Skip to main content

Buyer guide

Power Automate Admin, Data & Copilot Controls Checklist

Data policies, Managed Environments, ownership, run history, regions, and the Copilot settings to review before flows touch sensitive data.

Reading time
2 min read
Sources
16 cited
In this piece
Power Automate−6 Mixed

Set data policies on connectors and desktop actions before business teams build, and decide on Copilot, which is on by default and can send prompts outside your region. Power Automate runs each flow in its environment's region and keeps run history for 30 days.

When you need this

  • Security or IT reviews Power Automate before business teams build on it.
  • Flows will move customer, employee, or regulated data between systems.
  • Copilot, AI Builder, or agent flows will process that data.

Evaluation criteria

  1. Ownership that survives staff changes

    Do critical flows keep running correctly when their builders leave?

    Look forGive the flows the business depends on service principal owners, and give shared flows co-owners. Check flow ownership during offboarding. A Hacker News commenter describes flows abandoned when their creators moved on. Another builder shared a flow with teammates so it kept running after the builder left.

  2. Connector data policies

    Which connectors and desktop actions should touch business data?

    Look forClassify connectors as business, non-business, or blocked. Turn on the tenant setting that shows desktop flow modules in data policies, then classify those too, because policies skip unclassified desktop modules. A policy change suspends the flows that break it.

  3. Environment controls

    Which environments hold production flows, and who can share into them?

    Look forRun production in Managed Environments. They add sharing limits, IP firewall, customer-managed keys, Lockbox, and data policies for desktop flows.

  4. Retention and location

    Where does flow data live, and for how long?

    Look forFlows deploy in the data center region of their environment, and an on-premises data gateway must sit in a matching region. Run history is kept for 30 days from each run's start.

  5. Copilot and cross-region data

    Can Copilot send prompts outside our region?

    Look forCopilot in Power Automate is on by default. In the United States, the UK, Australia, and India, only Microsoft support can turn it off, for the whole tenant. Elsewhere, turning off cross-region data movement turns Copilot off. Microsoft states that it does not train Azure OpenAI foundation models on prompts and outputs.

  6. AI steps under data policies

    Which AI connectors and Copilot Studio knowledge can flows call?

    Look forClassify AI Builder, Copilot Studio, and outside AI connectors in data policies before teams add AI steps. Some companies block AI connectors entirely, and their builders take flow questions to chat assistants outside the tenant.

  7. Inventory and monitoring

    Can IT see every flow and its owner?

    Look forUse Inventory, Usage, Monitor, and Actions in the Power Platform admin center. Microsoft no longer maintains the CoE Starter Kit.

Questions to ask vendors

  1. Which flows move personal or regulated data, and in which environment do they run?
  2. Is cross-region data movement on for our environments, and did we decide that on purpose?
  3. Which desktop flow modules are classified in our data policies?
  4. Who receives failure notices for flows owned by service accounts?

Red flags

  • Production flows in the default environment, where every member can reach them.
  • Data policies that leave desktop flow modules unclassified.
  • Copilot left on by default with no decision about cross-region data movement.
  • Audits that need run history older than the 30 days Power Automate keeps.

Products in this piece

Sources

Official documentation
11
Public source
5
  1. Microsoft Learn: Data policiesOfficial documentationlearn.microsoft.com
  2. Microsoft Learn: Data loss prevention for desktop flowsOfficial documentationlearn.microsoft.com
  3. Microsoft Learn: Managed Environments overviewOfficial documentationlearn.microsoft.com
  4. Microsoft Learn: Power Automate regions overviewOfficial documentationlearn.microsoft.com
  5. Microsoft Learn: Copilot in Power AutomateOfficial documentationlearn.microsoft.com
  6. Microsoft Learn: Turn on copilots and generative AI features (data movement across regions)Official documentationlearn.microsoft.com
  7. Microsoft Learn: Limits of automated, scheduled, and instant flowsOfficial documentationlearn.microsoft.com
  8. Microsoft Learn: Support for service principal owned flowsOfficial documentationlearn.microsoft.com
  9. Microsoft Learn: Change the owner of a cloud flowOfficial documentationlearn.microsoft.com
  10. Microsoft Learn: CoE Starter Kit transition to the Power Platform admin centerOfficial documentationlearn.microsoft.com
  11. Microsoft Learn: Explore the Power Automate home page (environments)Official documentationlearn.microsoft.com
  12. Reddit r/MicrosoftFlow: a flow whose author is long gone stops working for most users (Jun 30, 2025)Public sourcereddit.com
  13. Hacker News comment on flows abandoned when their creator moves on (Jul 4, 2026)Public sourcenews.ycombinator.com
  14. Reddit r/sysadmin: a shared flow that kept running after its builder left (Dec 31, 2025)Public sourcereddit.com
  15. Reddit r/MicrosoftFlow: building flows with ChatGPT where AI connectors are blocked (Apr 7, 2026)Public sourcereddit.com
  16. Hacker News comment on deploying Copilot Studio and the Power Platform in GCC (Dec 3, 2025)Public sourcenews.ycombinator.com

Keep reading

  1. Buyer guidePower Automate Rollout PlaybookThe environments, ownership rules, review practice, and licensing to settle before business teams build flows that others depend on.
  2. Buyer guidePower Automate Licensing & Capacity ChecklistPick the license each flow runs under, from Microsoft 365 rights, Premium, Process, flow groups, and pay-as-you-go, and check it against request limits.
  3. Buyer guidePower Automate Agent Flows, Copilot & RPA GuideUse a cloud flow for triggers and schedules, an agent flow or Copilot Studio workflow when an agent calls it, and a desktop flow for screens with no API. Each bills differently.
Read the research