DEVELOPER COMPLIANCE BEST PRACTICES

• • • Set Up Developer Compliance Components

    • Developer Compliance components ensure that all custom apps, flows, and integrations adhere to
    • organizational policies and regulatory standards. They monitor solution development, enforce coding
    • standards, and track changes to maintain security and quality. Implementing compliance checks early
    • helps prevent errors, reduce risks, and ensure audit readiness. Key elements include solution
    • versioning, permission management, and automated validation of configurations. Proper setup also
    • facilitates reporting, governance, and adherence to best practices across the development lifecycle.
    • Integrating these components with DevOps and Power Platform environments improves oversight
    • while maintaining agility. Regular reviews and updates ensure compliance standards evolve with
    • organizational and regulatory changes. Overall, Developer Compliance components streamline safe
    • and reliable app development.
      • Prerequisites
      • Basic understanding of Power Platform solutions, apps, and flows.
      • Knowledge of organizational policies, security standards, and regulatory requirements.
      • Familiarity with Dataverse, connectors, and environment configuration.
      • Set Up Developer Compliance Components Using the Setup Wizard
      • Guided Configuration: Step-by-step interface ensures proper setup of compliance rules,
      • permissions, and validation templates.
      • Integration & Monitoring: Connects to relevant apps, flows, and environments to enforce
      • standards and track changes.
      • • Testing & Updates: Allows testing of compliance settings and supports regular updates to
      • align with evolving policies.
      • Note:
      • Always verify the Setup Wizard is connected to the correct environment.
      • Document all changes for audit and future reference.
      • Test compliance rules thoroughly to ensure policies are enforced without disrupting
      • workflows.
      • Set Up Developer Compliance Components Manually
      • Configure Mandatory Environment Variables
      • Environment variables ensure that apps, flows, and solutions function correctly across environments.
      • They include API endpoints, credentials, feature flags, and tenant-specific configurations. Proper
      • setup prevents errors, supports seamless deployment, and ensures consistent behavior across
      • development, test, and production environments. Regular reviews maintain system reliability and
      • compliance.
      • Tips:
      • Keep environment variable values consistent across all environments.
      • Use secure storage for sensitive information such as client secrets or API keys.
      • Regularly review and update variables to reflect configuration or endpoint changes.

      Exempt Environments from the Compliance Process

    • Identify Environments: Determine which environments (development, sandbox, test) do not
    • require full compliance monitoring.
    • Access Compliance Settings: Navigate to the environment management section in the
    • Developer Compliance or CoE Admin Command Center app.
    • Select Environment for Exemption: Choose environments to exempt from automated
    • compliance checks.
    • Configure Exemption Rules: Apply flags or settings to disable compliance monitoring,
    • validations, or auditing.
    • Save Changes: Confirm and save the exemption settings.
    • Verify Exemption: Test flows or apps in the exempted environment to ensure compliance
    • rules are not enforced.
    • Document Exemptions: Record exempted environments and reasons for audit and
    • governance purposes.
    • Monitor Other Environments: Continue full compliance monitoring on non-exempt
    • environments.
    • Review Periodically: Ensure exemptions remain valid and update as needed.
      • Turn On Flows
      • Access Power Automate Portal: Sign in securely with Microsoft 365 credentials.
      • Navigate to My Flows: Locate flows under Cloud, Desktop, or Solution Flows.
      • Identify Target Flow: Select the flow to activate.
      • Review Current Status: Confirm it is disabled or inactive.
      • Open Flow Details: Click the flow name to access configuration.
      • Activate Flow: Click the Turn On button.
      • Validate Dependencies: Ensure connections, variables, and connectors are correct.
      • Perform Initial Testing: Verify triggers and workflow execution.
      • Configure Monitoring & Alerts: Set up notifications for errors or performance issues.
      • Document Activation: Record flow activation for governance and audit purposes.
      • Share Apps with Makers
      • Sharing apps allows multiple users to collaborate on development, testing, and maintenance while
      • maintaining governance. Makers can edit or manage apps without compromising security.
      • Permissions should be role-based, and access should be reviewed regularly to maintain compliance.
      • Proper sharing accelerates development and fosters team collaboration.
      • Tip:
      • Assign roles carefully to prevent unauthorized edits.
      • Use environment-level security controls.
      • Document shared access for audits.

      All Environment Variables

    • Environment variables store configuration settings such as API endpoints, credentials, and feature
    • flags, ensuring apps and flows operate consistently. They allow updates without modifying code,
    • improving maintainability and reducing errors. Proper documentation and clear naming conventions
    • help manage configurations efficiently.
      • Important Note:
      • Always back up environment variable values before changes.
      • Use descriptive names for clarity.
      • Test all apps and flows after updates.
      • Key Developer Compliance Environment Variables:
      • Name	Description	Default Value
        Developer Compliance Centre URL	URL of the Developer Compliance Centre app to manage compliance settings and monitor apps	n/a
        Compliance – Apps – Days Since Last Publish	Maximum days since an app was last published; prompts makers to republish if exceeded	60
        Compliance – Apps – Shared Groups Limit	Number of groups an app can be shared with before requiring business justification	1
        Compliance – Apps – Minimum Launches (30 Days)	Number of times an app must be launched in the last 30 days to remain compliant without review	30
        Compliance – Apps – Shared Users Limit	Maximum number of users an app can be shared with before a justification is required	20
        Compliance – Chatbots – Launch Threshold	Number of chatbot launches that triggers a compliance review or business justification request	50

      How to File an Issue

    • Access the Support Portal: Log in to the official support platform or issue tracker.
    • Select Appropriate Category: Choose the module related to the issue.
    • Provide Detailed Information: Include description, steps to reproduce, screenshots, error
    • messages, and environment details.
    • Submit the Issue: Complete all required fields and submit the ticket.
    • Track and Follow Up: Monitor status, respond to queries, and verify resolution.

      Additional Resources

    • Training: Learn best practices, governance, and solution development to effectively use the Power
    • Platform.