Your IT security team wants to prevent Copilot Studio agents in the HR environment from sending data to any social media connectors, while still allowing agents to use SharePoint and Microsoft Teams connectors. Which Power Platform governance tool should you configure?
Select an answer to reveal the explanation.
Short Explanation and Infographic
DLP policies in Power Platform are like a traffic cop for connectors — they sort connectors into Business, Non-Business, or Blocked lanes and prevent agents from mixing lanes. Putting social media in Blocked and SharePoint/Teams in Business keeps your HR data from ever reaching Twitter or LinkedIn.
Full explanation below image
Full Explanation
Data Loss Prevention (DLP) policies in the Power Platform Admin Center govern which connectors Copilot Studio agents (and Power Apps/Automate flows) can use and how they can be combined. Connectors are classified into three buckets: Business, Non-Business, and Blocked. Business connectors can interact with each other; Non-Business connectors can interact with each other but not with Business connectors; Blocked connectors cannot be used at all in the governed environments.
To meet the requirement: place SharePoint and Microsoft Teams in the Business group, and place social media connectors (Twitter/X, LinkedIn, Facebook, etc.) in the Blocked group. This prevents any agent in that environment from using social media connectors, while preserving full access to SharePoint and Teams.
Option A (Purview sensitivity labels) classifies content based on sensitivity — it doesn't control which connectors an agent can use. It's about data classification, not connector governance.
Option C (Azure AD conditional access) controls authentication at the identity layer — blocking a connector's service principal authentication is possible but not the intended mechanism and is complex to manage.
Option D (Copilot Studio firewall rules) does not exist as a feature — Copilot Studio does not have environment-level outbound firewall configuration.
Exam tip: DLP policy = Power Platform Admin Center = connector classification (Business / Non-Business / Blocked). This is the primary governance tool for controlling what connectors agents can use. DLP policies can be scoped to specific environments or applied tenant-wide.