Templates, policies and workbooks

Twelve numbered sections and two appendices, written to be adopted rather than admired. It covers who may build agents and in which environments, the approval gate before an agent talks to anyone outside the organisation, what an agent may be grounded on, who owns the credit budget, what has to be true before an autonomous action runs, and when an unused agent gets switched off. The clauses are specific enough to disagree with, which is the point. A policy nobody can argue with is a policy nobody has read.

• A completion table at the front for organisation, policy owner, effective date and review date
• An absolute prohibition on grounding an external-facing agent in tenant Graph data, and the reason it is absolute rather than advisory
• A mandatory monthly credit cap per agent, because Microsoft disables custom agents across the whole tenant at 125% of prepaid capacity
• Human-in-the-loop rules split by action class: read-only, reversible write, irreversible
• Testing and evidence before publication, including a measured cost per conversation rather than a forecast
• A roles table covering agent owner, environment admin, data owner, security and budget owner
• Agent register fields, and a publication approval record with signature lines

Who it is for. A platform lead or CoE who has been asked for an AI governance policy this quarter and does not want to start from an empty document.

The twelve months before a renewal, in the order the work has to happen: twelve months out, six, three, one, and the two weeks before signature. Every phase is a list of checkboxes you can actually tick. Most of the money is decided in the first six months, before anyone says the word discount, which is why the early phases are the long ones. It deliberately contains no prices. Microsoft's list moves, and yours are whatever your agreement says.

• Five timed phases with concrete actions, from pulling dated usage exports to reading the order form line by line
• Twelve questions to put to Microsoft or your partner in writing, phrased so that a written answer is either accurate or their problem
• What is genuinely negotiable, what sometimes is, and what never is
• The Dataverse capacity trap: entitlement accrues per licence, so cutting seats can create an overage that costs more than the saving
• A reminder to diary the notice period for the next renewal on the day you sign this one

Who it is for. Whoever owns the renewal number, and the architect who will be asked halfway through whether the estate can survive the proposed cut.

One page an architect can hand to a steering group without a covering deck. The four-environment shape with who builds and who administers each, why the default environment has to be governed rather than ignored, a naming convention, the promotion path, and the five decisions that actually need a meeting. Fitting it on one page is the discipline. Anything that would not fit was not one of the five decisions.

• The default, development, test and production shape in a single table
• Why the default environment is the strategy: it cannot be deleted, every licensed user is a maker in it, and it is where most of your flows already are
• The sequencing warning nobody gives you: measure, warn, then enforce, because a DLP policy applied without notice suspends live flows silently
• A naming convention and the promotion path in one line each
• Five decisions worth a meeting, including one production environment or one per product

Who it is for. An architect who needs a steering group to make five decisions in forty minutes.

A working review rather than a dashboard. Six sheets with live formulas: licence inventory with assigned against active, Dataverse capacity priced at Microsoft's add-on rates, Copilot credits costed at both the prepaid and the pay-as-you-go rate, a findings log, and a summary that pulls the annual number out of each sheet. Shaded cells are yours to fill in; everything else recalculates. The read me tells you exactly where in the Power Platform admin center each number comes from.

• Licence inventory with monthly and annual waste calculated from assigned minus active
• Dataverse capacity priced per gigabyte per month, with the tenant default entitlement table for reference
• Copilot credits at both rates, with the packs required and the credit count at which agents get disabled
• A findings log with dropdowns, worked examples of a good row and a bad one
• A summary that refuses to add two totals together, because findings restate the sheets and double counting is worse than no total

Who it is for. Anyone who has been asked to find savings in the platform and would rather bring evidence than an estimate.

The worksheet you fill in six months before a renewal, while there is still time to act on what it says. One row per user, because use rights attach to a person. Two hundred rows with a recommendation dropdown, formulas for days since sign-in and for the saving each recommendation implies, and a counter at the top so you can see how many rows still say Investigate. The third sheet is the one that saves money: eleven use-rights traps, each with what people assume, what actually applies, and how to check it.

• Columns for licences assigned, last sign-in, the apps and flows the user actually owns, and whether their usage sits inside their licence
• A Keep / Downgrade / Remove / Investigate dropdown, with monthly and annual saving calculated from it
• Dynamics 365 dual-use rights: included Power Platform use applies in the context of that application, not to any app the user touches
• Team Member is defined by a use-rights list, not by what the software will let someone click
• Multiplexing does not remove the need to license the humans behind the service account
• Attach licences carry no separate API request allocation of their own

Who it is for. Whoever has to defend the seat count, and the person who will be asked to prove it afterwards.

A starting classification for the well-known connectors across Business, Non-business and Blocked, with a rationale for every row, a note on what would move it, and a confirmed-by column that stays empty until a human signs it. Every connector named is a real published connector. It is a starting point and says so loudly: Microsoft ships and renames connectors constantly, so reconcile it against your own tenant's list before you enforce anything.

• Three group sheets with a written rationale and a move it if column for every connector
• The two policy settings people forget: the custom connector URL pattern catch-all, and the default group for connectors that do not exist yet
• Why blocking HTTP is the highest-value decision on the sheet and the one most likely to break something on day one
• The default-environment problem, and why a tenant-wide policy that excludes it protects the places that were already safe
• A recommended three-policy scoping: tenant baseline, default and personal, production

Who it is for. The admin who has been told to put DLP in place and has worked out that the hard part is scope, not the connector list.