SC-401 · Module 13 · Skill 2.1 Create and configure data loss prevention policies

DLP outside Microsoft 365: Power Platform and non-Microsoft cloud apps

Module 11 built Purview DLP policies for Exchange, SharePoint, OneDrive, Teams and devices. This module covers two places those policies do not reach on their own.

Place 1: Power Apps and Power Automate flows that move data between services. Place 2: files in Box, Dropbox, Google Workspace and other non-Microsoft cloud apps.

The idea that holds the whole module

Power Platform DLP controls which connectors can work together. It never looks at the data. Cloud app DLP looks at the data in the file.

Example. A flow reads customer rows from SQL Server and posts them to X (Twitter). A Power Platform data policy stops the flow because the two connectors sit in different groups. It does not care what the rows contain.

Example. A Box file with 40 credit card numbers is shared with a public link. A Defender for Cloud Apps file policy, or a Purview DLP policy for Box, finds the numbers in the file and acts on that file.

The module on one table

Question you will get	Short answer	Tab
Which product owns this control?	Flows and apps: Power Platform admin center. Box or Dropbox files: Defender portal file policy, or Purview DLP.	1
Can these two connectors be used together?	Only if they are in the same group in every policy that applies.	2
Two policies disagree. Who wins?	The most restrictive result. Blocked always wins.	2
Box files, reports in Purview with Exchange	Purview DLP policy, location Instances (or the new Box location)	3
Quarantine or remove a shared link in Box	Defender for Cloud Apps file policy, governance action	4
Which setting drives notifications?	Policy severity. Category is only a label.	4

Tab 1 · Pick the productWho owns which controlThree products, one table Tab 2 · Power PlatformConnector groupsBusiness, Non-Business, Blocked Tab 3 · Cloud apps in PurviewInstances locationAnd what replaces it in 2027 Tab 4 · File policiesDefender for Cloud AppsFilters, inspection, governance, matches ReviewThe module on one screenRe-tests and Copy my results

EXAM = tested, learn it. SKIM = context, read once. Questions test only EXAM parts. Each tab: the one idea, tenant screens with numbered marks, "pick X when" tables, traps, then questions. Answer in the page. The Review tab has "Copy my results".

VERSIONTwo features in this module retire on 6 January 2027

Microsoft Learn product pages say: Defender for Cloud Apps file policies retire on 6 January 2027. The Purview DLP Instances location retires the same day.

The SC-401 skills outline still lists "Create file policies in Microsoft Defender for Cloud Apps by using a DLP policy" and "Respond to Defender for Cloud Apps file policy alerts". So learn them for the exam. Tab 3 shows what replaces them.

FIXWhere the module and today's product pages differ

The exam follows the product. Use the right-hand column. Product pages opened 15 Nov 2026.

Module says	Product pages say
Create file policies and Instances policies (units 3 and 4)	Both retire on 6 January 2027. Replacement: Purview DLP with one location per app (preview).
Power Platform admin center › Policies › Data policies	Security › Data and privacy › Data policy
"DLP policies" in Power Platform	Renamed "data policies". Same feature.
Instances matches show in Purview, "not in Defender for Cloud Apps"	True for matches. But creating the policy also creates the same policy in Defender for Cloud Apps.
Vendor item SC401-019: SensLbl3 fails because auto-labeling is "server-side"	It fails because it is not published in a label policy. Same key, different reason.
Vendor item SC401-047: "Policies from the Control section"	Cloud Apps › Policies › Policy management. Same order.

Tab 1 · Pick the product

Three products. They overlap, but they are not interchangeable.

First ask: is the risk a flow between services, or a file sitting in an app?

A flow between services is Power Platform. A file in a non-Microsoft app is Defender for Cloud Apps or Purview DLP. A file in SharePoint or OneDrive is plain Purview DLP from Module 11.

EXAMWho owns which control

Product and portal	What it controls	Looks at content?
Power Platform data policy Power Platform admin center	Which connectors an app, flow or agent may combine	No
Defender for Cloud Apps file policy Microsoft Defender portal › Cloud Apps	Files in connected cloud apps: filters, content scan, governance actions	Yes
Purview DLP policy, Instances location Microsoft Purview portal › Data loss prevention	Files in connected cloud apps, with the Purview rule engine	Yes

Sources: Power Platform "Data policies"; Defender for Cloud Apps "File policies"; Purview "Use DLP policies for non-Microsoft cloud apps". All opened 15 Nov 2026.

