Eleven core modules. Every risk area in one licence.
Each module brings together the checks, playbooks and Microsoft services for one area of your tenant. Extension modules add specialist areas on top.
In short
The Governor has 250 checks. 242 sit in 11 core modules that come with the platform licence: agents, environments, Copilot credits, data policies and outbound, identity, ALM, data protection, monitoring, operating model, licences and Power Pages. The Compliance and audit evidence extension module adds 8 more.
Which module answers which question?
Grouped by the question your board asks, not by Microsoft product. Seven checks from these modules are free in the Core, so you see the first gaps before you buy anything. Extension modules are marked as such.
250 checks
Agent governance
Every Copilot Studio agent known, owned, authenticated and shared on purpose.
34 checksEnvironment strategy
The right environments, in the right region, with the right people in them.
29 checksCopilot credits FinOps
Copilot credits matched to real use, with a limit on every agent and an owner for every budget.
21 checksData policies and outbound
Connectors, HTTP calls, MCP servers and other tenants allowed where they should be, and nowhere else.
29 checksIdentity and access
Admins, service accounts and app registrations with power over Power Platform, under control.
21 checksALM and pipelines
Changes reach production through a pipeline with an approval, not by hand.
21 checksData protection and oversharing
The SharePoint sites, Dataverse tables and mailboxes your apps and agents use, shared on purpose.
26 checksMonitoring and audit
Audit logs on, alerts routed and someone watching.
17 checksOperating model
Owners, intake and a review rhythm, so the platform stays governed after we leave.
18 checksLicences and capacity
Premium licences and Dataverse capacity matched to what people actually use.
16 checksPower Pages
Public sites that show only what they should.
10 checks- Extension module
Compliance and audit evidence
NIS2, DORA, ISO 27001, SOC 2 and EU AI Act controls measured every week, with evidence your auditor accepts.
8 checks
Sources
The primary documentation and law this page relies on. Each link opens the original source.