Connection could not be created due to a connection API Policy violation

[Anonymous]

Finding something quite strange. 

Created environment with dataverse. 

I go to tables, Import data, select a SharePoint site as example. I cannot sign in nor can I connect and have this error message

Unable to create an OAuth connection. Reason: "Connection could not be created due to a connection API Policy violation. Policies may be adjusted in the Power Platform admin center. (Session ID: c163fd45-a72c-4fb1-a5ff-d383a2cf6e5c, Region: uk)"

I have checked DLP policy and we have power query, dataflow, sharepoint connector. I don't know what "API" would even mean? 

Surely this should just work for dataverse? It must be policy but would like more understanding if anyone can help. 

[JPMayorga]

Hey, hello there, I have exactly the same issue, has someone found a solution?

[P3Sven]

Have found also this:

https://learn.microsoft.com/en-us/power-apps/maker/data-platform/create-and-use-dataflows#troublesho...

Issue Description

Creating a Connection against a PowerQuery Connector (such as SQL, SharePoint...) while setting up a Power Platform Dataflow results in the following error:

"Unable to create an OAuth connection. Reason: (Session ID: <SessionID>, Region: <RegionTag>)"

Cause

We are currently blocking creation for any connections from Connectors 'Blocked' by Data Loss Prevention Policies (DLPs). If the connector in question is under the 'Blocked' section in a Tenant-Level or Environment-Level DLP, then the end-user won't be able to create connections against it for Dataflows / Power Query use.

• Existing DLP policies governing creation and use of connections in Power Platform originally did not apply to Power Platform Dataflows (PPDF)
• Last month (August 2023), creation of connections began to be DLP-enabled for PPDF, ensuring that no new connections that violated administrative DLP policies could be created.
• Starting this week (September 18th, 2023), these policies will begin to apply to use of connections in PPDF, which will ensure no connections that violate DLP policies can be used in a refresh.
• Existing connections that violate these policies will be marked as ‘disabled’.
• This will apply to ALL connectors governed by DLP policy.
• Notably, if a DLP policy excludes 'HTTP with Azure AD' connections, this will impact all existing connections that use this authentication method (such as SharePoint, OData, etc.)
• Starting this week (September 18th, 2023) , customers who have disabled 'HTTP with Azure AD' in Power Platform will start to see Power Platform Dataflows with these types of connections fail to refresh. (Example: SharePoint, OData, etc...)

Resolution

Please review the existing Data Loss Prevention policies to ensure none of the connectors used in the context of Dataflow is currently blocked.

There is no workaround to applying DLP policy. We are now applying these policies more rigorously, enforcing them with Power Platform Dataflows, which had not applied these policies before.  

Alternatively, the customer can move the connector to ‘Business’ or ‘Non-business' group, then ensure the connector is not blocked by DLP policy in their environment.

Note

If you use data loss prevention (DLP) policies to block the HTTP with Azure AD connector then SharePoint and OData connectors will fail. The HTTP with Azure AD connector needs to be allowed in DLP policies for SharePoint and OData connectors to work.

BR,

Sven

[RadVine]

I added the SQL Server Connector to the Business Category and now it works. What we cannot understand is, why this only started to happen on 15th november 2023, and not before. Nobody changed anything in the DLP

[raphael63]

Hello,

We encounter the same issue and we have found a kind of workaround to make it work temporarily.

What you need to have in your DLP policy is the "HTTP with Microsoft Entra ID (preauthorized)" but you have to configure the end point to allow api url to communicate. We have set "Allow - *" (temporarily) to make it work again...

We have notice it cause issues in our side only for SharePoint and Excel. Dataverse and other application api url is working because they was already added in the end point configuration.

I'll open a ticket to Microsoft to know which api URL we need to authorize to make it work with "Deny - *" on the last line of the end point configuration.

[AlbertoCastro]

Hi @Anonymous @P3Sven @RadVine @Plinderoth @cihys 
the DLP assigned to environment must to have the HTTP with Entra ID (preauthorized) connector in Business clasification and must to have all enpoints Allows or at least your sharepoint site.

-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

Regards
Alberto

[AlbertoCastro]

Hi @Anonymous @P3Sven @RadVine @Plinderoth @cihys 
the DLP assigned to environment must to have the HTTP with Entra ID (preauthorized) connector in Business clasification and must to have all enpoints Allows or at least your sharepoint site.

-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

Regards
Alberto

[Natali-WinOn365]

I am facing the same problem, even with HTTP With Microsoft Entra ID in the business connectors.

I just saw your suggestion. We will also try it.

[YannicAtVOSS]

Same issue here. As we need it in near future for a project, we will open a case with Microsoft Support and keep you guys updated. 

[AlbertoCastro]

Did you set the endpoint in the DLP with your organizational sharepoint url?