How to add HTTP actions and custom connectors to a Data Loss Prevention (DLP) policy in PowerApps and Flow

Custom Connector support for DLP

In my last article I explained how to create a custom connector and in this article I will explain how to add a custom connector to a Data Loss Prevention (DLP) policy.

I wrote about how Data Loss Prevention policies work in PowerApps and Flow in this article, if you need a refresher.

Microsoft introduced HTTP and Custom Connector Support for Data Loss Prevention Policies in January this year. I recommend reading that article first.

Prerequisites

To be able to create a DLP to manage custom connectors (and HTTP actions) you will need a couple things:

• Office 365 Global Admin role or AAD Global Admin role
• Paid or trial Plan 2 license
• Install the PowerApps modules for PowerShell
• Basic PowerShell knowledge

The PowerShell syntax

To add a custom connector to a DLP we have to use the Add-CustomConnectorToPolicy cmdlet with this syntax:

As you tell from the syntax, we need a few things before we can add a custom connector to a DLP:

• PolicyName – The policy name.
• ConnectorName – The connector's name (not the display name).
• GroupName – Accepted values lbi or hbi – lbi is for the No Business Data Allowed group and hbi is for Business Data Only.
• ConnectorId – The custom connector ID.
• ConnectorType – The custom connector type.
• ApiVersion – The api version to call with. The default value is 2018-01-01.

The next step here is to create the DLP to get the PolicyName and, after that, we will get the rest of the details.

Creating the DLP

I currently have 2 DLPs in my tenant which I created through the UI.

To create a new DLP to handle custom connectors, you will have to use the PowerShell command below – I named my policy Custom Connectors:

This command contains a parameter -SchemaVersion to which you have to pass the 2018-11-01 version.

The reason you have to use this version is to ensure that the DLP will support custom connectors and HTTP actions.

If you did everything right, the result will look like below. Notice that the PolicyName is a GUID – copy the GUID because you will need it later:

If you go back to the PowerApps Admin Center you will see the policy in the UI under Data Policies:

Managing HTTP actions in the DLP

Now that the DLP is created, you can add the HTTP actions to one of the data groups in the DLP.

By default, the HTTP actions will sit in the No business data allowed data group, as shown below:

Now you can add the actions to the Business Data Only data group if you want to isolate them from other connectors.

To do this, click the Add button in the Business Data Only data group, search for "http" in the Add connectors dialog, select the HTTP actions and click the Add connectors button.

This will add the HTTP actions to the Business Data Only data group as shown below:

That is all that you have to do to manage HTTP actions in a Data Loss Prevention policy.

Obviously, you can create multiple DLPs, perhaps one to handle HTTP actions and another one to handle one or more custom connectors.

Now I will explain how to add a custom connector to a DLP.

Identifying the Custom Connector

I have the PolicyName from the previous step and now I need the rest of the details.

The next thing you need to do is to identify the custom connector you want to add to the DLP and get its display name.

In my case, the custom connector I want to add is Yelp and I can find it by going to the PowerApps Portal or Flow Portal >> Data >> Custom Connectors

If you want to know how I built this connector, read this article.

Clicking on the Yelp connector will open the Details page.

On this Details page I can see the connector's display name, its description, who created it, and the authentication type, but in order to manage this connector in a DLP I will need the connector's identifier (aka ConnectorName) which is not exposed in this UI.

Getting the custom connector details

Now that I know the name of my custom connector, I can query it in PowerShell and get its ConnectorName using this command:

This command will return the connector properties, including the ConnectorName, ConnectorId, and type.

The type is a key in the connector's Internal property which contains the connector type value. As you can see below, in this case, the connector type is Microsoft.PowerApps/apis:

Adding the custom connector to DLP

Now that we have the policy name, the connector name, the connector ID, and the connector type, we can run the Add-CustomConnectorToPolicy command:

And if we did everything right, we will get a 200 response back:

This is how it looks in the UI:

Removing the custom connector from the DLP

To remove the connector, we can run the Remove-CustomConnectorFromPolicy command. We only need the PolicyName and ConnectorName: