Power Platform DLP Policies

Connectors make Power Platform powerful, and they create risk too. A flow could copy customer data from a business system into a personal storage account in one step. Data loss prevention policies stop that kind of leak before it starts.

What a DLP Policy Does

A data policy sorts connectors into groups. Apps and flows may combine connectors from the same group. Mixing connectors from different groups is blocked. Administrators create policies in the Power Platform admin center.

The Three Groups

+--------------+    +------------------+    +----------+
|  BUSINESS    |    |  NON-BUSINESS    |    | BLOCKED  |
| SharePoint   |    | Twitter          |    | Dropbox  |
| Dataverse    |    | Personal storage |    |          |
| Outlook      |    | News feeds       |    |          |
+--------------+    +------------------+    +----------+
      ^                     ^
      |                     |
  A flow may use         A flow may use
  these together         these together
      \_____ NEVER MIXED _____/

A flow that uses SharePoint (Business) and a personal storage connector (Non-business) fails the policy check and cannot be saved or run.

Policy Scope

Administrators choose where a policy applies.

• Tenant-level policies apply to every environment in the organization.
• Environment-level policies apply to selected environments only.

Strict tenant policies protect everything, and lighter environment policies give a sandbox more freedom for experiments. When several policies apply, the most restrictive combination wins.

Connector Classification and Actions

Some connectors allow fine-grained control. Administrators can block individual actions or endpoints for supported connectors. A policy might allow the HTTP connector only for approved web addresses, which stops flows from sending data to unknown destinations.

Building a Policy

1. Open the Power Platform admin center and select Security, then Data and privacy, then Data policy.
2. Create a new policy and give it a clear name.
3. Move approved connectors into Business.
4. Move risky or unneeded connectors into Blocked.
5. Leave remaining connectors in Non-business or set a default group.
6. Add custom connectors to rules by their host patterns.
7. Choose the environments and save.

What Makers Experience

Makers see a policy violation message in the flow checker or when saving an app. Existing flows that break a new policy get suspended. Communicate before enforcing a stricter policy, and give makers a way to request exceptions.

Layman Example: Office Document Rules

A company allows staff to email contracts to clients, and the company forbids sending those contracts to a personal inbox. The rule does not stop email. The rule stops one dangerous combination. DLP policies enforce the same sensible separation between business and personal services.

Planning Your Policy

Inventory Current Usage

Review which connectors makers already use. Blocking a connector that fifty flows depend on causes outages.

Start With a Baseline

Place standard Microsoft 365 connectors in Business. Block clearly unsafe connectors.

Create Exception Environments

Give special projects a separate environment with a tailored policy rather than loosening the tenant policy.

Review Regularly

New connectors appear often. Check the connector list every quarter and classify new ones.

Reviewing Policy Impact

Before enforcing a policy, export the list of flows and apps that use each connector from the admin center. Identify the owners and send a short notice that explains what changes and when. After enforcement, monitor the suspended flows and help owners rebuild them with approved connectors. A calm rollout earns cooperation from makers.

Key Takeaways

DLP policies keep business data inside approved paths. Clear grouping, thoughtful scope, and good communication protect data while letting makers keep building.