Microsoft has made its Power Automate Desktop tool free for all Windows users. However, experts warn it could lead to an increased risk of shadow IT.
Launched in September 2020, the enterprise-level robotic process automation (RPA) tool comes with 370 prebuilt actions that allow non-coders to create software to automate repetitive and time-consuming tasks in Windows 10.
Low-code/no-code applications, which can take the form of a ‘drag and drop’ interface, have been championed as a democratising tool for organisations, albeit usually by the vendors flogging them. They’ve also been touted as a solution to the global developer shortage.
Microsoft has previously called Power Automate Desktop a solution that makes “automation more accessible by empowering everyone to optimise how they work”.
So far, so good. But beyond the buzzwords, some experts fear Microsoft’s quest to empower users could cause headaches for already-stretched IT teams.
Around the block
From 2 March Power Automate became free for anyone to use, irrespective of whether an organisation chooses to use it. Significantly, IT admins have no way of blocking its use.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataIT teams can disable the license, but according to Microsoft this will have “no effect on a user’s ability to create flows”. The license will simply become active again when the user next logs in because the relationship is between the individual and Microsoft – not Microsoft and the organisation.
The crucial detail is explained in a Microsoft blog post saying: “Power Automate is a fully public cloud service, and everyone in the world can sign up and use it to automate their day-to-day tasks. To use Power Automate there is no requirements that users have or use an Office 365 account. Because of this, there’s no mechanism at this time for you to block another person from using Power Automate (as everyone in the world can, irrespective of their email address).”
That last sentence has raised concerns among IT professionals. They worry that it could increase the likelihood of shadow IT, which a term describing how employees use systems outside the remit of the central IT department.
“The decision to make Power Automate free provides that low-code/no-code automation that will help customers streamline processes without the need for development costs,” Ben Simpson, lead ITAM consultant at software asset management firm License Dashboard, tells Verdict. “However, because this is open to all users, the possibility of shadow IT becomes inevitable. As with all online services, it’s easy for organisations to lose control of services utilised.”
Microsoft Power Automate: Empowering mistakes?
Why does this matter? Those familiar with shadow IT will be well aware of the potential pitfalls, from declining productivity to wasted investments. Employees could end up building solutions with inconsistent approached that end up making more work in the long run. They could also create problems around data security and privacy.
For example, an employee might flex their creative muscles and build a bespoke automated marketing platform using Microsoft’s RPA solution. However, the person building it might not be fully aware of data laws such as the European Union’s General Data Protection Regulation (GDPR) that would normally be handled by a dedicated team. These rules are important to know as using tools like Microsoft Power Automate could potentially increase the danger of company data being leaked, raising the risk of the company being slammed with massive fines.
Microsoft Power Automate may well “empower” the way people work, but it could also empower them to make costly mistakes.
“There’s going to be a delicate balance between organisations wanting to give the freedom to users to maximise their investment in technology, whilst still needing to retain visibility and control for GDPR and data security purposes,” warns Simpson. “Businesses will have to find a way to secure their data but still encourage users to leverage their investment to drive efficiency and improve working processes, without stifling their creativity.”
However, it’s worth pointing out that organisations can use Microsoft’s data loss prevention policies to prevent employees from using company data within Power Automate. This can be switched on by IT to create policies about specific users and data.
“Protecting the integrity and confidentiality of sensitive information should be on the radar as organisations embrace these tools, especially as this new capability allows people to share more data at a higher rate,” Gavin Ashton, security strategist at data governance firm Stealthbits, tells Verdict. “Of course we don’t want to restrict productivity or innovation, but prioritising placing controls like data access governance, information protection, and data loss protection around sensitive data in particular will help organisations ensure they are covered from a regulatory perspective globally, while protecting their employees and their data.”
Microsoft does have another partial solution – for those prepared to reach for their wallets. Per its blog post, customers can pay for its ‘Attended RPA’ plan, which comes with bells and whistles such as 400 built-in connectors and collaboration tools. Crucially, it also gives organisations on this tier the option to centrally manage and control how the tool is used.
However, according to Bola Rotibi, research director of software development at research firm CCS Insight, making Power Automate free is a “smart move by Microsoft” and argues that it “delivers on Microsoft’s underpinning ethos for proactive governance”.
He points to Microsoft’s existing “integrated end-to-end governance and management framework” as a safeguard that IT admins can fall back on to reduce the risk of shadow IT.
“It is this tie into the established IT governance and management solutions already used by so many organisations that makes it a formidable barrier to shadow IT,” Rotibi tells Verdict.
Microsoft did not return requests to comment on this story.
Read more: Microsoft Teams gets end-to-end crypto, no matter what the Five Eyes say
