Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Rename and Clarify 'Sample Audit Process' #2288

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 10 additions & 12 deletions power-platform/guidance/coe/example-processes.md
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
title: "Example App auditing process | MicrosoftDocs"
description: "The App auditing sample process showcases how your CoE department or IT administrators can automate an auditing process on an app-level basis to gather additional information about an app, like business justification and impact of an outage, from the maker."
title: "Example App Review Process | MicrosoftDocs"
description: "The app review ample process showcases how to streamline the app review and auditing process to gather compliance information about apps before promoting widespread use."
author: manuelap-msft

ms.component: pa-admin
Expand All @@ -12,28 +12,26 @@ ms.reviewer: sericks
search.audienceType:
- admin
---
# App auditing process
# App Compliance Review Process

The components in the Center of Excellence (CoE) Starter Kit are designed for multiple uses. The example process in this article, which uses the starter kit components, is meant to showcase common patterns other organizations have found useful and—hopefully—act as inspiration for defining your own processes.

The app auditing sample process showcases how your CoE department or IT administrators can automate an auditing process on an app-level basis to gather additional information about an app, like business justification and the impact of an outage, from the maker.
This sample process showcases how your CoE department or IT administrators can automate an app-level process to gather, review, and audit compliance information from makers about apps, such as business justification and the impact of an outage, before adding the app to the app catalog for widespread use. It is meant to demonstrate a pattern other organizations have found useful and act as an example for defining your own process.

> [!NOTE]
> Follow the [setup compliance components](setup-governance-components.md) steps to configure this process. More information: [Compliance process](governance-components.md#compliance-processes)

## Process description
## Process Description

**Problem statement:** There are many apps in the Contoso tenant. IT doesn't know what all these apps are intended for or how to support individual apps when the helpdesk is called, and it's unclear whether all the apps are being maintained to any standard. They can see details like the description and number of shared users from the Power Apps for Admins connector, but they need to communicate directly with the app owner to fully understand the situation around the apps. Especially in a large organization like Contoso, it's not feasible for the IT team to be responsible for manually reaching out to each app owner individually, and those details can't be stored in email conversations. The Contoso team would like to have a central app catalog for high-quality apps.

**Solution:** The CoE has decided there should be an auditing process on an app-level basis, using Microsoft Dataverse as a data store for the business justifications. They decide to use apps and flows to facilitate this process.
**Solution:** The CoE has decided there should be a review and auditing process on an app-level basis, using Microsoft Dataverse as a data store for the business justifications. They decide to use apps and flows to facilitate this process.

The flow named Admin \| Compliance Detail Request is used to iterate through all the apps in the tenant and check whether the apps are compliant. If the owner hasn't submitted a business justification and the app was shared broadly (in this example, with more than 20 users or at least one group), the flow sends the owner an email to notify them that their specific app isn't compliant with Contoso's policy. The email contains a link to the Developer Compliance Center canvas app, where the owner can provide the business justification details in a form submission. The Developer Compliance Center app also contain details about the compliance thresholds and has links to the app settings, so the owner can configure the description and republish if needed.

After the maker has proven compliance by adding these details, the admin can review those details and the app itself. A business process flow in the Power Platform Admin View (model-driven app) helps facilitate the auditing process.
After the maker has proven compliance by adding these details, the admin can review those details and the app itself. A business process flow in the Power Platform Admin View (model-driven app) helps facilitate the process.

When reviewing the app compliance details, the admin can make a decision about whether the app belongs in the app catalog.

## The user's view of the process
## The User's View of the Process

Here is that process from the point of view of the people involved and the components they interact with.

Expand All @@ -47,11 +45,11 @@ Three items are tracked in the system, and the user might have to do all three:

- Add supporting details, such as the business justification.

![Maker point of view in the audit process.](media/coe55.png "Maker point of view in the audit process")
![Maker point of view in the App Review process.](media/coe55.png "Maker point of view in the App Review Process")

**Admin:** After an app meets all three of these requirements, it appears in the **Compliance - Submitted** filter view on the **Power Platform Admin View** model driven app.

![Admin point of view in the audit process.](media/coe71.png "Admin point of view in the audit process")
![Admin point of view in the App Review process.](media/coe71.png "Admin point of view in the App Review Process")

An admin opens **Power Platform Admin View** > **Compliance - Submitted** and assesses all the apps due for review by looking at the **Audit** tab within the app, investigating the work done by the maker, and then marking their assessment in the **Compliance - Submitted** section.

Expand Down