An admin at a 400-environment tenant spent a Tuesday afternoon tracing why a maker in a finance sandbox could connect a flow to a third-party file-sharing connector that should have been blocked tenant-wide. The tenant-level DLP policy classified the connector as non-business. An environment-specific policy, created eighteen months earlier for a since-retired pilot project, had it classified as business instead, and because classic DLP evaluates every applicable policy and merges the results, the older, looser rule won for that one environment. Nothing was misconfigured in the sense of a typo or a missed checkbox. It was misconfigured in the sense that nobody could reason about which rule applied where anymore.
That kind of drift is the specific problem Advanced Connector Policies were built to close, and as of June 4, 2026, they are generally available across the Power Platform admin center. For solution architects and platform administrators who have spent years managing DLP through the classic business/non-business/blocked model, ACP is not a UI refresh. It changes the underlying enforcement model, and it does not yet cover everything classic DLP does, which means the real work right now is figuring out exactly where the boundary sits.
What Advanced Connector Policies Actually Change
Classic DLP lets an environment inherit from multiple overlapping policies at once: a tenant-wide baseline, group-level rules, environment-specific exceptions, sometimes all three stacked on top of each other. The runtime evaluates all of them and applies the most restrictive result for a given connector, which sounds safe until you have dozens of overlapping policies and nobody has a single view of what’s actually allowed in environment 214. Advanced Connector Policies replace that model with something much narrower: each environment can have exactly one effective ACP, either configured directly on the environment or inherited from an environment group, never both at once.
The more consequential change is the default posture. Classic DLP sorts connectors into three buckets and anything not explicitly sorted lands in a default bucket, which in practice means most connectors are reachable unless someone deliberately restricts them. ACP inverts that. It is a strict allowlist: every connector is blocked until an administrator explicitly allows it, and critically, newly released connectors are blocked by default rather than automatically available. That second part matters more than it looks. Under classic DLP, Microsoft ships a new certified connector and it’s immediately usable in every environment that doesn’t have an explicit block rule against it, which is exactly how ungoverned tools accumulate over time. Under ACP, a new connector requires deliberate action before anyone can touch it, which shifts the operational model from periodic cleanup to ongoing curation.
Action-Level Control and Where MCP Governance Fits
ACP also goes deeper than connector-level allow or block. Within an allowed connector, admins get visibility into individual triggers, regular actions, internal actions, and actions Microsoft has marked deprecated, and can block any of those independently, which is useful for pushing makers off a deprecated action a legacy flow still references without pulling the whole connector. One behavior worth knowing before you rely on it: once a connector is scoped down to specific allowed actions, any new action or trigger Microsoft adds later isn’t automatically included. It has to be added deliberately, consistent with the allowlist philosophy but meaning a connector configured carefully in June can quietly miss a capability Microsoft ships in September until someone revisits the policy.
This is also where ACP intersects with agentic AI governance, worth calling out since most classic DLP writeups predate MCP entirely. Advanced Connector Policies give admins visibility into MCP servers alongside standard connectors and let them block an entire server, but they don’t yet offer granular control over individual tools exposed by that server. If a team stands up an MCP server bundling a dozen tools and you need eight of them permitted while two are blocked, ACP can’t currently express that: the block is server-wide or nothing. For organizations moving quickly on Copilot Studio agents and custom MCP integrations, that’s a real gap to plan around, since it means governance over agent tool access is currently coarser than governance over a standard connector’s actions.
What’s Still Missing, and Why Classic DLP Isn’t Going Away Yet
The limitation that will affect the most environments in practice is that ACP currently only governs certified connectors. Custom connectors and HTTP connectors, including HTTP with Azure AD and the endpoint filtering that lets admins restrict a custom or HTTP connector to a specific allowed URL pattern, are not supported in ACP today and have no committed timeline for parity. If your tenant relies on endpoint filtering to say, for instance, that a generic HTTP connector may only call approved internal APIs and nothing else, that control still lives entirely in classic DLP. Virtual connectors are a separate case again: Copilot Studio’s virtual connectors are being moved to a dedicated governance model built specifically for that surface rather than folded into ACP, and Power Automate desktop flow virtual connectors are being converted into certified connectors over time, at which point they’ll fall under standard ACP rules like anything else.