EXAMPick X when

Pick this	When the scenario says
Power Platform data policy	"flow", "Power Apps", "Power Automate", "connector", "citizen developers", "environment"
File policy in Defender for Cloud Apps	"quarantine", "remove the shared link", "remove external users", "make private" in Box, Dropbox or Google Workspace
Purview DLP, Instances	"same rules and reports as Exchange and SharePoint", "manage from the Purview portal", "DLP alerts dashboard", "Activity explorer"
Purview DLP, SharePoint sites or OneDrive accounts	The files are in SharePoint or OneDrive. Do not use Instances for them.

TRAP"Detect and quarantine externally shared files in Box." Purview Instances also detects Box files. But quarantine and link removal are file policy governance actions. The module's own assessment keys the file policy.

EXAMFile policy or Purview Instances: side by side

File policy (Defender portal)

Best for cloud-app actions: quarantine, revoke links, make private
Matches show in Defender for Cloud Apps
One policy = one set of filters and actions
Up to 50 file policies per tenant

DLP policy, Instances (Purview portal)

Best for one rule set across many locations with SITs
Matches show in the Purview DLP alerts dashboard and Activity explorer
Creating it also creates the same policy in Defender for Cloud Apps
Action: Restrict Third Party Apps; choices differ by app

Source: training unit 3 comparison table; Purview "Use DLP policies for non-Microsoft cloud apps" note on automatic creation; Defender for Cloud Apps "File policy limitations" (50).

SKIMBoundary with Module 11

Module 11 teaches the general Purview DLP wizard: templates, rules, conditions, actions, simulation, policy tips. This page does not repeat it. It adds only what changes when the location is Instances or a non-Microsoft app.

Questions for tab 1

Tab 2 · Power Platform

Data policies: put connectors in groups

Connectors in the same group can work together. Connectors in different groups cannot. Blocked connectors cannot be used at all.

A connector is a wrapper around an API. It gives makers ready triggers and actions, for example "When a file is created in SharePoint".

Power Platform now calls these policies data policies. The module and the exam still say DLP policies. Same thing.

EXAMThe three groups

Group	What it means
Business	Connectors for sensitive data. They can share data only with other Business connectors.
Non-Business	Connectors for non-sensitive data. They can share data only with other Non-Business connectors. Every connector starts here.
Blocked	Cannot be used in any app or flow where the policy applies.

A connector sits in one group only, per policy.

Tenant screenshot pending: Power Platform admin center: Prebuilt connectors page with Business, Non-business and Blocked groups. Taught from Microsoft Learn; not seen in tenant yet.

EXAMWhich pairs work: one policy

Microsoft's walkthrough policy: SharePoint and Salesforce in Business. Outlook.com in Non-Business. Facebook and X (Twitter) in Blocked.

A flow wants to combine…	Allowed?
SharePoint + Salesforce (both Business)	Yes
Outlook.com + another Non-Business connector	Yes
SharePoint (Business) + Outlook.com (Non-Business)	No
Anything + Facebook (Blocked)	No
Facebook + X (Twitter), both Blocked	No. Same group, but Blocked is never usable.

Source: Power Platform "Manage data policies", connector matrix table.

TRAP"SharePoint is in Business, so users can only see some SharePoint content." Wrong. The policy does not filter data. A user still reads any library they have access to. The policy only stops SharePoint from being combined with other groups.

EXAMSome connectors cannot be blocked

Microsoft keeps core connectors working. You can put them in Business or Non-Business, but not in Blocked. The Block action is greyed out.

Kind	Examples (from Microsoft's list)
Microsoft Enterprise Plan standard connectors	SharePoint, OneDrive for Business, Microsoft Teams, Microsoft 365 Outlook, Excel Online (Business), Planner, Power BI, Defender for Cloud Apps
Core Power Platform connectors	Dataverse, Approvals, Notifications, Microsoft Copilot Studio

You can block every third-party connector. You can block every Microsoft-owned premium connector except Dataverse.

Need to block an unblockable one anyway? Microsoft points to advanced connector policies (ACP), an allowlist model. SKIM

EXAMThe default group for new connectors

Microsoft adds new connectors over time. The default group decides where they land. It starts as Non-Business.

Microsoft recommends: keep Non-Business. Review each new connector, then move it.
If you set Blocked as default: new blockable connectors go to Blocked. New unblockable connectors still go to Non-Business.

EXAMTenant-level or environment-level

An environment is a container for apps, flows and data. Companies often have Default, Production, Sandbox (test) and Developer environments.

Question	Tenant-level policy	Environment-level policy
Applies to	All environments, all except some, or a chosen list	One environment
Who creates it	Power Platform Administrator (Global Administrator also works)	Environment Admin. With Dataverse: System Administrator.
Scope page	Yes: add environments, or exclude some	No scope page
Can the other side edit it?	Environment admins cannot edit or delete it	Cannot override a tenant policy

Sources: "Manage data policies" (roles, scope, edit notes); training unit 2.

