Power Platform admin center – Advanced connector policies [MC1403390]

Message ID: MC1403390
We are announcing the ability to use advanced connector policies (ACP) to govern which connectors, connector actions, and Model Context Protocol (MCP) servers are permitted across your environments in Power Platform admin center. This feature reached general availability on June 4, 2026.

How does this affect me?
ACP replaces the Business/Non-Business/Blocked classification model of classic data loss prevention (DLP) policies with a single default-deny allowlist, and is off by default until explicitly activated by an administrator. ACP currently applies to certified connectors only (including MCP connectors); continue using DLP policies for custom connectors. This feature includes the following capabilities:

• Default-deny allowlist: All certified connectors and actions are blocked unless explicitly added. New connectors are blocked by default until an administrator reviews and allows them. Business and non-business classifications have been removed for connectors and actions to improve clarity.
• Design-time and runtime enforcement: Makers now get immediate feedback while authoring an app, flow, or agent, not only at runtime when data is changing. Makers are blocked from adding restricted connectors or actions while authoring, and the platform performs a last-mile check at runtime.
• Govern AI tools: Admins can block an MCP server just like any other connector or action.
• Action-level control: Allow a connector while disabling specific risky, deprecated, or internal actions. Triggers, internal, and deprecated actions are clearly tagged.
• Automatic scaling: Because ACP is native to environment groups, the right policy follows each environment created through personal developer environments and routing, no environment-by-environment overhead is required.
• ACP-only mode: Optionally skip classic data policy evaluation entirely for a clean governance posture.

Admins can enable ACP directly on a single environment, which does not require Managed Environments, for high-risk, pilot, or regulated environments. Admin can also enable it once applied to an environment group to govern a fleet at scale, which does require Managed Environments.

What action do I need to take?
This message is for awareness, and no action is required.

To enable ACP in your environment, navigate to the Power Platform admin center and complete the following steps.

1. Review inventory. Use Power Platform inventory (preview) under Manage > Inventory to see connector and operation usage across apps, flows, and agents so you can anticipate impact before activating ACP.
2. Test on a single environment. Apply ACP under Security > Data and privacy in the Power Platform admin center. No Managed Environments are required for a single environment. The policy remains off until you activate it.
3. Build your allowlist. Starting from default-deny, add the certified connectors and actions your teams require. New connectors are blocked by default, so plan for ongoing allowlist reviews.
4. Scale with environment group. Applying ACP across an environment group requires Managed Environments. Configure on the group’s Rules tab.
5. Run hybrid with DLP. Keep existing DLP policies in place for custom connectors, HTTP connectors, and scenarios not yet at parity while you migrate to ACP.
6. Evaluate ACP-only mode. Test it in public preview to prepare for migration off of DLP policies.

If you would like more information on this feature, please visit the Advanced connector policies documentation and the announcement blog post.

Source: Microsoft

Latest Posts