Overview
Capricorn Society engaged Arinco to strengthen governance across Microsoft Power Platform and Microsoft Copilot Studio, so teams could continue building low-code and AI solutions with clearer controls and less operational risk.
Arinco delivered a practical uplift across environment strategy, data loss prevention, application lifecycle management, connection ownership, Copilot governance and monitoring. Capricorn now has stronger visibility, safer data and integration controls, and a more reliable foundation for future Power Platform and AI growth.
About Capricorn Society
Capricorn Society is Australasia’s largest member-owned automotive aftermarket cooperative, supporting members and preferred suppliers across Australia and New Zealand. Capricorn helps members run their businesses more efficiently through services such as trade accounts, supplier access, consolidated monthly expenses, rewards, equipment finance, travel services and business protection. Since 1974, Capricorn has grown from a small group of service station owners into a member-owned organisation with more than 30,000 members and over 2,000 preferred suppliers.
Business challenge
Capricorn’s use of Power Platform and Copilot Studio had grown quickly, with teams building apps, flows and agents to improve internal processes and member and supplier experiences.
As adoption scaled, Capricorn needed stronger governance, including better visibility, tighter controls around data and integrations, and clearer ownership of the apps, flows and agents teams relied on.
A review found more than 300 cloud flows, including around 130 active flows, plus a growing number of Copilot Studio agents. Many business-critical and semi-critical workloads sat in the default environment, making control, monitoring and change management harder.
Capricorn also needed more consistent data loss prevention controls, with clearer rules for data movement, connector use, custom connectors, HTTP actions and Microsoft Graph calls.
Continuity and release management risks also needed attention. Some production apps and flows relied on unclear connections, while deployment practices made consistent change management harder and increased the risk of solution drift.
As Copilot Studio use increased, Capricorn needed a clearer way to manage AI agents across inventory, ownership, environment placement and lifecycle control.
Capricorn needed an experienced partner to help bring structure to its fast-growing low-code and AI estate, while keeping live services stable and teams moving.
Solution
Capricorn partnered with Arinco to scale Power Platform and Copilot Studio with stronger control, clearer ownership and less operational risk, while protecting the live apps, flows and agents already used across the business.
Creating a clearer view of platform risk
Arinco reviewed Capricorn’s Power Platform and Copilot Studio estate across more than 73 environments, covering over approximately 10300 solution components including flows, agents, power pages and Power Apps. This gave Capricorn a clearer picture of what existed, where it lived, how it was used and which areas needed attention first.
The review focused on the default environment, high-use flows, low-success workloads, solution checker findings, personal connections, connection references and data loss prevention impacts across development, staging and production. This helped Capricorn prioritise risk and decide where stronger governance was needed.
Reducing data and integration risk
Arinco designed and supported environment-specific data loss prevention policies, helping Capricorn move from broad connector access to approved connector lists matched to each environment.
Controls were tested in non-production first, then introduced into production with monitoring and support. Higher-risk changes were scheduled during lower-impact windows to protect live processes.
Arinco also helped define an exception process for future connector or endpoint changes, giving Capricorn a clearer way to manage data movement and integration risk as requirements emerge.
Making change safer and more repeatable
Arinco reviewed custom connectors, HTTP actions and Microsoft Graph calls, clarifying the risks of broad domains or wildcard access. New API endpoints were recommended as formal integration changes, with review, documentation and approval before release.
Arinco also reviewed Capricorn’s application lifecycle management approach and advised on a more consistent release model, addressing manual solution movement, unmanaged changes, dependency issues and unclear source-of-truth ownership.
A target model using GitHub, Octopus Deploy and/or Power Platform Pipelines gave Capricorn a clearer path to repeatable production change. Azure API Management was identified as a longer-term option for API security, visibility and control.
Preparing AI agents for managed growth
As Copilot Studio use grew, Arinco helped Capricorn define stronger controls for agent inventory, ownership, environment placement and lifecycle management.
Arinco supported planning for the Copilot Studio Kit and Creator Kit in non-production to improve reporting and test automation, and helped validate contact-centre agents when admin analytics showed unexpected results.
This gave Capricorn a stronger foundation for managing AI agents as adoption grows, without relying on informal ownership or ad hoc controls.
Protecting business continuity
Arinco helped Capricorn improve Power Platform administration and reduce service disruption risk, including solution checker enforcement across managed environments and future enforcement through pipelines.
Arinco also recommended moving from broad tenant-level access to environment-specific roles. Where production components relied on accounts due to be removed or downgraded, Arinco flagged the risk and recommended service accounts, enterprise-app patterns and cleaner connection references.
Project delivery
Arinco supported change planning, stakeholder communication and post-change monitoring. Clear rollout communications explained why each control was being introduced, what teams needed to test and how to report issues, helping Capricorn strengthen governance with less disruption.
Outcomes
The engagement gave Capricorn a stronger foundation for scaling Power Platform and Copilot Studio safely. The main outcomes centred on better visibility, reduced risk, stronger ownership and more reliable change:
- Clearer decision making: Capricorn now has a more complete view of its Power Platform and Copilot Studio estate, making it easier to understand what exists, where risk sits and what needs attention first.
- Reduced data movement risk: Stronger data loss prevention controls now give Capricorn clearer rules for connector use, data movement and integration approvals.
- More reliable business operations: Service continuity risks linked to personal connections, privileged accounts and unclear production ownership were identified, giving Capricorn a clearer path to more reliable production operations.
- Safer change across live services: Governance changes can now be introduced with more confidence, supported by staged testing, communication and monitoring.
- More consistent release management: A clearer model for managed solutions, release ownership, solution checker enforcement and pipeline-based deployment now supports more predictable change.
- Stronger AI governance foundations: A clearer view of the Copilot Studio footprint gives Capricorn a practical path for managing agent ownership, environment placement and lifecycle controls.
- Greater confidence to keep innovating: Teams can continue using Power Platform and Copilot Studio to improve internal processes and member and supplier experiences, with stronger controls and less operational risk.
What's next?
Capricorn is now in a stronger position to continue maturing its Power Platform operating model. The next stage is expected to focus on sustainable governance, maker enablement, monitoring and secure integration patterns. This may include further development of a Power Platform centre of excellence, stronger application lifecycle management, hardened data loss prevention controls and clearer Copilot Studio governance.
These foundations will help Capricorn continue scaling low-code and AI initiatives in a controlled way, while supporting better experiences for members and preferred suppliers across Australia and New Zealand.
