RIMPA 2023: Managing information in low-code applications
Published October 2023
Engage Squared sponsored, attended and presented at the RIMPA Global 2023 conference on the Gold Coast, Australia. RIMPA is a leading organisation that represents Records and Information Management Practitioners worldwide and has a strong presence in Australia. This year’s conference was different to previous years as RIMPA combined the conference with DAMA Australia. DAMA Australia is part of the worldwide network of more than 60 DAMA chapters which form DAMA International – an organisation dedicated to improving and promoting the field of Information Management.
The coming together of RIMPA and DAMA is a reflection of where the information management disciplines are in the modern contemporary landscape of rapidly evolving information and technology. The content of the conference was suitably diverse with sessions ranging on issues of records management and data management through to AI and aspects on how the industry looks to adapt and change to meet the needs of organisations, society and individuals.
Engage Squared was fortunate enough to present two topics at the conference, and due to our ‘Managing Information in Low-Code Applications’ presentation being so well received, we wanted to share the session content.
This session hosted by Andrew Jolly aimed to appeal to both audiences attending the conference, whether you were a developer, IT professional, or records management practitioner, the intent was to provide insights into the evolving world of records management within low-code applications and explore how information related to Power Platform solutions can be effectively lifecycle managed and governed throughout its lifecycle.
What does low code actually mean?
For those unfamiliar with the term, a ‘low-code application’ within the context of the Microsoft Power Platform, it’s a software application developed with minimal manual coding, using visual development tools and pre-built components provided by the Power Platform suite of tools. This approach makes application development more accessible to non-developers and enhances the ability of businesses to respond quickly to changing needs and opportunities. The Power Platform includes tools such as Power Apps, Power Automate, Power BI, and Power Virtual Agents.
According to Gartner®, “By 2026, low-code development tools will account for 75 percent of new application development.” To help build those applications, professional developers are turning to Microsoft Power Platform.”
And by ‘developers’ we also extend this definition to encompass citizen developers, those people in roles that aren’t considered developers per se but have skills to take the Power Platform capabilities and solve business problems.
Why do we want or need automated processes built with low code technology?
When implementing Power App solutions, it’s important to consider how records management technologies and techniques can be incorporated into low-code solutions to ensure the efficient handling of vital information. Records management has never been solely about documents when it comes to information management; it encompasses all types of data generated during business processes. Automated processes, especially those developed due to their significance, invariably generate essential data that must be actively managed and reported on to derive actionable insights. Generally speaking, if someone went to the trouble of making an automated process there’s a good chance its important enough that its information ought to be managed.
It’s not only the outputs of an automated process that need to be managed, most if not all records management authorities recognise that such systems provide indicators about the stage of a process and fields to capture vital information throughout the process. For example NSW State guidelines stipulate:
“That in order to be authoritative, records and information must possess metadata recording the business actions and events involving records and information throughout their existence. This metadata must include the date and time of the actions, changes to the metadata and the agents undertaking the actions. Records and information that do not possess such metadata lack the characteristics of authoritative records.”
So, how do you go about capturing and preserving information about the actions taken throughout an automated process. Firstly let’s understand how a low code application comes together?
Depending on your solution you may have ‘document’ outputs, or data output to list items or other data stores such as Dataverse. If your app is outputting documents or capturing process data into SharePoint Online, Microsoft Purview provides a great set of capabilities to bring information governance to your apps information. Below is an example of a course certificate generator app:
What about the metadata captured along the way?
For those familiar with Microsoft 365 audit capability will know that a significant amount of telemetry is captured during normal operational use, while it is useful it doesn’t always offer the context required and can be somewhat of a forensic exercise to build up a picture of what has happen to a document, also depending on your Microsoft 365 licensing unless your organisation is capturing and preserving the audit log data then it may only be retained for a limited number of years. As part of this certificate issuing process we’re interested in:
All these data points are important in the creation of the certificate, for if there was ever an issue with the certificate holder, an investigation could easily demand that this information is provided in an investigation.
With the flexibility of the Power Platform, you have a number of options when considering how to capture process related metadata.
What about records management, how can we ensure we’ve got sufficient control and governance for the information?
Microsoft Purview provides Retention Labelling capabilities which allow you to set a retention period on the item.
If you’re E5 licensed, a label can ensure that an item of content is retained for defined period of time before it comes up for disposition review by Information or Records Managers. With E5 licensing a label can be configured as a default on the library or list you’re using to capture outputs.
If you’re E3 licensed, a label can ensure that an item of content is retained for a defined period of time before either retention is not longer applied or the item is destroyed, what E3 doesn’t include is a disposition review option. When it comes to applying the label to outputs it is not possible to set a default retention label for your libraries or lists however, it is possible to achieve a form of automatically applying the label using an action in your Power Automate flow known as the ‘Http request to SharePoint’. This is a non-premium action and with the help of the SharePoint REST API it’s possible to use the ‘SetComplianceTag’ endpoint to apply the label you want, in the example below the Retention Label of Accreditation is being applied to document, the action locates the document in a certificates library by its ItemID.
This is also useful even with E5 licensing, as depending on the type of information output by the application you may have a need to apply different labels.
What about apps that don’t write outputs to SharePoint libraries or lists?
Lots of modern Power Platform solutions utilise what are known as model driven applications, these utilise the Microsoft Dataverse, which is a data platform provided by Microsoft for use with the Power Platform and other Microsoft applications, It allows for secure storage and management of data in the cloud and integrates easily with a range of applications and workflows. Dataverse supports a variety of data types, including text, numbers, dates and more and it provides a common data model that makes it easier to build and deploy applications. It also includes tools for analysing and visualising data and creating custom business logic.
Microsoft Purview’s retention policies currently don’t extend out to the Microsoft Dataverse, however currently in preview are Dataverse Retention policies and long term archiving of Dataverse data. This means that the Dataverse as a ‘System of record’ will be soon include capabilities that will allow management of data long term.
Microsoft Dataverse supports custom retention policies to securely retain unlimited data long term in a cost-efficient way. While Dataverse can support your business growth with no limit on active data, you might want to consider moving inactive data to the Dataverse long term retention store. For a great overview of this capability Microsoft provide a great overview of the capability here.
My organisation has built a number of low code applications, have we missed the boat?
Not at all! If you remember back at the start of this article, the beauty of low code applications is that they’re meant to support modification and extension in response to changes in business need. In fact depending on the application changes may be simpler that you think.
If this post has inspired you to take a look at your organisations use of Power Apps and how you can apply records management capabilities or if you’ve got broader questions about records management with Microsoft 365 we’d love to chat.Get in touch