Apply a restrictive data policy to the default Power Platform environment

Description

A tenant-level Power Platform data policy covers the default environment (scope Add all environments, or a list or exclusion scope that includes it) and:

• places only the connectors needed for personal productivity in Business, typically the non-blockable Microsoft 365 connectors;
• moves every other blockable connector, including HTTP and consumer services, to Blocked;
• sets the default group for new connectors to Blocked;
• blocks custom connectors with a deny rule on the * URL pattern, unless specific endpoints are allowed.

Copilot Studio virtual connectors (for example Chat without Microsoft Entra ID authentication in Copilot Studio) are classified in the same policy.

Some Microsoft 365 connectors cannot be blocked (for example SharePoint, Office 365 Outlook, Teams, OneDrive for Business, Approvals). Their actions can be limited with advanced connector policies on managed environments. When several policies apply, the most restrictive one wins.

Rationale

The default environment is shared by every licensed user and cannot be restricted for creation. Without a data policy, a maker can connect SharePoint or Outlook data to a personal Dropbox, Gmail, an HTTP endpoint or a social network in a few clicks, intentionally or not. A data policy that blocks everything except a small set of business connectors turns the default environment into a personal productivity space and pushes real solutions into governed environments.

Impact

Existing apps, flows and agents in the default environment that use connectors now blocked, or combine Business and Non-business connectors, are suspended and their connections disabled; they must move to a dedicated environment with its own policy. Enforcement can take up to 24 hours on large tenants. Run an inventory of connector usage in the default environment (Center of Excellence Starter Kit or Power Platform inventory) before enforcing, and publish the governance error message with a contact address.

Audit

1. Sign in to the Power Platform admin center (https://admin.powerplatform.microsoft.com) as at least a Global Reader.
2. Browse to Security > Data and privacy > Data policy.
3. Find the policies whose Applied to column includes the default environment (All environments, All environments, except (n) without the default one, or a list naming it).
4. Open the policy with Edit Policy (do not save) and check the Prebuilt connectors groups: blockable connectors other than approved business ones are in Blocked, and Set default group is Blocked. Check Custom connectors: a * pattern is denied or blocked.
5. Alternative, read only (Power Platform Administrator): Add-PowerAppsAccount, then Get-DlpPolicy and inspect the policies whose environment scope includes the default environment (Get-AdminPowerAppEnvironment -Default gives its name).
6. Fail if no data policy applies to the default environment, or if the policy leaves blockable non-business connectors (HTTP, consumer storage or mail, social networks) unblocked.

Remediation

1. Inventory connector usage in the default environment and contact the owners of solutions that must move.
2. In the Power Platform admin center, browse to Security > Data and privacy > Data policy > New Policy. Role: Power Platform Administrator.
3. Name the policy, for example DLP - Default environment.
4. Prebuilt connectors: move the approved connectors to Business, move every other blockable connector to Blocked, and select Set default group > Blocked.
5. Custom connectors: add a rule that blocks the * pattern (add allow rules before it for approved endpoints, always over HTTPS).
6. Scope: Add multiple environments, then add the default environment (or use Add all environments for a tenant-wide baseline policy).
7. Review and Create policy. Customize the governance error message with Set-PowerAppDlpErrorSettings.

Rollback

Edit the policy and move the affected connectors back to Non-business, or delete the policy. Suspended flows must be turned back on by their owners.

References

• Manage data policies Microsoft, vendor-doc, accessed 2026-10-24
• Secure the default environment Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Power Platform baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-POWER-004 Cover every non-default Power Platform environment with a data policy
• related CB-M365-POWER-005 Enable Power Platform tenant isolation
• related CB-M365-POWER-022 Require user authentication for Copilot Studio agents and limit how widely they are shared
• related CB-M365-POWER-023 Keep maker credentials, hard-coded secrets and cleartext HTTP out of Copilot Studio agents

People and lifecycle