The mechanism
A DLP policy sorts every connector into one of three groups:
- Business — sanctioned corporate data (Dataverse, SharePoint, SQL…).
- Non-business — personal/unsanctioned (personal cloud storage, social, external email…).
- Blocked — cannot be used at all.
The rule: an app or flow may not use connectors from BOTH the business and non-business groups at once. That single rule stops the exfiltration pattern — 'read from Dataverse (business) AND write to a personal Dropbox (non-business)' becomes impossible in one flow. serv365 scans the Power Platform DLP surface, so a policy weakening (a risky connector moving to business, a new environment with no policy) is a dated drift alert — because a loosened DLP is a data-exfil path opening.
The scoping decisions that matter
- Which connectors are business vs non-business — the classification IS the policy; a permissive default (everything business) defeats the purpose, an over-strict one breaks legitimate apps. Review it deliberately.
- Policy scope: tenant-wide vs per-environment. The pattern: a strict tenant-wide baseline + per-environment policies for sanctioned exceptions (the finance env may use the SQL connector the default may not).
- The default-environment gap: the default env needs the STRICTEST policy (environments concept) — it's where unsanctioned makers build.
- New connectors: connectors arrive constantly, landing in a default group — an unreviewed new connector can be a new exfil path; the review is ongoing.
What to watch (proofs)
- Policy inventory: Power Platform admin center → DLP policies (and serv365's nightly scan of the surface) — which environments are covered, and the business/non-business split; an uncovered environment is an open door.
- The exfil test: attempt a flow combining a business + non-business connector in a governed env — it should be blocked; the block is the proof.
- Classification drift: a sensitive connector (HTTP, custom, personal storage) sitting in 'business' — the misclassification that quietly permits exfil.
- New-connector backlog: connectors added since the last policy review — the ongoing-governance queue.