Power Automate DLP: connectors that get blocked

“Your flow violates the DLP policy” or connector blocked by DLP: makers see this when a flow combines connectors the organisation’s policy does not allow together. The policy is called Data Loss Prevention (DLP), but it works differently from DLP in Microsoft Purview. It does not look at content, only at which connectors sit together in one flow or app.

The three groups

• Business: connectors allowed to work with business data, such as SharePoint, Office 365 Outlook, Teams and Approvals.
• Non-business: connectors that may not mix with business data, such as personal storage or social media.
• Blocked: may not be used at all.

The rule: one flow may use connectors from Business or from Non-business, not both. A flow copying a SharePoint file to a personal Dropbox is stopped if Dropbox sits in Non-business.

Where the policy applies

A policy can apply to the whole tenant or to selected environments. When several apply, the strictest combination wins. A common set-up: a strict policy for the default environment where anyone can build, and a looser one for a separate environment for managed solutions.

Finer control: actions and endpoints

Besides the groups, an admin can block specific actions per connector (for example reading but not deleting) and, for some connectors such as HTTP and SQL Server, filter endpoints: only your own API addresses or servers.

What happens to existing flows

A new or stricter policy also applies to existing flows. Flows that do not comply are suspended and the owner is notified. So do not change policies casually: first check which flows are affected. The Power Platform admin center and the admin modules show which flows use which connectors.

# Windows PowerShell 5.1, Power Apps admin module
Get-AdminFlow -EnvironmentName <environment id> |
  Select-Object DisplayName, FlowName, @{n='Owner';e={$_.CreatedBy.userId}}

As a maker: what can you do?

• Read in the message which connectors clash.
• See whether connectors from one group will do, for example OneDrive for Business instead of a personal service.
• If the combination is truly needed, ask the Power Platform admin for an exception or a separate environment. The fix lives in the policy, not in the flow.

A sensible starting policy

Put the Microsoft 365 connectors you use in Business, let new connectors default to Non-business, and block what you do not want. Write down which combinations are allowed and why, so makers know where they stand.

See also Installing Power Apps PowerShell and a first Microsoft 365 flow.