Power BI reporting. The resulting data will be stored in the storage solution defined in T-01. Resource Group: rg-gso-powerplatform-app-analytics App Registration: EuAh-S06-Prd-Scau-All-01 Secret Name: GSO-PP-Governance Automation Account: GSO-PP-Automation-Account Runbook: TBD

Create an ETL process to retrieve the complete Power Apps inventory across all Power Platform environments identified in T-02. The process will collect both Canvas Apps and Model-driven Apps and store the resulting data in the storage solution defined in T-01. The application inventory will later be correlated with environments, users, DLP policies, connectors and other governance datasets. Resource Group: rg-gso-powerplatform-app-analytics App Registration: EuAh-S06-Prd-Scau-All-01 Secret Name: GSO-PP-Governance Automation Account: GSO-PP-Automation-Account Runbook: TBD

Create an ETL process to retrieve the complete workflow inventory across all Power Platform environments identified in T-02. The scope is not limited to Power Automate cloud flows. The dataset should include all available workflow and process types present in the environments, allowing them to be identified and analyzed separately. The workflow inventory will later be correlated with environments, users, applications, connectors and other governance datasets. Resource Group: rg-gso-powerplatform-app-analytics App Registration: EuAh-S06-Prd-Scau-All-01 Secret Name: GSO-PP-Governance Automation Account: GSO-PP-Automation-Account Runbook: TBD

Create a data collection process to monitor Copilot Studio credits consumption across the Power Platform tenant. The process will collect available credit consumption and allocation information and store the resulting data in the storage solution defined in T-01. The collected data will be used to provide historical usage visibility, identify consumption trends and support Power BI reporting. Resource Group: rg-gso-powerplatform-app-analytics App Registration: EuAh-S06-Prd-Scau-All-01 Secret Name: GSO-PP-Governance Automation Account: GSO-PP-Automation-Account Runbook: TBD

Create a PowerShell ETL process to retrieve the complete tenant user inventory required for Power Platform Audit & Monitoring. The runbook will collect user information and store the data in the storage solution defined in T-01. The user dataset will later be correlated with Power Platform environments, applications, flows, ownership information, and other governance data. Resource Group: rg-gso-powerplatform-app-analytics App Registration: EuAh-S06-Prd-Scau-All-01 Secret Name: GSO-PP-Governance Automation Account: GSO-PP-Automation-Account Runbook: TBD

Create a PowerShell ETL process to retrieve the complete Power Platform DLP policy inventory. The runbook will collect all tenant-level DLP policies, including their configuration and scope, and store the collected data in the data storage solution defined in T-01. The process will use the existing Azure governance infrastructure: Resource Group rg-gso-powerplatform-app-analytics App Registration EuAh-S06-Prd-Scau-All-01 Secret GSO-PP-Governance Automation Account GSO-PP-Automation-Account Runbook TBD The collected DLP information will later be correlated with the Environment inventory created by T-02 to provide tenant-wide governance visibility.

Create the initial PowerShell ETL process for the Power Platform Audit & Monitoring solution. The runbook will retrieve the complete Power Platform environment inventory and store the collected data in the data storage solution defined in T-01. The process will run under the existing Azure governance infrastructure: Resource Group rg-gso-powerplatform-app-analytics App Registration EuAh-S06-Prd-Scau-All-01 Secret GSO-PP-Governance Automation Account GSO-PP-Automation-Account Runbook TBD The environment inventory will act as the base dataset for the following Audit & Monitoring ETL processes.

Classify every connector as business, non-business or blocked, with a documented rationale. Connectors are currently not structurally classified and all 129 policies carry non-business connectors.

Add the safety fallback policy that applies where environments are not otherwise assigned. None exists today.

Bring the 17 environments currently outside any DLP policy under coverage.

Decommission the 4 duplicate policies and consolidate the 125 policies scoped to fewer than five environments, resolving the 62 environments carrying more than one policy.

Tighten the policy covering personal productivity, the riskiest environment, addressing the apps and flows using unrecommended connectors such as HTTP, SQL Server and file system.

Enable desktop flow actions in DLP, having first assessed the impact on the 483 existing desktop flows. Once enabled this setting cannot be disabled.