Power Platform DLP Impact Assessment

Understanding Power Platform DLP Impact Assessment

When setting up a new tenant, it is recommended that Power Platform DLP should be implemented before any tools are utilized, while if you've been developing apps and creating flows without any active policies, it might be a risk to implement DLP. In this case, running a Power Platform DLP Impact Assessment beforehand can be beneficial. Impact Assessment can indicate which apps or flows might get disrupted when a Power Platform DLP policy is introduced. This knowledge aids the strategy formation, and a communication plan can be drafted for users who may be affected.

But to carry out a Power Platform DLP impact assessment, users must have admin access to the Power Platform Admin Centre and the updated version of the CoE Starter Kit must be installed. The 'Data Loss Prevention' (DLP) Impact Analysis model-driven app, located in the 'Centre of Excellence' Core Components, will be needed for this assessment.

The initiation step of this process is creating a new DLP policy. Though it might seem counter-intuitive, this new policy won't apply to any environment. Instead, it helps us understand what could occur if applied. This "empty" policy will play a critical role in the impact assessment.

A standard DLP policy generally classifies all Microsoft connectors to Business, and the rest as Blocked. Based on business needs, more connectors can be added to Business or Non-Business. Some connectors cannot be blocked, and for such cases, the connector classification documentation provides more information. A list of connectors to be moved to Business/Banned can be obtained post filtering.

This assessment does not apply to custom connector usage; the analysis of the same can be gleaned via other tabs in the CoE Starter Kit Power BI dashboard.

Setting the scope of assessment is a crucial step where no policy is applied to any environment; we will merely view its potential effect. This is done by selecting 'Exclude certain environments' and adding those environments to the policy. However, we are actually adding them to the set of excluded environments, so it doesn't affect overall functioning.

Post-Assessment Actions

Once the Impact Assessment is conducted, users can navigate to the environment where their CoE Starter Kit is installed to find the DLP Impact Analysis app. If the policy doesn't affect any apps or flows, a respective message would be displayed. If it does, the affected assets would be displayed in a table.

The 'Impact' section shows which connector(s) could be affected in the selected app or flow. The 'Email Maker' section has an auto-populated email body, which lets the user know about potential connector conflicts. It allows communicating with the relevant makers regarding conflicts.

The responsibility to keep track of emails falls on the user, as hundreds of flows and apps might be affected, and follow-ups may be required. The 'Export to Task List' option adds these records to the DLP Impact Analysis table in the CoE Core Components solution; from there, they can be accessed anytime through the 'Non-compliant task list' area of the app.

The details of the Impact Analysis are then sent to the user's email, which provides key information such as the creator, environment, and connector(s) that would be impacted. This Impact Assessment is crucial for any Power Platform activity in your tenant, and the results can guide the conversations about any forthcoming changes.

Lastly, depending on the results, users might need to strategize and plan their DLP policy or policies. There could be a need for more than one policy – a topic that would be tackled in the subsequent articles. The overall goal remains to make the Power Platform experience better without compromising on data security.