EXAMMany policies on one environment: the most restrictive wins

All policies that apply to an environment are evaluated together.

Blocked anywhere = blocked. If any policy blocks a connector, no app or flow in that environment can use it. Other policies do not matter.

Business and Non-Business: the groups intersect. Two connectors can be combined only if they are in the same group in every policy.

Example. Policy A: SharePoint and Salesforce both Business. Policy B: SharePoint Business, Salesforce Non-Business. A flow cannot combine SharePoint and Salesforce, because policy B splits them.

Three policies with two groups each can split connectors into 2³ = 8 groups. Microsoft advises: use as few policies per environment as possible.

TRAP"The environment-level policy is more specific, so it overrides the tenant policy." Wrong. There is no override. The most restrictive combination applies.

EXAMCreate one: the wizard

Open. Power Platform admin center › Security › Data and privacy › Data policy › New policy. (The module says Policies › Data policies, an older menu.)

Name. Enter the policy name.

Prebuilt connectors. Move connectors to Business or Blocked. Set the default group.

Custom connectors. Tenant-level only: an ordered list of Allow or Deny URL patterns. The last rule is *, set to Ignore by default.

Scope. Tenant-level only: add environments, or exclude some.

Review and create.

Tenant screenshot pending: Power Platform admin center: Data policy list and New policy. Taught from Microsoft Learn; not seen in tenant yet.

Tenant screenshot pending: Power Platform admin center: Scope page of a tenant-level policy. Taught from Microsoft Learn; not seen in tenant yet.

EXAMWhat happens to flows that already exist

Design time. A maker cannot save an app or flow that breaks the policy. They get an error.
Run time. A background process checks existing apps, flows and agents. Violators are suspended. Connections to a blocked connector are disabled.
Latency. Usually within an hour. In extreme cases up to 24 hours.
Flows that still comply keep running.

TRAPA tenant-wide policy hits all existing flows at once. The module's advice: audit flows first, start with one environment, then widen.

EXAMFiner controls inside one connector

They overlap with groups, but they are not interchangeable. Groups decide which connectors meet. These two decide what one connector may do.

Pick this	When you need	Limit
Connector action control	Allow or block single actions of a connector. Example: block "Delete" but allow "Read".	Blockable connectors only. Not unblockable or custom ones.
Connector endpoint filtering (preview)	Allow or deny the address a connector reaches. Example: SQL Server only to `.database.windows.net`.	HTTP, SQL Server, Azure Blob Storage, SMTP and a few more. Only static endpoints are checked.

EXAMPowerShell: right module, look-alike names

Add-PowerAppsAccount
Get-DlpPolicy
New-DlpPolicy -NewPolicy $NewPolicy
New-AdminDlpPolicy -DisplayName "MetroBank Policy"

All four come from the module Microsoft.PowerApps.Administration.PowerShell. New-DlpPolicy creates a data policy from a policy object; with the other parameter set, -DisplayName and -EnvironmentType are required. Set-DlpPolicy and Remove-DlpPolicy update and delete. New-AdminDlpPolicy is the older cmdlet. Lines copied from Microsoft's reference examples; not run in your tenant.

Cmdlet	Belongs to
`New-DlpPolicy` (Power Apps admin module)	Power Platform data policy
`New-DlpCompliancePolicy`	Purview DLP policy (Security & Compliance PowerShell)
`New-DlpPolicy` (Exchange module)	Old Exchange DLP. Same name, different product.

Questions for tab 2

Tab 3 · Cloud apps in Purview

Purview DLP for Box, Dropbox and Google Workspace

Purview cannot see a non-Microsoft app on its own. It borrows the Defender for Cloud Apps connector.

So the order is always the same. First connect the app in Defender for Cloud Apps. Then the app appears as a location in the Purview DLP wizard.

EXAMToday's exam path: the Instances location

Connect the app. Defender for Cloud Apps app connector for Box, Dropbox, Google Workspace, Salesforce, Cisco Webex, AWS or ServiceNow.

Create the policy. Purview portal › Data loss prevention › Policies › Create policy › Custom › Custom policy.

Locations. Turn on Instances. To pick apps: Edit › Specific instances › Include instances. If you pick none, the policy covers all connected apps.

Rule. Conditions such as Content contains a sensitive information type. Action: Restrict Third Party Apps, then the actions each app offers.

