Bug: shared_flowmanagement and shared_agentnode connectors needs allowed by DLP

[russrimm]

Description

The Copilot Agent Kit installer code app has a reference to Power Automate Management (shared_flowmanagement) connector so it needs to be added to the DLP allow list. The shared_agentnode preview connector can also cause DLP violations if it gets blocked.

Customizations.xml has this reference so it will cause a DLP violation if not allowed.

id: /providers/Microsoft.PowerApps/apis/shared_flowmanagement
displayName: Power Automate Management
dataSources: ["flowmanagement"]
apiTier: Standard

Steps to reproduce

1. Put Power Automate Management (shared_flowmanagement) connector in non-business or blocked.
2. Put Agent (preview) (shared_agentnode) connector in non-business or blocked. (I believe it's possible via api)
3. Try to install the Copilot Studio Kit

Expected behavior

Copilot Studio Kit installs without fail

Actual behavior

Solution "Copilot Agent Kit" failed to import: CanvasApp import: FAILURE: Code: AcpDlpPolicyEvaluation Message: The app 'cat_copilotagentkitinstaller_81f96' cannot be saved because one or more connectors it uses 'shared_commondataserviceforapps, shared_flowmanagement' are blocked by Advanced Connector Policy (ACP) or Data Policies (DLP) for this environment. Please contact your environment administrator '' to update the policies 'Copilot Studio Kit Policy' to allow the connectors used by this app. Link for the policy wiki ''. Violation details: [PolicyId: 96b4dd2b-b8a9-4b0c-86a7-1d8ba2671a05, PolicyDisplayName: Copilot Studio Kit Policy, PolicyType: DLP, PolicySource: , PolicyLastModified: 2026-08-18T22:16:54.919948Z, ViolationType: BusinessAndNonBusinessConnector, Parameters: [shared_commondataserviceforapps, shared_agentnode]]; [PolicyId: 96b4dd2b-b8a9-4b0c-86a7-1d8ba2671a05, PolicyDisplayName: Copilot Studio Kit Policy, PolicyType: DLP, PolicySource: , PolicyLastModified: 2026-08-18T22:16:54.919948Z, ViolationType: BusinessAndNonBusinessConnector, Parameters: [shared_flowmanagement, shared_agentnode]]. Client Request Id: b0a64710-1fd1-4e6e-8658-f4cabd1d3a6d.

Environment

No response

Additional context or logs

Solution "Copilot Agent Kit" failed to import: CanvasApp import: FAILURE: Code: AcpDlpPolicyEvaluation Message: The app 'cat_copilotagentkitinstaller_81f96' cannot be saved because one or more connectors it uses 'shared_commondataserviceforapps, shared_flowmanagement' are blocked by Advanced Connector Policy (ACP) or Data Policies (DLP) for this environment. Please contact your environment administrator '' to update the policies 'Copilot Studio Kit Policy' to allow the connectors used by this app. Link for the policy wiki ''. Violation details: [PolicyId: 96b4dd2b-b8a9-4b0c-86a7-1d8ba2671a05, PolicyDisplayName: Copilot Studio Kit Policy, PolicyType: DLP, PolicySource: , PolicyLastModified: 2026-08-18T22:16:54.919948Z, ViolationType: BusinessAndNonBusinessConnector, Parameters: [shared_commondataserviceforapps, shared_agentnode]]; [PolicyId: 96b4dd2b-b8a9-4b0c-86a7-1d8ba2671a05, PolicyDisplayName: Copilot Studio Kit Policy, PolicyType: DLP, PolicySource: , PolicyLastModified: 2026-08-18T22:16:54.919948Z, ViolationType: BusinessAndNonBusinessConnector, Parameters: [shared_flowmanagement, shared_agentnode]]. Client Request Id: b0a64710-1fd1-4e6e-8658-f4cabd1d3a6d.

[Ramakrishnan24689]

Hi Russ Rimmerman [MSFT] (@russrimm) ,

Thanks for reporting this and for including the policy violation details.

The Copilot Agent Kit Installer intentionally uses the following connectors for Agent Review setup:

• Agents (preview) ( shared_agentnode ) to establish and validate the Agents connection
• Microsoft Dataverse ( shared_commondataserviceforapps ) to read and repair solution connection references
• Power Automate Management ( shared_flowmanagement ) to locate, read, activate, and verify the Review Agent Components flow

Power Platform evaluates these connector dependencies during solution import. Under classic DLP, all three connectors must be permitted in the same data group. The reported  BusinessAndNonBusinessConnector  violations indicate that  shared_agentnode  is currently classified differently from Dataverse and Power Automate Management.

The installer cannot override or bypass an organization’s connector policies. To resolve the import failure, a Power Platform administrator must review the applicable DLP policy and, if use of Agent Review is approved, assign all three connectors to the same permitted data group, typically Business, in the target environment. The solution import can then be retried. If this policy configuration cannot be approved, the Agent Review capability cannot be installed in that environment.

The installer currently documents Agents and Dataverse but does not clearly identify Power Automate Management or the pre-import DLP requirement. We’ll update the installation guidance to make all three dependencies and the required policy configuration explicit.