Unable to Add Knowledge to Agent Due to DLP Error

(1) Share

Report

Posted on by CU18061550-0

Hello,

I am having a strange issue where I am unable to add any knowledge (documents or SharePoint) to my copilot agent I am creating in copilot studio. It always says the action is blocked "Not allowed due to your organization's data loss prevention policies. Contact your admin.".

Things I have done:

check power platform to see if there were any DLP policies . there were none.
create a new environment and create a new policy that assigned "SharePoint" and "Knowledge source with documents in Copilot Studio " connectors the "Business" section.

Even after doing both of these adding those connectors still tells me that its blocked. I am in GCC-HIGH but I spoke with others that have the same environment, and they are able to doit. IM not sure what else to do here. any assistance would be grateful.

Categories:

Calling actions from Copilot Studio

I have the same question (0)

All responses (3)

Answers (0)

Sort by

Suggested answer

11manish 2,983 on at

Like (0)

Report
Copy link

Link copied!
Given that:

You don't see any environment DLP policies causing the issue,

You've already classified SharePoint and Copilot knowledge connectors correctly,

The error persists across environments,

the most likely causes are tenant-level DLP/ACP policies, GCC High service restrictions, or Purview/Conditional Access controls.

I would start by having a Power Platform administrator review all tenant-level DLP and Advanced Connector Policies, then capture a browser

network trace (HAR file) while reproducing the issue. The underlying API response often reveals the exact policy or connector being blocked.

Was this reply helpful? Yes No
CU18061550-0 28 on at

Like (1)

Report
Copy link

Link copied!

By tenant-level DLP and Advanced Connector Policies do you mean the environment level policies? We did check that. Is there some other place that they should be looking?

Was this reply helpful? Yes No
Suggested answer

Valantis 6,456 on at

Like (1)

Report
Copy link

Link copied!

Hi @CU18061550-0,

yes, there is a separate place from environment-level policies. DLP in Power Platform has two scopes.

Environment-level DLP: what you've already checked, applies only to specific environments.

Tenant-level DLP: applies across all environments and cannot be overridden by environment policies. The most restrictive policy always wins. A tenant-level policy blocking a connector will still block it even if your environment-level policy allows it.

Where to look: PPAC > Policies > Data policies. In the Scope column, look for policies set to "All environments" or that explicitly include your environment. These are your tenant-wide policies. Environment admins can't see or create these, only Power Platform admins or Global admins can.

For GCC High specifically: there are additional feature availability restrictions that don't exist in commercial tenants. Some Copilot Studio knowledge source capabilities may simply not be available or may be behind additional compliance controls in GCC High that normal DLP policy management doesn't expose. Microsoft docs confirm GCC High has a different feature matrix for Copilot Studio than commercial cloud.

Ask your tenant admin (not just environment admin) to check for any tenant-scoped DLP policies and also review PPAC > Settings > Tenant settings for any Copilot-specific feature toggles that may be turned off for compliance reasons.

Ref: https://learn.microsoft.com/en-us/microsoft-copilot-studio/admin-dlp-troubleshooting

Best regards,

Valantis

✅ If this helped solve your issue, please Accept as Solution so others can find it quickly.

❤️ If it didn’t fully solve it but was still useful, please click “Yes” on “Was this reply helpful?” or leave a Like :).

🏷️ For follow-ups @Valantis.

📝 https://valantisond365.com/

💼 LinkedIn

▶️ YouTube

Was this reply helpful? Yes No