The connector catalog
A connector is a wrapper over an API that apps and flows call through a connection (an authenticated instance). Microsoft ships 1000+, in three governance-relevant tiers:
| Tier | Examples | Licensing effect |
|---|---|---|
| Standard | SharePoint, Outlook, Teams, OneDrive for Business, Office 365 | Covered by the Power Apps/Automate use rights included with Microsoft 365 |
| Premium | SQL Server, Azure services, Salesforce, HTTP, most non-M365 | Requires a premium Power Apps/Automate licence per user |
| Custom | Your own wrapped REST API (OpenAPI definition) | Premium; and you own its security |
The premium line is the single biggest source of surprise cost: an app built on standard connectors runs on the seeded licence, then someone adds the SQL or HTTP connector and every user now needs a premium plan.
Custom connectors
A custom connector wraps any REST/SOAP API via an OpenAPI (Swagger) definition, with its own auth (API key, OAuth2, etc.). It is how makers reach line-of-business systems the catalog doesn't cover — and it is a governance blind spot: a custom connector can point at anything, including an attacker-controlled endpoint, and carries whatever credential the maker configured.
Failure modes
- The HTTP connector is a universal exfil pipe. 'HTTP' (and 'HTTP with Azure AD') can POST any data to any URL. If it sits in the DLP business group, one flow can read corporate data and ship it out. It belongs in blocked or non-business almost everywhere.
- Custom connectors as shadow integrations. A maker wraps an external SaaS, stores a credential in the connection, shares the app — now corporate data flows through an ungoverned, unreviewed API.
- Connection ownership = stored credentials. A connection holds the maker's authenticated token; anyone the app/flow is shared with can act as that connection without re-authenticating (see flow security).
- New connectors arrive constantly and land in a default DLP group — an unreviewed arrival can be a new exfil path.
What to watch (proofs)
- Connector inventory and tier: Power Platform admin center / CoE toolkit lists connectors in use per environment; the premium ones are your licensing and risk map.
- Custom connectors:
Get-AdminPowerAppConnectorenumerates custom connectors per environment — each is a bespoke integration to review for endpoint and credential. - Connections and their owners:
Get-AdminPowerAppConnection— stored credentials and who holds them; the shared-connection exfil surface. - DLP placement of high-risk connectors (HTTP, custom, personal storage):
Get-DlpPolicy— anything risky sitting in business is the finding.