Forum Discussion
Launching DIY Data Control for Nonprofits
I want to create a library of open-source resources that helps self-taught IT champions in nonprofit organisations build fully governed, secure shared data systems. I have plenty of ideas about how to do this, but before I press ahead, I want to listen to the people I hope to support to ground those ideas in reality.
For my first project, I want to draw on part of the Microsoft ecosystem, which provides some useful tools for safely building your own data systems:
- Microsoft Learn: Microsoft provides a wealth of free learning resources. I use them a lot and they are as good as other resources that I have happily paid for. The two big barriers to using them are finding time and working out where to start.
- The Common Data Model for Nonprofits: This is an open-source resource from Microsoft, it describes the tables of data that a nonprofit organisation needs, and the relationships between them. Once you add your own data it becomes a shared functioning model of your organisation.
- Role based column and row level security: This is the revolutionary part that lets you safely replace scattered spreadsheets with a single, comprehensive, shared model of your organisation. It lets you decide exactly which parts of which records people are allowed to see or change, so everyone who interacts with your shared model can only see and change the things that they need to.
- Model-driven Power Apps and Power BI: Once you have a detailed model of your organisation with governance baked into it, adding tools to interact with it becomes straightforward. Both Model-driven Power Apps and Power BI can understand the structure of your organisation from your model, and they will respect the governance policies that you built into it.
In theory, these should provide all the tools you need to bring together scattered data in siloed spreadsheets into a single, secure, auditable shared source of truth. But there are gaps, and I want to find out what guides, signposts and tools would be needed to bridge them.
Later I will want to explore the features that you could add with Copilot Studio if you wanted to. Once you have established a clearly defined, precisely secured data environment, Copilot Studio can provide the tools to develop and deploy AI agents safely. But for now, I will focus on the foundations of well-defined, well-governed, accessible data.
If you have any thoughts about this project then I would love to hear them, and I’d especially like to find out what pain-points there are that I can target. So please do get in touch.
Patrick Killeen
Head and Heart CIC
email address removed for privacy reasons
https://www.headandheart.info/
This work is released under the MIT Licence and is available at
https://github.com/head-and-heart-cic/public/blob/main/in-practice/2600707-launching-diy-data-control-for-nonprofits/README.md
1 Reply
Patrick, this is a genuinely valuable direction. Our experience suggests that the biggest gap is not the technology itself, but the journey from a promising data model to a trustworthy, maintainable operational system.
The pain points I would prioritise are:
- turning an abstract model into definitions that staff interpret consistently;
- matching and deduplicating records imported from unreliable spreadsheets or data sources;
- recording provenance, licensing, confidence and transformation history, not just the final value;
- designing roles around real responsibilities, including exceptions and sensitive fields;
- testing security from the perspective of each user type;
- handling corrections, approvals, audit trails and schema changes;
- separating development, testing and production, with recoverable backups;
- understanding ongoing licensing, administration and support obligations.
I would also treat reporting security as its own implementation topic. Model-driven apps can work closely with Dataverse security, but Power BI permissions and row-level security need deliberate design and testing; teams should not assume that every underlying access rule will automatically carry through to every report.
The most helpful resources may therefore be opinionated, end-to-end reference implementations rather than another catalogue of features: a small fictional nonprofit, realistic messy source files, a governed target model, documented decisions, import and reconciliation processes, security tests, deployment guidance and a “who looks after this after launch?” checklist.
I’d strongly support beginning with listening. Self-taught IT champions often understand their organisations exceptionally well, but are being asked to carry architecture, governance, privacy, security and operational support responsibilities without a map... or enough protected time. Designing for that reality could make this project unusually useful.
