SMCPS governance lead magnet
Power Platform and M365 Governance Diagnostic
A printable leadership checklist for finding the ownership, information, permission and delivery gaps that make Microsoft estates difficult to scale.
Use this as a conversation starter, not a certification
This is not a compliance certification or a scorecard that pretends every organisation has the same risk. Use the questions to make the current position visible, then agree what needs evidence and ownership.
01
Ownership and accountability
Governance starts with knowing who can make decisions and who is accountable when a service changes or fails.
- Can we name the business and technical owner for every production app, flow and site?
- Do owners understand the support, risk and lifecycle responsibilities they have accepted?
- Can leaders see which solutions are business-critical and which are still prototypes?
02
Environments, information and permissions
A platform can be technically available while still being unsafe or difficult to control.
- Are development, test and production environments clearly separated and governed?
- Do we know where sensitive or regulated information moves through connectors and automations?
- Can access be removed quickly when someone changes role or leaves?
03
Delivery, support and change
A low-code solution becomes a service when people rely on it. The controls need to match that reality.
- Are changes tested before they affect operational users?
- Is there a support route when a flow, app or SharePoint process stops working?
- Are governance decisions recorded in a way delivery teams can actually use?
04
The 90-day decision
The point of a diagnostic is to create a sequence of decisions, not another report that sits unused.
- Which three risks would create the greatest operational or regulatory consequence?
- Which decision or owner is missing for each material risk?
- What can be improved in 30, 60 and 90 days without creating a second transformation programme?