Company data loss prevention policies

[GiridharM]

Hi Team,

I have an issue where I was unable to figure it out from a long time realted to Data loss prevention policies.

I have created a custom connector using "import an open API", my connector will call an api to get some news items from that api. 

Actually we are planning to save the data coming from this connector and try to save in a sharepoint list, where we are getting the actual problem.

In the flow when we are using customer connector and sharepoint list connector, we are getting an error that "Your flow was updated, but it is currently suspended since it uses a combination of connectors that conflict with the company data loss prevention policies." Please find the below screen shot of the flow along with error details.

 I have did some RND on this data loss prevention policy that, we are not able to build a flow that uses the connectors from different groups called Business data only and No business data allowed Microsoft blog link .

My guess is I need to add my custom connector in Business data only group, so that I can use other connectors like sharepoint etc. So when I am trying to add but not able to find my custom connector in the list. This is the link I am following to create the policy https://docs.microsoft.com/en-us/powerapps/administrator/create-dlp-policy

It would be great if I get some help from this community. Thanks in advance !

Giridhar

[v-yuazh-msft · Accepted solution]

Hi @GiridharM,

I afriad that custom connector is not supported in data loss prevention policies in microsoft flow currently.

I afraid that there is no way to achieve your needs in Microsoft Flow currently.

If you would like this feature to be added in Microsoft Flow, please submit an idea to Flow Ideas Forum:

https://powerusers.microsoft.com/t5/Flow-Ideas/idb-p/FlowIdeas

Best regards,

Alice

[GiridharM]

Thanks Alice for the reply.

I will submit an idea to the forum, hope for the best.

Thanks,

Giridhar 

[Anonymous]

Did you submit a an request for this? I will vote it up!

This is  ridiculous that I follow best practicses and set up a DLP and now my flows stop working!

I guess the only 'Solution' is to set up an environment with everyting in the 'No Business Data'  zone and restriict who can publish to that zone.

Hey Microsoft, Is there any documentation on this anywhere?

[mcolbert]

@Anonymous

I couldn't agree more, Microosft preaches the extensibility of thier p[roducts but we keep running into brick walls.

Did an idea get submitted, I couldn't find one.

Now that I've tried to do more with PowerApps I am realizing how much is missing from this product. Bad, bad Friday, spent the trime to create the connector to load Excel into Azure SQL (soemthing else that you would think is supported but is not), onloy to find out I can use, we MUST use DLP.

Ugh.

[Sokon]

*Updated: Link*

Sorry do say that, but this is no acceptable solution.

We need to add an idea/suggestions in order to get the functionalities of Flow to work together correctly as documented? I posted an idea so everyone can vote for it.

[mcolbert]

Actually there is a way, it's not documented but all connectors, including custom connectors are added to whichever environment is considered the default. If you set Business data only as your default, the connector will available in Flow to use. It will not show up in the UI however, but when you go back to your flow, it can now be enable.

By default .. the No business data allowed group is the default policy setting. This means that any new connector published to the Power Platform environment, including Microsoft's or third party or custom connectors will be added to this group. This is preferrable as the default bahvior should be to not allow it.

However, if you change the default setting to Business data only your custom connector will moved to this group (even though you can't see it listed in the allowed connectors. To change Business data only to be the default click on the elippsisi to the far right there  and select Set as default group

The downside to do this is any new connectors will be included in your business data only group, which introduces challenges for the data govenance. There is a blog here that demostrates how to use Flow to be alerted any time a new connector is added so it can be dealt with appropriately with appropriately.

I would agree 100% that this is a much needed enhancement to the DLP functionality, but for now you can enable the use of your custom connectors.

Hope this helps.

[Sokon]

Yes this helps, thank you! The governance issue prevents me to do what you describe. However, you put me on the right track. I simply created another environment that doesn't use DLP and is limited the users to a couple of trusted developers.

I posted a idea to vote for nevertheless. Please vote for it here!

[ldskfklodsf]

This has now been solved, tested and working: https://flow.microsoft.com/en-us/blog/introducing-http-and-custom-connector-support-for-data-loss-pr...

[Anonymous]

This feature is garbage because it doesn't let you add the policy right there on the fly while you're in the editor!  DUMB!