Result. The same policy is created automatically in Defender for Cloud Apps. Matches show in the Purview DLP alerts dashboard and Activity explorer.

Tenant screenshot pending: Purview DLP wizard: Locations page with Instances. Taught from Microsoft Learn; not seen in tenant yet.

TRAP"All instances" means all apps connected to Defender for Cloud Apps. An app your users use but you never connected is not covered.

Roles that can create the policy (from the Purview page): Compliance administrator, Compliance data administrator, Information Protection, Information Protection Admin, Security administrator.

VERSIONAfter 6 January 2027: dedicated app locations (preview)

Microsoft is replacing Instances with one location per app. The wizard path starts with Enterprise applications & devices. The rules are stricter.

Rule for non-Microsoft app locations	What it means
Custom template only	Financial, Medical and Privacy templates do not support these locations
Cannot mix locations	Box and Dropbox together is fine. Box plus SharePoint, Exchange, Fabric or Devices in one policy is not.
Advanced DLP rules only	Conditions and actions differ by app
No policy tips, no user overrides	Users get no tip in Box
No simulation mode	Turn on now, or leave off
Admin units not supported	Scope is Full directory
Reporting	Activity explorer and DLP alerts: yes. Content explorer: no.
Known gaps	Encrypted files and PDF files are not classified yet

Source: Purview "Use DLP policies for non-Microsoft connected apps (preview)", opened 15 Nov 2026. Not seen in tenant.

SKIMMoving file policies to Purview

Defender portal › Cloud Apps › Policies › Policy management › All policies tab › banner › Migrate. A 4-step wizard.
It sorts policies into Can migrate, Partial migration, Cannot migrate.
New Purview policies are named [Migrated] <name> (1P DLP) and start in Test with notifications mode.
A labeling file policy becomes a Purview auto-labeling policy, not a DLP policy.
Non-Microsoft app policies (Box, Dropbox…) are not migrated by the tool yet. Recreate them by hand.
Do not run both at once. Turn on Purview, validate, then disable the file policy. Delete it later.

Source: Defender for Cloud Apps "Migrate file policies to Microsoft Purview", opened 15 Nov 2026.

Questions for tab 3

Tab 4 · File policies

Defender for Cloud Apps file policies

A file policy = content scan + context filters + automated actions.

Example: find files with credit card numbers (content), shared externally (context), in Dropbox, then remove the external users (action).

The policy uses the cloud app's API. It scans files already there and new files.

EXAMBefore the first policy

Prerequisite	Where, or what to know
Connect the app	App connector in Defender for Cloud Apps
Enable file monitoring	Defender portal › Settings › Cloud Apps › Information Protection › Files
Keep one policy alive	No file policy, or all disabled for 7 days in a row: file monitoring turns itself off
Entra service principal permissions	Granted automatically for the first file policy. If that fails, fix it first.
Scan encrypted files	One-time admin consent: Settings › Cloud Apps › Microsoft Information Protection › Inspect protected files › Grant permission

Tenant screenshot pending: Defender portal: Settings › Cloud Apps › Files (Enable file monitoring). Taught from Microsoft Learn; not seen in tenant yet.

EXAMThe form, field by field

Path: Defender portal › Cloud Apps › Policies › Policy management › Information protection tab › Create policy › File policy.

Field	What it does
Policy severity	Decides whether matches send notifications, if notifications are set per severity
Category	Information only. Helps you filter policies and alerts. Default: DLP.
Filters	Metadata, over 20 filters: access level (Public, External, Internal, Private), app, owner, extension, label…
Apply to	All files, selected folders, or all except selected folders
Select user groups	Which file owners are in scope
Inspection method	Built-in DLP, or Data Classification Service (recommended)
Alerts	Alert per match, email, daily alert limit, send to Power Automate
Governance actions	What to do to the file

Tenant screenshot pending: Defender portal: Create file policy form. Taught from Microsoft Learn; not seen in tenant yet.

TRAP"Trigger notifications based on matching criteria" is Policy severity. Category sounds right, but it changes nothing.

EXAMTwo inspection methods

Pick this	When
Data Classification Service	You want the same sensitive information types and trainable classifiers you keep in Purview. Microsoft recommends it.
Built-in DLP	Defender for Cloud Apps' own engine. Preset or custom expressions (substring, exact string, regular expression).

Threshold. Set a minimum number of matches. Example: 10 = alert only on files with at least 10 card numbers.
Masking. Matches show as X. Numbers in the 100 characters of context show as #. Option: unmask the last four characters.
File types. Text is extracted from more than 100 file types.

EXAMSafe rollout: monitor first, act later

Create with no governance action. The policy is on and scans at once. Use "Edit and preview results" on the filters first.

