Microsoft 365 Community Community Demos, 25 May 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Automating DLP Policy Creation in Power Platform from an Existing Policy

Description

In this 13-minute developer-focused demo, Mohammed Ashiq Faleel shows 3 options for cloning an existing Data Loss Prevention (DLP) policy in your tenant. 1) use the Power Platform Management Connector (a flow), 2) use the DLP Editor App in the CoE Starter Kit, or 3) use Power Shell using the Power Apps Administration Module that when used with a flow completely automates the process. For each option, the DLP with all connectors are copied.

This PnP Community demo is taken from the Microsoft 365 & Power Platform Development Community call recorded on May 25, 2023.

Demo Presenter
• Mohammed Ashiq Faleel (Avanade) | @AshiqFaleel

Community Call Conversation
• aka.ms/May25-Demo3

Supporting materials
• Article - How to copy an existing DLP Policy in Power Platform | https://ashiqf.com/2023/03/19/how-to-copy-an-existing-dlp-policy-in-power-platform/
• Connectors - Power Platform for Admins | https://learn.microsoft.com/connectors/powerplatformforadmins/
• Documentation - Use core components | https://learn.microsoft.com/power-platform/guidance/coe/core-components
• Documentation - Microsoft.PowerApps.Administration.PowerShell | https://learn.microsoft.com/powershell/module/microsoft.powerapps.administration.powershell
• Documentation - Power Platform data loss prevention (DLP) SDK | https://learn.microsoft.com/power-platform/admin/data-loss-prevention-sdk
• Documentation – Azure Automation runbook types | https://learn.microsoft.com/azure/automation/automation-runbook-types
• Article – How to copy an existing DLP Policy in Power Platform | https://ashiqf.com/2023/03/19/how-to-copy-an-existing-dlp-policy-in-power-platform/
• Blog - Mohamed Ashiq Faleel | https://ashiqf.com/

Learn more
• Microsoft 365 Unified Sample gallery - https://aka.ms/community/samples
• Microsoft 365 Platform Community in YouTube - https://aka.ms/community/videos
• Microsoft 365 Platform Community - http://aka.ms/community/home

A

A

Stockholm Sweden and I work as a solution architect uh predominantly focusing on Power Platform at dominate, Sweden I'm, also a business applications MVP, and these are my social handles. If you're, if you have got any questions connected with this demo, feel free to reach out to me.

A

Well, what I'm going to today talk about is uh how to automate the DLP creation policy from an existing one. So in the past, even I have spent a lot of time creating a DLP policy from an existing policy to copy it before I got to know about this option. So it's it's. It becomes uh quite cumbersome if you have to copy in. As of now in the Power Platform admin Center, there is no option to copy and create a new policy. So let's look at it.

A

How we can actually do it and the different options you can use to copy and create a new policy. So the the first option is power. Power, automate flow, so in power automate flow. There is a connector by the name, Power Platform for admins, which has actions to manage DLP policies, and then the second option is DLP editor. It's an app from Microsoft coe's Target. It has. It has a canvas app which can, which has very nice interface to copy an existing policy uh and and create a create a new new one.

A

And then we have Powershell uh partial module from powerapps Administration. So uh there are a lot of commandlets to manage which helps manage the environment, Power, Platform environments, and there are also a couple of commandlets which helps us to uh create, delete and update a DLP policy. And you can you can use this option uh for advanced uh options like, for example, if you wanted to add a custom connector to a DLP policy, or if you wanted to make changes uh to a connector or whether to allow certain actions or not.

A

So there are command lists which helps you uh do it all of these options you have to be uh tenants, are tenant, administrator or a Power, Platform administrator to do it.

A

So, for the first one power automate flow, there is a connector by the name, Power Platform for admins, which has options to manage the environmental life cycle, life cycle capabilities such as creating an environment deleting or updating an environment, and and on top of these commandlets uh actions, there are also actions which allows you to manage DLP policies. You can see here, for example, uh the the get DLP policy. It allows you to uh get information about an existing DLP policies.

A

It gives out information about the the different act, different connectors in in different categories like uh uh blocked business, non-business category, and then we have list DLP policies. We do action. This allows you to list out all the policies which exist in the tenant and then uh create update and delete as it as it suggests. As it sounds, it allows you to create, update and delete DLP policies.

A

I've also got a short demo uh with you, using using this connector to create and and create a new policy from an existing policy, and the next option is the DLP editor app. So it is, as I said. Initially, it is from uh from the Coe starter kit solution uh and, and especially from the core component solution it does. It has this app called as DLP editor app. So this is the interface here, whatever you are seeing it here.

