RIMPA 2023: Managing information in low-code applications

Published October 2023

In this blog we share a summary of Andrew Jolly’s presentation from RIMPA Global 2023: ‘Managing Information in Low-Code Applications’.

Engage Squared sponsored, attended and presented at the RIMPA Global 2023 conference on the Gold Coast, Australia. RIMPA is a leading organisation that represents Records and Information Management Practitioners worldwide and has a strong presence in Australia. This year’s conference was different to previous years as RIMPA combined the conference with DAMA Australia. DAMA Australia is part of the worldwide network of more than 60 DAMA chapters which form DAMA International – an organisation dedicated to improving and promoting the field of Information Management.

The coming together of RIMPA and DAMA is a reflection of where the information management disciplines are in the modern contemporary landscape of rapidly evolving information and technology. The content of the conference was suitably diverse with sessions ranging on issues of records management and data management through to AI and aspects on how the industry looks to adapt and change to meet the needs of organisations, society and individuals.

Engage Squared was fortunate enough to present two topics at the conference, and due to our ‘Managing Information in Low-Code Applications’ presentation being so well received, we wanted to share the session content.

Managing Information in Low-Code Applications: Techniques and Considerations for Records Management with the Power Platform

This session hosted by Andrew Jolly aimed to appeal to both audiences attending the conference, whether you were a developer, IT professional, or records management practitioner, the intent was to provide insights into the evolving world of records management within low-code applications and explore how information related to Power Platform solutions can be effectively lifecycle managed and governed throughout its lifecycle.

What does low code actually mean?

For those unfamiliar with the term, a ‘low-code application’ within the context of the Microsoft Power Platform, it’s a software application developed with minimal manual coding, using visual development tools and pre-built components provided by the Power Platform suite of tools. This approach makes application development more accessible to non-developers and enhances the ability of businesses to respond quickly to changing needs and opportunities. The Power Platform includes tools such as Power Apps, Power Automate, Power BI, and Power Virtual Agents.

According to Gartner®, “By 2026, low-code development tools will account for 75 percent of new application development.” To help build those applications, professional developers are turning to Microsoft Power Platform.”

And by ‘developers’ we also extend this definition to encompass citizen developers, those people in roles that aren’t considered developers per se but have skills to take the Power Platform capabilities and solve business problems.

Why do we want or need automated processes built with low code technology?

• Efficiency: Time saved, get through workloads faster
• Consistency: Things get done the same way (predictability, accuracy)
• Quality: Your staff can now focus on quality of outputs, responding to exceptions, streamlining, improving data quality or compliance

When implementing Power App solutions, it’s important to consider how records management technologies and techniques can be incorporated into low-code solutions to ensure the efficient handling of vital information. Records management has never been solely about documents when it comes to information management; it encompasses all types of data generated during business processes. Automated processes, especially those developed due to their significance, invariably generate essential data that must be actively managed and reported on to derive actionable insights. Generally speaking, if someone went to the trouble of making an automated process there’s a good chance its important enough that its information ought to be managed.

It’s not only the outputs of an automated process that need to be managed, most if not all records management authorities recognise that such systems provide indicators about the stage of a process and fields to capture vital information throughout the process. For example NSW State guidelines stipulate:

“That in order to be authoritative, records and information must possess metadata recording the business actions and events involving records and information throughout their existence. This metadata must include the date and time of the actions, changes to the metadata and the agents undertaking the actions. Records and information that do not possess such metadata lack the characteristics of authoritative records.”

So, how do you go about capturing and preserving information about the actions taken throughout an automated process. Firstly let’s understand how a low code application comes together?

• Interfaces: Low code apps can include a number of types of interfaces, these may be as simple as a native SharePoint List item form and the view interfaces, it might be a document with metadata that could constitute your interface, Microsoft Forms can also provide simple input capture experiences and of course for the more comprehensive interfaces Power Apps is extremely versatile and can deliver on almost any interface and user experience need.
• Logic: The business logic that orchestrates a low code application is typically contained within one or more Power Automate flows, Power Apps also can contain business logic and processing and will often work in conjunction with Power Automate depending on the needs and steps of a business process.
• Data sources: Power Automate and Power Apps can connect to a wide range of data sources, its native data store is the Dataverse, but common connections to other data sources  include SharePoint Lists and Libraries, SQL Databases and connections other line of business systems, in fact there are over 400 connectors for the Power Platform and this increases weekly.
• Information governance: For low code apps that include information stored within SharePoint Online you can ensure that records are properly classified, retained, and protected in compliance with relevant laws and regulations, as well as your organisation’s policies and procedures. Soon to be generally available is retention policies for data within the Dataverse which is a great step forward for information governance within native Power Platform applications. Low code applications that store data in both SharePoint and Dataverse will have good coverage when in comes to retention and governance of information in these data stores.

