Power Platform Governance: DLP & CoE for AI Agents [2026]

Power Platform Data Loss Prevention policies classify every connector as Business, Non-Business or Blocked, and prevent a single flow or agent from combining connectors across those groups. That is the control that stops a Copilot agent from moving Dataverse records into an unapproved destination.

Why agents changed the urgency

Low-code governance used to be a tidiness problem: too many apps, unclear ownership, orphaned flows. It was worth fixing, and it could wait.

Agents changed that. An agent grounded in Dataverse holds a standing connection to company data and acts without a person watching each step. If an outbound connector sits in the same DLP group as that data, there is a path out of the tenant that nobody consciously designed and nobody is monitoring.

Designing the policy

The design mistake to avoid is a generous Business group. Every connector added there can be combined with Dataverse by anyone building in that environment. Additions should be a decision with a name attached, not a convenience.

Deploy it as code

# DataDaur Power Platform Governance Automation Script
# Enforces DLP Policy rules blocking non-business connectors across AI environments

Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Force
Init-PowerAppEnvironment

$DlpPolicyName = "DATADAUR_ENTERPRISE_AI_DLP"
$EnvironmentId = "00000000-0000-0000-0000-000000000000"

# 1. Define Business Connectors (Allowed to share data)
$BusinessConnectors = @(
    @{ id = "/providers/Microsoft.PowerApps/apis/shared_commondataserviceforapps"; name = "Dataverse" },
    @{ id = "/providers/Microsoft.PowerApps/apis/shared_office365"; name = "Office 365 Outlook" },
    @{ id = "/providers/Microsoft.PowerApps/apis/shared_sharepointonline"; name = "SharePoint Online" }
)

# 2. Define Blocked Connectors (Strictly prohibited for AI Agents)
$BlockedConnectors = @(
    @{ id = "/providers/Microsoft.PowerApps/apis/shared_twitter"; name = "Twitter" },
    @{ id = "/providers/Microsoft.PowerApps/apis/shared_dropbox"; name = "Dropbox" },
    @{ id = "/providers/Microsoft.PowerApps/apis/shared_facebook"; name = "Facebook" }
)

# 3. Apply DLP Policy to Tenant Environment
New-AdminDlpPolicy -DisplayName $DlpPolicyName -EnvironmentName $EnvironmentId -BusinessConnectorGroup $BusinessConnectors -BlockedConnectorGroup $BlockedConnectors
Write-Host "✅ Enterprise AI DLP Policy successfully enforced on environment $EnvironmentId." -ForegroundColor Green

Policies configured by hand in the portal drift. Six months later nobody can say whether the difference between two environments was deliberate. Scripted deployment makes the policy reviewable, diffable and repeatable — which matters most at the moment somebody asks why a particular connector was permitted.

The CoE Starter Kit

Microsoft's Center of Excellence Starter Kit is a set of Dataverse solutions, flows and Power BI dashboards that inventory what exists across the tenant: apps, flows, agents, connectors, makers and orphaned resources.

Treat it as inventory first and governance second. The most common finding on a first run is not a policy violation — it is several hundred assets nobody knew were there, a meaningful share of them owned by people who have left.

Managed Environments

1. Sharing limits. Cap how widely an app can be shared, so a prototype cannot quietly become tenant-wide infrastructure.
2. Weekly digests. Usage and inactivity reporting to the people who own the environment, which is how orphaned assets get retired.
3. Solution checker enforcement. Require it to pass before a solution can be deployed into the environment.
4. Environment separation. Development cannot reach production connectors. Simple, structural, and routinely missing.

Governance that only exists as policy is a document. Governance that exists as environment configuration is a control. Auditors know the difference and so do the people building in the tenant.

What good looks like

A governed estate is not one with fewer apps. It is one where every app and agent has a named owner, every connector in the Business group was approved by a person who can say why, and the list of what exists is generated, not remembered.