The New Microsoft Security Challenge: Who Secures What Your Citizen Developers Build?

Your company may have far more developers than you think. They may not have "Developer" in their job title, but they are building Power Apps, automating processes with Power Automate, creating Power BI dashboards, connecting systems and, increasingly, using AI and agents to solve business problems. Microsoft Power Platform has made software development accessible to everyone. But there is another side to that story: who is responsible for securing everything being built?

Watch the session

This is Part 1 of The New Microsoft Security Challenge, a two-part webinar series from AvantIT and FRCI, first presented as Your Company Has Hundreds of Developers. You Just Don’t Know It Yet. The series continues live in Lisbon on 23 October: see the conference.

Prefer YouTube? Watch it there and subscribe to the AvantIT channel.

Why this is a security problem, not just an IT one

In the traditional model, software was built by a small group of developers, reviewed by IT and released through a controlled process. That model is gone. Today a finance analyst can build an approval app on a Friday afternoon, connect it to SharePoint and a third-party service, and share it with the whole department before Monday.

Nothing about that is wrong in itself. Citizen development is how many organisations finally clear their process backlog. The risk is that applications and automations multiply faster than anyone’s ability to see them: who owns them, what data they touch, which identity they run as, and what happens when the author leaves.

What the session covers

• How the traditional software development model is changing
• Why business users are becoming citizen developers
• The building blocks of Microsoft Power Platform
• How business problems become software
• The applications and automations already inside organisations
• Identity, data, connectors, governance and lifecycle
• The new enterprise attack surface
• How IT, business and security need to work together

The new enterprise attack surface

Every Power App, flow or agent is a small piece of software with an identity, access to data and connections to other systems. Multiply that by hundreds of makers and the questions pile up:

• Identity: whose credentials does a flow run under, and does it survive a leaver or a role change?
• Data: which sources can be combined, and can business data end up in a consumer service through a connector?
• Connectors: are DLP policies in place, and do they match how your teams actually work?
• Lifecycle: who reviews, updates and retires what has been built?
• AI and agents: what can an agent read and do on a user’s behalf, and who approved that?

For the practical side of the first four, our guide to Power Apps security and governance for CTOs goes deeper on DLP, access control and GDPR.

One question to take back to your organisation

What exactly is being built inside your organisation?

If you cannot answer that with an inventory rather than a guess, that is the place to start. IT, the business and security each hold part of the answer, and none of them can secure what they cannot see.

Part 2: AI-powered email threats with FRCI

The series continued with Part 2, delivered by FRCI on 1 October, which explored AI-powered email threats and Microsoft Defender for Office 365. Read the Part 2 write-up. Together, the two parts cover both sides of the challenge: what you are building, and what is coming in through the front door.

Want to know what is already running in your tenant?

AvantIT helps organisations take stock of their Power Platform estate and put governance in place without slowing makers down. Talk to our team or explore our Power Platform services.