A

So these are the policies uh which is in the tenant and as soon as you get inside, you you'll see options here to copy the policy so copy it. I said: yes, you click click on this button. You get to you get this interface where you can enter the name of the new uh policy and after you click on copy policy, it's called a create a policy based on existing one.

A

It also allows you to make changes to an existing DLP policy and and also it helps you to find out the impact uh it causes on the canvas app and the different uh cloudflow Cloud flows. So this app also uses the same connector Power Platform for admins the different actions within that connector to to create and copy the new policy, and then we have a Powershell so Powershell, as you have many have already used, uh you use this module powerapps Administration module.

A

It has also got command lists which will help you to manage DLP policies so get the LPA policy allows you to get information about an existing policy and then new and set allows you to create or update a policy, and then we have Veer, which is new PowerApp uh DLP connector configuration. So this commandlet allows you to make changes to the connector actions from a connector.

A

For example, if you, if you take an SQL connector, if you wanted to uh block an action delete or if you want to block an action update, you can, you can do so with the help of this command and also, uh there is also an interface from the uh from the command admin Center uh to make that change.

A

And then we have this commandlet, add custom connector to policy. So this allows you to add a custom connector to an existing policy, and there is also a sample from Microsoft which has caught a lot of examples on how to create, update or delete from an existing policy or or create a new policy moving out connections, moving out actions, connector actions from one group to another group. So there is a huge list of examples on this sample. I've got I've, given this as a reference at the end of the slide as well.

A

I'll go uh to the demo now so here uh it's it's! It's uh it's! A small tenant I've got here uh three policies: uh one is a default DLP policy uh which we, which is applied uh to all the environments, except except eight, and if I, edit this policy- and if you have look at if you look at the characters, I've got uh 24 uh connectors in the business category, all the non uh all the non-blockable connectors are added here in the business and then in the non-business category.

A

All connectors, which is published from Microsoft, has been added here and all other mining connectors are are blocked.

A

So when it comes to the environment, so we have here uh eight eight, eight environments, which is excluded from this DLP policy and and all of these policies. All of these environments have has got this policy applied. So what we're going to now do is uh create a copy of this DLP policy, the default DLP policy and apply that to this environment. Eu Sweden marketing, uh Dev I've already copied the environment ID, which I will, which I will show you in a while, so I'm going to the flow.

A

So this is the flow which I have got here with, which has got couple of uh two or only two actions to copy and create a new policy I'm going to test the flow.

A

So here uh I will first enter the current name of the policy, which is.

A

Let me quickly copy the name default DLP policy, that is the existing DLP policy name and then the new DLP policy I'm going to make it as DLP EU marketing Dev, which is which will be dedicated to that environment, EU marketing, environment and then the environment ID for EU marketing Dev. Is this one I've already copied I'm going to run the flow.

A

Yeah, so you can see here, the flow has run now. Let's quickly go check if the DLP policy has been created.

A

Yeah, so this is the policy which got created down uh DLP EU marketing Dev. You can also see that this policy is applied to this environment, EU marketing Dev, and if we edit this policy, you can see all the connectors which we had from the default DLP business, 24, non-business, 214 and blocked right. So you can also improvise this flow to control.

A

Moving connectors from one category to another category using select functions, I've also written a blog post detailing about it and how to do it yeah so I will I'll Now quickly uh take a go through the DLP editor app. So this is the app from the admin Center from the Coe core component solution. Dlp editor.

A

So here you can see here so the the whatever policy I had in the tenant I can create a copy by clicking on this button. So here enter enter the policy name.

A

Yeah, so after that, after click on copy policy, it's it's gonna create a new policy. Based on this, as I already said, this app from the Coe starter kit, it uses the Power Platform for admins connector right so now, I will quickly show the sample from the from Microsoft for Powershell.

A

uh You can you can see here uh this. This is the link and it is the it has the repo as well. So uh the the sample has got all the examples like uh creating a DLP policy. Copying it deleting it. So everything is here.

A

uh You can you'll have to just go through this uh and and then uh modified according to your needs, and if you- and there is also an option uh to run a Powershell script from Azure, run book automation and once you have deployed it to the Azure runbook automation service, and if you wanted to call that Powershell script from a power automate flow, there are connectors which can help you do that.

A

So you can completely automate the process if you are going to use Powershell uh for DLP automation right, so I will move over to the slide I've. Given some references here uh about the admin connector and also the DLP, editor, app and I have all also written a blog post, which has got details or whatever I've just given uh I have walked through on this demo. uh It's there on this blog post as well yeah. If there are any questions, I will take it up in the chat over to you, David.

B

Awesome very, very cool stuff, really fine example of combining Technologies in a variety of ways, Mohammed. So thank you for sharing and giving us multiple ways in which this can be utilized together.

A