DLP vs Advanced Connector Policies: Why You Need Both

For years, Power Platform data policies meant three boxes: business, non-business and blocked. In 2026, advanced connector policies arrived, with allow-lists, single actions and MCP servers. Do you replace the old policies? No. Most tenants need both.

Side by side

	Classic data policy	Advanced connector policy
Model	group connectors; block some	block everything; allow some
Granularity	whole connector	single actions, e.g. read but not send
Agents and MCP	limited	can block MCP servers agents would call
Custom connectors, HTTP	yes	not yet
Applied through	environments, tenant	environment groups

How to combine them

1. Keep a classic baseline for the tenant. It blocks risky connectors everywhere, custom connectors and HTTP included, which advanced policies cannot cover yet.
2. Add advanced policies per environment group, with strict allow-lists for production and agent environments.
3. Check the impact before you enforce: which apps and flows would break.

Where to find them

In the admin center: Security → Data and privacy. Advanced connector policies, the preview advanced-only mode, and the classic data policy sit side by side.

The checklist

1. A classic tenant baseline, custom connectors and HTTP included.
2. Advanced allow-lists per environment group.
3. Block MCP servers you have not reviewed.
4. Run the impact analysis before enforcing.

The short answer

Use classic policies for the broad tenant-wide baseline. Use advanced policies where you need precision: single actions, agent environments and MCP servers. Together they cover what neither covers alone.