When low-code stops being a handful of clever experiments and starts becoming an enterprise capability, your governance has to catch up. Here’s how to tell when that moment has arrived — and what to do about it.

Power Platform doesn’t always arrive with a bang. It builds slowly, gaining traction as pockets of people start testing the waters and automating the processes that have always relied on spreadsheets, emails and hours of manual work. A finance analyst spins up an app that saves their team three hours a week. Someone in operations automates a notoriously complicated process. It works, word spreads, and suddenly there are dozens -then hundreds – of apps, flows and bots running across the business.

The challenge comes with the scaling. One day you look up and realise nobody can say with confidence what’s been built, who owns it, what it’s connected to, or what would happen if the person who made it left. That’s the moment low-code stops being a productivity win and starts being an operational, security and financial question.

This is exactly what a Power Platform Centre of Excellence (CoE) is designed to solve. Before we get to the signs, it’s worth being clear about what a CoE actually is.

First, what is a Power Platform Centre of Excellence?

A Centre of Excellence is an operating model, not simply a tool you install or a dashboard you switch on. It’s the people, standards, guardrails and shared ways of working that let an organisation use Power Platform in a way that’s sustainable, scalable, secure and tied to real business outcomes.

In simple terms, it’s Power Platform governance. How do we keep data safe? Who’s allowed to build what? How do we control cost? Governance is a huge part of a CoE – but it isn’t the whole thing. A good CoE balances two sides that usually get treated as opposites:

Enablement – helping more people build, faster, with reusable components and proper support, so makers aren’t reinventing the wheel.

Control - environment strategy, data loss prevention (DLP), ownership, lifecycle management and cost visibility, so growth doesn’t turn into risk.

Microsoft’s own adoption guidance frames it the same way: a CoE exists to make the platform safe to scale, not to slow innovation down. The trick is knowing when you’ve crossed from “a few people experimenting” into “we genuinely need a CoE.”

Here are the seven signs we see most often.

1. Your adoption is growing faster than your governance model

This is the clearest signal of all, and it’s almost always the first.

When Power Platform starts expanding at enterprise scale, the challenge moves from ‘can people build’ to ‘can we control what people build’. The platform begins spreading faster than any single governance model can keep up with. Growth becomes the success and the risk.

Organisations want citizen developers, digital champions and business teams to keep momentum high, but that growth still needs to sit on top of a clear central model for governance, cost and security. Otherwise, adoption runs ahead of control.

The sign: the platform is spreading, but the operating model hasn’t caught up. If adoption charts are going up while your governance is still “a few rules in someone’s head,” you’re already in CoE territory.

2. Critical processes are still manual and fragmented — so low-code is a patch, not a system

There’s a difference between using Power Platform to fix things and using it to build a capability.

The problem usually starts with manual processes, duplicated effort and siloed data limiting productivity and decision-making. Low-code then starts solving local pain, but every fix becomes its own island. Teams modernise line-of-business apps, digitise repetitive work and simplify data capture, but without shared standards they rebuild slightly different versions of the same thing, over and over.

When Power Platform is relieving pain in pockets but creating inconsistency across the enterprise, you don’t have a building problem, you have a system problem. A CoE turns scattered fixes into a shared, reusable capability.

The sign: every team has its own version of everything, and nobody’s reusing anyone else’s work.

3. Security, compliance and DLP concerns are no longer “future problems”

For anyone in IT or risk, this is where the conversation gets serious.

Rapid expansion raises real security and governance questions. The answer is to put environment strategy, security roles, DLP, identity controls and automated governance in place before large-scale production use – not after something goes wrong. Typical requirements quickly start to look like a governance checklist: approved versus non-business connectors, Entra ID integration, MFA, DLP policies, disaster recovery, and a plan for the reactive issues that always emerge, from orphaned apps to sudden cost spikes.

These aren’t edge cases. The moment business-critical data is flowing through citizen-built apps and connectors nobody’s reviewed, data leakage and weak auditability become a real risk.

The sign: IT is genuinely worried about uncontrolled connectors, where data is going, or whether you could pass an audit. If that worry exists, the case for a CoE is already made.

4. You can’t clearly see what exists, who owns it, what it costs, or what value it creates

In more mature estates, visibility gaps can become surprisingly large: multiple environments, legacy DLP approaches, orphaned apps, unclear ownership and inconsistent cost data. That’s why organisations quickly start asking for dashboards that expose cost, usage, performance, orphaned apps, cost spikes and the activity figures that underpin ROI.

