Almanac
Microsoft/power-appsPower Platform

Consultant KB for Microsoft Power Apps: canvas apps, model-driven apps, Power Fx, data and connections, controls and UI, code and extensibility, mobile and offline, ALM and solutions, governance and security, licensing and performance, plus cross-cutting decision guides. Implementation notes, configuration decisions and the gotchas that bite on real projects. Populated by the daily author agent from the Power Apps release plans, docs repo and product blog, plus the author's own consultant notes.

power-apps/09-governance-and-security/feature-coe-starter-kit-for-apps.md
feature-coe-starter-kit-for-apps.mdv1 · history
CurrentApplies to BothUpdated last monthSource Microsoft Learn ↗

What it does

A Microsoft-published solution that inventoried every app, flow and maker in a tenant and layered audit, compliance and clean-up processes on top. As of the May 2026 documentation refresh it's no longer actively maintained — the core capabilities now live natively in the Power Platform admin centre as Inventory, Usage, Monitor and Actions.

Key facts

  • Microsoft's current position, stated plainly on the docs page: the kit remains available for existing and new deployments, but gets no new feature investment and issues are no longer reviewed or addressed. Security vulnerabilities go to MSRC.
  • The mapping Microsoft gives: Inventory replaces the app/flow/agent inventory components, Usage replaces adoption and top-maker reporting, Monitor replaces operational health tracking, Actions replaces the governance and risk components.
  • Power Platform inventory covers canvas, model-driven, code and vibe apps, plus cloud flows, agent flows, agents, environments and environment groups. Created, updated or deleted resources show up within about 15 minutes.
  • Inventory now carries a Connectors column (preview) showing which connectors and operations each app uses — the thing most CoE deployments were really being used for.
  • Access to inventory is by Entra role: Global admin, Power Platform admin, Dynamics 365 admin and Global reader see everything. AI administrator and AI reader are scoped to AI resources only and can't see canvas apps, model-driven apps or cloud flows.
  • Programmatic access is through the Power Platform inventory API, the Power Platform for Admins V2 connector, and Azure Resource Graph with KQL.
  • Inventory isn't available in GCC, GCC High, DoD, 21Vianet (China) or air-gapped clouds.

When to use / skip

If a client already runs the kit and it works, leave it alone and plan a migration rather than a rip-out — the audit processes and approval flows people built on top of it don't have exact native equivalents yet. For anyone starting fresh in 2026, don't deploy it. Recommending an unmaintained solution with a couple of hundred components and a nightly sync is hard to defend when the admin centre does the inventory job with no maintenance at all. The honest gap is the bespoke bits: compliance questionnaires, maker onboarding flows, archive-and-delete approval chains. Those you'd now build small and purpose-made rather than adopting the whole kit to get them.

Configuration decisions

  • Whether an existing deployment is migrated to native admin centre experiences, frozen in place, or decommissioned — and who owns that call.
  • Which of the client's CoE processes are actually load-bearing. Usually it's two or three flows, not the two hundred components.
  • Whether governance reporting is consumed in the admin centre UI, exported to Excel, or queried through the inventory API into the client's own reporting stack.
  • Who holds the Entra roles that can see inventory, given that the AI-scoped roles deliberately can't see the app estate.
  • Whether the kit's own environment and its service account remain licensed, if you're keeping it.

Gotchas

  • The maintenance cost was always the real story. A CoE deployment is a solution someone has to upgrade, a set of flows someone has to unblock, and a service account with broad rights someone has to own. Clients who deployed it and then reorganised the platform team invariably have a broken sync and stale data they're still making decisions from.
  • Only published model-driven apps appear in inventory. Unpublished ones are invisible.
  • The three preinstalled model-driven apps in the default environment (Power Platform Environment Settings, Power Pages Management, Solution Health Hub) don't show in inventory until someone edits and republishes them.
  • Inventory search only covers what's loaded in the grid — up to 1,000 rows. Above that you filter first, you don't search.
  • If the client enforces MFA via conditional access on Azure Resource Manager, inventory may fail to load entirely until the Power Platform admin centre app is included in the policy.

Consultant notes

  • Say the maintenance quiet part out loud in the first governance workshop. Clients hear "free Microsoft toolkit" and price it at zero; it's a small product with an owner and a support burden.
  • If you're being asked to install it now, ask what specific question it answers that Inventory, Usage, Monitor and Actions don't. Usually there isn't one.
  • For clients already running it, the migration conversation is easiest framed around what they'd stop maintaining rather than what they'd gain.
  • Check the sovereign cloud position early. A government client can't use native inventory, which changes the answer entirely.

Sticky note: revisit if Microsoft ships native equivalents for the compliance and approval components, or formally retires the kit.

Was this accurate?
Related
Admin controls and tenant settings09-governance-and-securityPower Apps code apps06-code-and-extensibilityPower Platform pipelines08-alm-and-solutionsManaged environments for Power Apps09-governance-and-securityCanvas apps in Teams and Dataverse for Teams01-canvas-appsModel app builder skill (AI code generation)02-model-driven-apps