Apps, Cloud & AI by Lukáš Oplt

Power Automate · Ownership · ALM Stop letting employees own production flows. A flow is not production-ready while its continuity depends on one person's account, license, password, role, or employment. By Lukáš Oplt 10 min read Governance Production flow ownership moving from an employee to a service principal A fragile employee identity is replaced with a managed service principal while connection references link the production flow to governed connections. EMPLOYEE ACCOUNT SOLUTION-AWARE FLOW CONNECTION REF Owner ≠ every connection SERVICE PRINCIPAL A maker builds an automation, tests it, and publishes it. Months later the maker changes role, loses a premium license, accepts a new Conditional Access policy, or leaves the company. The business process stops even though nobody changed the flow. This is not a rare technical edge case. It is a predictable ownership failure. A production automation needs an operating identity with a lifecycle designed around the process...

Power Pages · JavaScript · Security Server-side JavaScript is here. Learn the boundaries first. Power Pages server logic can move sensitive operations out of the browser. It is also a constrained platform runtime—not a small Node.js server hidden inside your site. By Lukáš Oplt 11 min read Power Pages Browser calling secure Power Pages server logic Client JavaScript sends a CSRF-protected request to a server logic endpoint, which applies web roles and table permissions before accessing Dataverse or an external API. POWER PAGES CLIENT CSRF TOKEN /_api/serverlogics/... SERVER LOGIC ECMAScript 2023 web roles · table permissions allowed domains · timeout DATAVERSE REST API Power Pages customization has long forced an uncomfortable choice: expose integration logic in client-side JavaScript, route everything through another service, or accept that a requirement does not belong in the site. Server logic adds a new option. A page can call JavaScript that runs inside the Power ...

Copilot Studio · Licensing · Governance The new harness is GA — and your Microsoft 365 Copilot licence no longer covers it. Copilot Studio now ships three harnesses. Only one of them bills you while you are still building the agent, and it bills every runtime call even for fully licensed Microsoft 365 Copilot users. By Lukáš Oplt 9 min read August 2026 HARNESS BUILD TIME RUNTIME — M365 COPILOT USER Copilot Chat harness Customise M365 Copilot with knowledge NOT BILLED INCLUDED IN USL fair usage limits apply Standard harness Topics, flows, rule-based agents NOT BILLED INCLUDED IN USL fair usage limits apply GitHub Copilot harness Agentic, end-to-end business processes USAGE-BASED authoring · evals · preview USAGE-BASED — ALWAYS BILLED Copilot Credits, no USL inclusion Source: Microsoft Copilot Studio Licensing Guide, August 2026. Two harnesses stay inside t...

Power Apps · Performance · Architecture Your app runs fine. Why is Studio unusable? A fast published app and a painfully slow editor are not contradictory. They are two different workloads—and they require two different investigations. By Lukáš Oplt 11 min read Canvas apps Power Apps runtime and authoring performance split into separate diagnostic paths A canvas app enters two paths: a healthy player and a slow authoring studio with a large dependency graph. LARGE CANVAS APP screens · controls formulas · references PUBLISHED APP Fast for users Measure data calls, rendering, network and formulas POWER APPS STUDIO Slow for makers Measure load, selection, formula editing and save A canvas app opens quickly for users. Navigation is smooth. Data operations complete in acceptable time. Yet opening the same app in Power Apps Studio takes minutes, selecting a control pauses the editor, and entering a formula feels like typing through a remote desktop connection. ...

Copilot Studio · Identity · Governance Your agent may be acting as you — not the user. A signed-in user does not tell you whose permissions a Copilot Studio tool will use. That hidden identity boundary can turn a helpful agent into a privilege-escalation path. By Lukáš Oplt 10 min read Updated August 2026 A user request passing through an agent to a tool with a different runtime identity The agent knows the signed-in user, but a tool can execute using either the user's permissions, the maker's connection, or a service identity. SIGNED-IN USER AGENT conversation identity TOOL EXECUTES USING End user Maker Service identity THESE PERMISSIONS DECIDE THE RESULT A user opens an agent in Teams, sees their name, and signs in with Microsoft Entra ID. It feels natural to assume that every action now runs with that user's permissions. In Copilot St...