This matters because of scale. It’s not unusual for an organisation to have hundreds, thousands or even tens of thousands of apps and flows – and yet only a small handful of success stories ever get measured or told. If you can’t see the estate, you can’t govern it, cost it, or prove it’s worth the investment.

The sign: nobody can confidently answer what’s running, who owns it, what it costs, and what value it delivers. When that’s true, you’re past the point where a spreadsheet will save you.

5. Apps are reaching production, but lifecycle management and support are inconsistent

There comes a point where a maker’s side-project becomes something the business depends on.

This is often where low-code maturity is most visible. Early on, makers may support their own apps, with few rules about when IT or the business should step in. As the estate grows, the need becomes more structured: application lifecycle management (ALM), deployment pipelines, version control, end-of-life processes, clarity on ownership and service accounts, impact analysis, migration strategy and formal sign-off.

That’s the difference between a maker experiment and a production lifecycle. Once apps are load-bearing, “the person who built it will fix it” is not a support model.

The sign: business-critical apps are in production, but there’s no consistent way to deploy, support, version or retire them.

6. Leadership wants a measurable ROI story, not just interesting anecdotes

Eventually, someone senior asks the obvious question: ”What are we actually getting out of all this?”

This is where our work with Warner Bros. Discovery (WBD) is a useful reference point, because the story moved past generic “digital transformation” language into measurable outcomes: faster processes, less manual effort and cost savings built on a governed low-code foundation. WBD were able to make manual processes up to 20x faster, and save a huge $1.5m over four years with the successful introduction of a CoE.

That’s not a one off, either. We see the same patterns shows up elsewhere: efficiency, reuse, better decisions, and a credible path from one-off pilots to repeatable value.

A CoE is what makes that story repeatable rather than lucky. Microsoft’s guidance is blunt about it: a CoE should start with a clear vision, metrics and goals, precisely because measuring and communicating value is how you prove return on investment.

The sign: leadership is asking what Power Platform is delivering – and the answer changes depending on who you ask.

7. Copilot and agents are entering the same estate – and raising the stakes

Apps and flows are no longer the whole picture. Copilot and AI agents are arriving in the same environments, touching the same data, governed (or not) by the same policies. Some organisations are already planning for governed Copilot Studio adoption, while others are finding their early agentic AI initiatives are unplanned, experimental, inconsistent and siloed. In the most mature cases, agents are being brought into the same DLP, ALM and monitoring model as the rest of the Power Platform estate.

The moment apps, flows, Copilot and agents all live in one operational estate, governance stops being a nice-to-have and becomes core enterprise control. AI doesn’t replace the need for a CoE – it raises the price of not having one.

A quick word on the Copilot Centre of Excellence

If sign seven resonated, you’ve spotted something important: a Copilot Centre of Excellence is fast becoming the natural companion to a Power Platform CoE.

For some organisations, this will sit naturally inside an existing Power Platform CoE. For others, it will need to be structured and governed as a Copilot Centre of Excellence in its own right. The important point is that the two conversations are becoming increasingly connected. Copilot governance brings specific questions around data grounding, agent oversight, responsible AI and where automation should, and shouldn’t, make decisions. But it also relies on many of the same foundations as Power Platform governance: environments, DLP, identity, monitoring and a culture of governed enablement. So whether you call it a Power Platform CoE, a Copilot CoE, or an evolution of both, the goal is the same: helping people innovate safely, consistently and with proper control.

A Centre of Excellence isn’t there to slow you down

The one thing worth remembering through all of this is the people. The maker who built something actually useful for their team. The IT lead awake at 2am wondering what’s connected to what. The leader who has to justify the spend. A CoE serves all three.

It exists to make innovation safe, measurable and repeatable - to let more people build, with more confidence, while the organisation keeps a clear view of cost, risk and value. Done well, it’s the opposite of bureaucracy. It lets you say yes to more ideas, because you finally have the guardrails to support them.

At Silicon Reef, this is the work we do every day – from helping Warner Bros. Discovery scale Power Platform safely and remediate an estate that had grown faster than its governance, to building governed foundations for manufacturers, life sciences organisations and public sector teams getting ready for an AI-enabled future. The pattern is remarkably consistent. The organisations that thrive aren’t locking low-code down, or letting it run wild. They’re finding the balance.

If two or three of these signs felt a little too familiar, that’s usually the moment. We’re always happy to talk it through.