Microsoft’s answer to this gap is mixed mode, which is also the default state for any environment or environment group where ACP has been configured. In mixed mode, both classic DLP and ACP evaluate simultaneously and the platform applies whichever result is more restrictive. That’s a genuinely useful design for migration: an organization can build out its ACP allowlist for certified connectors incrementally, watch how it behaves in mixed mode against real usage for a few weeks, and keep the existing classic policy doing the work ACP can’t do yet, namely custom connectors, HTTP endpoint filtering, and virtual connectors. Only once an environment’s governance needs are fully expressible in ACP, which for most tenants means never for HTTP-heavy environments, should it be switched to ACP-only mode, which turns off evaluation of classic policies entirely for that scope and can only be reversed by reconfiguring the rule.
Design-Time Enforcement Is Rolling Out Workload by Workload
One detail that’s easy to miss in the announcement is that GA for ACP as a policy engine is not the same as GA for design-time enforcement across every maker surface. Design-time blocking, meaning a maker sees an error while building a flow or app rather than discovering the failure at runtime, is rolling out one workload at a time: Power Automate’s maker portal first, Copilot Studio next, and Power Apps’ maker portal after that. Until a given surface has design-time support, ACP still enforces at runtime there, which means a maker in Power Apps today can build and save a canvas app referencing a blocked connector and only find out it doesn’t work when the app actually runs. That’s a materially different experience from the flow-checker warning a Power Automate maker gets today, and it’s worth setting expectations accordingly with any citizen developer population still working primarily in Power Apps.
A Practical Migration Sequence
The organizations getting this right aren’t treating ACP as a lift-and-shift replacement for their existing DLP policy set. They start with an audit of what their current classic policies actually enforce, separating that into a certified-connector allowlist that can move to ACP and a residual set of custom-connector, HTTP endpoint-filtering, and virtual-connector rules that has to stay in classic DLP indefinitely. From there, building the ACP allowlist environment-group by environment-group, publishing it in mixed mode, and giving it real usage time before considering ACP-only mode avoids the failure pattern of flipping a switch tenant-wide and finding the gaps through a flood of support tickets. It’s also worth reconciling allowed-connector lists periodically through the Power Platform API rather than the admin UI alone, since retired or invalid connector IDs accumulate in a policy’s configuration and throw off the connector count the UI reports without actually blocking anything.
One operational gotcha worth flagging before it surprises anyone: removing an ACP rule from an environment group does not automatically remove that policy from environments that already inherited it, and removing an environment from a group retains whatever ACP configuration it last had rather than reverting to unrestricted. That’s a deliberate design choice to prevent a connector from becoming unexpectedly available during a reorganization, but it means offboarding an environment from group-based governance requires an explicit cleanup step, not just a drag-and-drop out of the group.
None of this makes classic DLP obsolete, at least not on any announced timeline, and treating ACP’s June GA as a mandate to migrate everything immediately would be a mistake for any tenant with meaningful HTTP or custom connector usage. What it does change is the ceiling on how precisely certified-connector access and AI agent tooling can be governed, and for tenants running large numbers of managed environments, that precision is the difference between a policy set someone can actually audit and one that quietly drifts for eighteen months until an admin loses an afternoon tracing it. We’ve walked several clients through exactly this audit-first sequencing this year, and the pattern holds regardless of tenant size: know what you’re moving before you touch the switch.
#AdvancedConnectorPolicies #PowerPlatformGovernance #DataLossPrevention #MCPGovernance #ConnectorSecurity #EnterpriseAI
No comment yet, add your voice below!