Review the matches. Too many? Wrong app? Tighten the filters.

Then add governance actions. Quarantine or remove access only when the scope is right. Some actions can't be undone.

EXAMGovernance actions you must know

Action	What it does
Remove external users	Keeps only collaborators from your internal domains
Remove public sharing	Only named collaborators keep access. Box and Dropbox call it Remove direct shared link.
Make private	Removes all shares. Only site admins can open it.
Put in user quarantine	Removes permissions, moves the file to a quarantine folder the user controls
Put in admin quarantine	Moves the file to an admin quarantine. The admin must approve it.
Apply sensitivity label	Applies a Purview label, with encryption if the label has it
Notify owner, last editor, specific users	Email notifications

Two policies, overlapping actions. If one action contains the other (Remove external users is inside Make private), the stronger one is enforced. Unrelated actions both run.

Source: Defender for Cloud Apps "Govern actions for connected apps".

EXAMLabels through a file policy: four rules

The label must be published in a sensitivity label policy. An auto-labeling policy is not a publishing policy.
The label scope must include at least Files and Emails.
100 Apply label actions per app, per tenant, per day. Then it pauses and continues after 12:00 UTC the next day.
Supported for Box, Google Workspace, SharePoint and OneDrive. Word, Excel, PowerPoint and PDF files. Up to 30 MB.

Source: Defender for Cloud Apps "Integrate with Microsoft Purview for information protection".

EXAMRespond to file policy alerts

Find the policy. Cloud Apps › Policies › Policy management › Information protection tab. Filter Type = File policy.

Open the matches. In the Count column, select the matches. Or ⋯ › View all matches.

Read two tabs. Matching now: files that match today. History: up to six months back.

Decide. Real risk: apply a governance action. Safe file: select ✓ Authorize. It leaves the report and stops matching.

Check. Cloud Apps › Governance log shows every action, success or failure. Some actions can be retried or reverted there.

Tenant screenshot pending: Defender portal: Policy management, Information protection tab, Count column. Taught from Microsoft Learn; not seen in tenant yet.

TRAPThe daily alert limit caps alerts only. Governance actions still run.

TRAP"Reset results and apply actions again" rescans every file in scope. Microsoft says avoid it in production. It is not a way to silence one false positive.

EXAMNumbers

50file policies per tenant

20+metadata filters

100+file types inspected

6 monthsHistory tab

7 daysno active policy = monitoring off

100 / dayApply label, per app, per tenant

Questions for tab 4

Review

The module on one screen

If the stem says	Answer
Flow, Power Apps, connector	Power Platform data policy, Power Platform admin center
Two connectors in different groups	Cannot be combined
Tenant blocks, environment allows	Blocked. Most restrictive wins.
Block SharePoint or Dataverse connector	Not possible. Unblockable: Business or Non-Business only.
Default group for new connectors	Keep Non-Business
Block one action, not the connector	Connector action control
Allow only some servers or URLs	Connector endpoint filtering
Box files, Purview reports	Connect app in Defender for Cloud Apps, then DLP with Instances
No instance selected	All connected apps
Quarantine, revoke link in Box	File policy governance action
Notifications by criteria	Policy severity
Reuse Purview SITs in a file policy	Data Classification Service
Exactly 100 files labeled per day	Apply label daily limit
False positive, keep filters	Authorize the file in the matches list
Retirement	File policies and Instances: 6 January 2027

Re-tests from Module 3 (you missed these on 9 Nov)

The scenario touches this module: Defender for Cloud Apps file policies versus Purview DLP events.

Your score

Paste the results in the thread. I grade the misses and build the re-test.

Confidence and caveats

0.85. Every key was derived from Microsoft Learn pages opened on 15 November 2026, before reading the vendor key. Not higher for four reasons.

File policies and the Instances location retire on 6 January 2027. Exam items written before that may drift. The skills outline still lists them.
The new non-Microsoft app locations are in preview and roll out in phases. Rules may change.
The vendor banks have no Power Platform items. All Power Platform questions here are new items written from the Power Platform docs.
Power Platform PowerShell lines are copied from Microsoft reference examples. They were not run in your tenant. Context7 was not used: it covers no Power Platform admin cmdlets.

Vendor keys checked: SC401-019, 040, 042, 047, 110.1, 110.2, 110.3. All keys AGREE. SC401-019 explanation corrected. SC400-018, 038, 050 are the same items as SC401-019, 042, 047, so they are not repeated. Original items checked: ORIG-D1-13, ORIG-D2-04, 05, 06, ORIG-D3-13. All AGREE.