Manage the Microsoft Power Platform environment →hardMultiple Choice

DLP Policy Effects on Connectors

Exhibit

Exhibit (JSON policy):
{
  "policy": {
    "name": "Default",
    "type": "DataLossPrevention",
    "properties": {
      "blockedConnectors": ["Microsoft Teams", "Twitter"],
      "blockedConnectorGroups": [],
      "environment": {
        "id": "/providers/Microsoft.PowerApps/environments/Default-87a8b3c4-1234-5678-abcd-1234567890ab"
      }
    }
  }
}

Refer to the exhibit. A Power Platform administrator applies this DLP policy to the default environment. What is the result?

⚠ Common exam trap

It's easy for candidates to assume a DLP policy blocks all connectors or applies globally, when in fact only the connectors explicitly placed in the 'Blocked' group are restricted, and the policy scope is limited to the specified environment.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Teams and Twitter connectors are blocked in the default environment

The exhibit shows a Data Loss Prevention (DLP) policy configured with Microsoft Teams and Twitter connectors in the 'Blocked' group. Since this policy is applied to the default environment, only those two connectors are blocked in that environment. All other connectors remain in the 'Allowed' group by default, so they are permitted. Therefore, the correct result is that Microsoft Teams and Twitter connectors are blocked in the default environment.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
All connectors are allowed
Why it's wrong here
Connectors placed in the Blocked group cannot be used in the environment, so a policy that blocks any connector cannot leave everything allowed. Allowing all connectors is what happens when no DLP policy is applied to the environment, or when every connector is assigned to the Business or Non-business group.
✗
All connectors are blocked
Why it's wrong here
A DLP policy assigns connectors to Blocked, Business, or Non-business groups; connectors omitted from every group remain allowed by default, so this outcome requires every connector to be explicitly listed as Blocked. Blocking all connectors is the intended result only when an organisation wants to prohibit all Power Platform connectivity outright.
✗
The policy applies to all environments
Why it's wrong here
DLP policies are scoped to selected environments, and a policy applied to the default environment affects only that environment unless explicitly extended. It is tempting because tenant-wide governance is a real goal, but that requires adding each environment to the policy's scope, not applying it to one.
✓
Microsoft Teams and Twitter connectors are blocked in the default environment
Why this is correct
Connectors assigned to the Blocked group in a data loss prevention policy are disabled for every app and flow in the environment where the policy applies. With Microsoft Teams and Twitter placed there, the default environment loses access to both connectors.

Go deeper

DLP Policy Effects on Connectors

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question