Custom Connector in the Environment Data Policy

[hsu]

Dear everyone,

I have an issue that the Data Policy / DLP is still blocking combination of connectors and custom connector in my PowerApps.

Setup of the Data Policy

• Create and adjust the data policy in the Environment level in the PowerApp . (not in the global policy)
• Read the explanation and follow the steps 
  • https://flow.microsoft.com/en-us/blog/introducing-http-and-custom-connector-support-for-data-loss-pr...
  • https://docs.microsoft.com/en-us/power-platform/admin/powerapps-powershell
  • https://alextofan.com/2019/02/26/how-data-loss-prevention-policies-work-in-powerapps-and-flow/
  • https://alextofan.com/2019/05/15/how-to-add-http-actions-and-custom-connectors-to-a-data-loss-preven...

The result in the Data Policy UI is also positive actually:

• In PowerPlatform Admin (Data Policy Preview) this custom connectors are NOT visible. 
• In PowerApps Admin:
  
• The standard connectors and custom connectors are all added and visible in the PowerApps Admin

The result in the PowerApps

• Combination of 2 standard connectors are working. 😀
  • 
• If I try to add Custom Connector in combination with the standand connector, the issues happens. 😟
  
  • It keeps on showing the following error: Conflict with the company data loss prevention policies
  • 

Anyone could help??

Thanks.

[Sampath_Kumar]

Hi,
Even I am also facing the same problem

[v-xida-msft]

Hi @hsu ,

Based on the issue that you mentioned, I have made a test, and the issue is confirmed on my side. The Custom connector would be visible in PowerApps Admin Center, but not in Power Platform Admin Center.

Actually, the DLP Policy feature in Power Platform Admin Center is still in Preview, the whole DLP feature in PowerApps Admin Center has not been migrated into Power Platform Admin Center.

If you would like this feature to be achieved in Power Platform Admin Center, please consider submit an idea to PowerApps Ideas Forum:

https://powerusers.microsoft.com/t5/Power-Apps-Ideas/idb-p/PowerAppsIdeas

Simultaneously, the DLP setting you set up in your PowerApps Admin Center would still take effect within PowerApps Environment.

Best regards,

[hsu]

Hi @v-xida-msft ,

thanks for your confirmation about the differences in the Admin UI.

However, I need help to enable the usage of custom connector and standard connector in the data policy.

Now I tried already for hours, deleting and re-creating the policy, but still it does not work.

Any guidelines on how to setup environment level data policy for custom connectors and also how to debug it?

Or anyone successfully create and able to share?

Or @v-xida-msft : Any suggestion on how to get further help from MS?

Thank you in advance.

[v-xida-msft]

Hi @hsu ,

Do you want to use the standard connector and custom connector together within your canvas app against the DLP?

I have made a test on my side, and the standard connector and custom connector could work together within my Environment the DLP applied to (add some standard connectors and custom connector into Business Data Only Group). When add another standard connector (in Non-Business Data Group) into my canvas app, the error would show up:

Please make sure the DLP you set up has been applied to proper Environment on your side. Also please take a try to re-create a new DLP policy on your side using PowerApps PowerShell cmdlets:

https://alextofan.com/2019/05/15/how-to-add-http-actions-and-custom-connectors-to-a-data-loss-preven...

Also please make sure the custom connector you added into the "Business Data Only Group" of your DLP is the same as that you want to add/use within your canvas app in current Environment.

If the issue still exists, please consider submit an assisted support ticket through the following link:

https://powerapps.microsoft.com/en-us/support/pro

Best regards,

[hsu]

Hi @v-xida-msft ,

I have repeated the steps in the Personal Productivity environment, and also still failed to add 2 connectors (1 standard premium, 1 custom connector). Another info here is that my custom connector is to access intranet resource utilizing the On Prem Gateway.

At the end I created a support ticket as your suggestion.

Thanks and meanwhile I will wait. 

[hsu]

About this I have exchanged emails with Microsoft support and then with the PowerPlatform technical engineer.

Their suggestions is going to the direction that the Global Policy is preventing it.

However I think there is still inconsistent message.

I also still need to verify their latest suggestions, by setting something using the PowerShell.

Will update again in the future.

[hsu · Accepted solution]

Hi @v-xida-msft ,

after long email with MS Support, they came with the suggestion:

• “I noticed that you also have a Global policy which applies to all environments in your tenant.  And since custom connector cannot be added to global policy, it means a custom connector cannot work alongside with any other connectors. 

  I understood that's why you created a env-specific policy for it.  However, the way it works when multiple policies exist is that the most restrictive rule wins; as a result, the custom policy does not work here.”

• One thing we can try here is to change the Global policy to exclude the environment in which you want to run custom connector with CDS and Office365Users. 

• This is where you can exclude the Environment from the Global Policy
  

For how to add the custom connector using the Power Shell, these 2 articles are helpful and the steps are working:

• https://alextofan.com/2019/02/26/how-data-loss-prevention-policies-work-in-powerapps-and-flow/
• https://alextofan.com/2019/05/15/how-to-add-http-actions-and-custom-connectors-to-a-data-loss-preven...

Thanks all.