Depending on your solution you may have ‘document’ outputs, or data output to list items or other data stores such as Dataverse. If your app is outputting documents or capturing process data into SharePoint Online, Microsoft Purview provides a great set of capabilities to bring information governance to your apps information. Below is an example of a course certificate generator app:

• The interface is provided by a Power App
• Power Automate is responsible for obtaining approval from a course instructor and converting a generated word document to PDF
• SharePoint Online provides the storage mechanism for the converted PDF
• Microsoft Purview provides a label that is applied to the generated PDF certificate as part of the Power Automate process.

What about the metadata captured along the way?

For those familiar with Microsoft 365 audit capability will know that a significant amount of telemetry is captured during normal operational use, while it is useful it doesn’t always offer the context required and can be somewhat of a forensic exercise to build up a picture of what has happen to a document, also depending on your Microsoft 365 licensing unless your organisation is capturing and preserving the audit log data then it may only be retained for a limited number of years. As part of this certificate issuing process we’re interested in:

• Who issued the certificate and when
• Which course instructor approved it
• When the PDF was emailed to the student

All these data points are important in the creation of the certificate, for if there was ever an issue with the certificate holder, an investigation could easily demand that this information is provided in an investigation.
With the flexibility of the Power Platform, you have a number of options when considering how to capture process related metadata.

• As part of the document metadata: Using a technique when constructing Power Automate, it’s possible to ‘collect’ metadata or events into a workflow variable and write this information to a column of the document’s content type during the process or at the final steps of the automate process. The benefit of this approach is that the metadata is right there with the document and easy to find.
• As part of a separate file: Depending on the process, it might not be practical to cram loads of process metadata into a single field, there may also be other reasons why it might not be right to store the metadata directly against the item. In these situations, once again Power Automate can be used to capture metadata throughout the process and either store it to a SharePoint list or compile it to a text, html, JSON or PDF file for storage in a separate library. Metadata can be used to relate these outputs together.
• As part of the document content: If you’ve ever been a participant in the process of obtaining digital signatures on a document you may have seen some of the technologies output the signed PDF with an additional page appended to the end of the document. With Power Automate premium actions which offer advanced PDF functions these types of results are possible.

What about records management, how can we ensure we’ve got sufficient control and governance for the information?

Microsoft Purview provides Retention Labelling capabilities which allow you to set a retention period on the item.
If you’re E5 licensed, a label can ensure that an item of content is retained for defined period of time before it comes up for disposition review by Information or Records Managers. With E5 licensing a label can be configured as a default on the library or list you’re using to capture outputs.

If you’re E3 licensed, a label can ensure that an item of content is retained for a defined period of time before either retention is not longer applied or the item is destroyed, what E3 doesn’t include is a disposition review option. When it comes to applying the label to outputs it is not possible to set a default retention label for your libraries or lists however, it is possible to achieve a form of automatically applying the label using an action in your Power Automate flow known as the ‘Http request to SharePoint’. This is a non-premium action and with the help of the SharePoint REST API it’s possible to use the ‘SetComplianceTag’ endpoint to apply the label you want, in the example below the Retention Label of Accreditation is being applied to document, the action locates the document in a certificates library by its ItemID.

This is also useful even with E5 licensing, as depending on the type of information output by the application you may have a need to apply different labels.

What about apps that don’t write outputs to SharePoint libraries or lists?

Lots of modern Power Platform solutions utilise what are known as model driven applications, these utilise the Microsoft Dataverse, which is a data platform provided by Microsoft for use with the Power Platform and other Microsoft applications, It allows for secure storage and management of data in the cloud and integrates easily with a range of applications and workflows. Dataverse supports a variety of data types, including text, numbers, dates and more and it provides a common data model that makes it easier to build and deploy applications. It also includes tools for analysing and visualising data and creating custom business logic.

Microsoft Purview’s retention policies currently don’t extend out to the Microsoft Dataverse, however currently in preview are Dataverse Retention policies and long term archiving of Dataverse data. This means that the Dataverse as a ‘System of record’ will be soon include capabilities that will allow management of data long term.

Microsoft Dataverse supports custom retention policies to securely retain unlimited data long term in a cost-efficient way. While Dataverse can support your business growth with no limit on active data, you might want to consider moving inactive data to the Dataverse long term retention store. For a great overview of this capability Microsoft provide a great overview of the capability here.

My organisation has built a number of low code applications, have we missed the boat?

Not at all! If you remember back at the start of this article, the beauty of low code applications is that they’re meant to support modification and extension in response to changes in business need. In fact depending on the application changes may be simpler that you think.

Like what you see?

If this post has inspired you to take a look at your organisation’s use of Power Apps and how you can apply records management capabilities or if you’ve got broader questions about records management with Microsoft 365 we’d love to chat.