DLP Policy Change Detector

Overview

The DLP Policy Change Detector is a scheduled governance flow that monitors Data Loss Prevention (DLP) policies across your Power Platform tenant. It retrieves the current DLP policy configuration from the Power Platform Admin API, compares each policy against a stored Dataverse snapshot, and posts a formatted Teams alert when new policies are detected or existing policies are modified.

Use Case

DLP policy changes in Power Platform can have wide-reaching impact — they control which connectors makers can combine in apps and flows. Unauthorized or accidental modifications can break production flows or expose sensitive data pathways. This flow provides automated change detection so IT admins are immediately notified when policy drift occurs. The before/after comparison uses a fingerprint hash stored in Dataverse, enabling drift detection without manual auditing.

The flow is ideal for teams that:

• A new DLP policy is created in the tenant
• An existing DLP policy is modified (connector group changes, scope changes, name changes)

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Create an Azure AD App Registration

Register an app with https://api.bap.microsoft.com/.default API permission (Application type). Grant admin consent. Note the Client ID and create a Client Secret — these populate the Graph* env vars.

Import the solution and set env vars

Import the solution into your target environment, then set flowlibs_GraphTenantId, flowlibs_GraphClientId, flowlibs_GraphClientSecret, flowlibs_TeamsGroupId, and flowlibs_TeamsChannelId to your tenant-specific values.

Authorize connections and turn on the flow

Open the flow in the designer, authorize the Dataverse and Teams connections, then turn the flow on. It will run daily at 8:00 AM UTC.

Change the schedule

Edit the Recurrence trigger frequency or time of day to align with your governance review cadence.

Add email notification

Add an Outlook SendEmailV2 action after the Teams post, using varAdminEmail as the recipient, to also send change summaries via email.

Detect deleted policies

Add a second loop that queries Dataverse snapshots and flags any policy IDs that no longer appear in the API response, indicating deletion.

Filter by environment type

Add a Filter Array before the For Each loop to only monitor AllEnvironments or OnlyEnvironments policies, narrowing the alert scope.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

concat(items('For_Each_Policy')?['properties']?['displayName'], '|', string(items('For_Each_Policy')?['properties']?['connectorGroups']), '|', coalesce(items('For_Each_Policy')?['properties']?['environmentType'], 'AllEnvironments'))

concat('flowlibs_policyid eq ''', items('For_Each_Policy')?['name'], '''')

not(equals(outputs('Compose_Policy_Fingerprint'), first(outputs('Query_Existing_Snapshot')?['body/value'])?['flowlibs_policyhash']))

https://api.bap.microsoft.com/providers/PowerPlatform.Governance/v2/policies