DLP Violation Maker Notification

Overview

This flow monitors Dataverse logs for Data Loss Prevention policy violations and automatically notifies the maker via personalized email with violation details and remediation steps. The flow runs daily at 8:00 AM, resolves each maker's profile via Office 365 Users, and sends both a High-importance maker notification and a Normal-importance admin copy before marking the violation as notified.

Use Case

Organizations using Power Platform Data Loss Prevention policies need to notify makers when their flows or apps violate a policy. Rather than relying on manual review, this flow automates notification: it reads from a Dataverse log table, resolves each maker's identity, and sends a professional HTML email explaining what was violated, which resource triggered it, and how to remediate. An admin copy ensures governance teams stay informed.

The flow is ideal for teams that:

• Automated DLP violation notification loop — no manual emails needed
• Personalized messages to makers with their specific violation details
• Admin copy ensures governance and compliance visibility
• Prevents repeat violations through targeted maker education
• Configurable schedule and policy documentation URL
• Tracks notification state to prevent duplicate emails

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Deploying to Another Environment

Import the solution into the target environment, update each environment variable with your organization's values, bind the Office 365 Outlook and Office 365 Users connection references to your tenant's connections, bind the Microsoft Dataverse connection to the target environment's Dataverse instance, then turn the flow on.

Change check frequency

Edit the Recurrence trigger to run more or less often (e.g., every 4 hours instead of daily at 8 AM).

Customize email template

Edit the Send Maker Notification Email and Send Admin Copy actions to change HTML body, subject line, or importance level.

Add extra metadata

Append violation category or severity to the maker email by adding new Dataverse columns and referencing them in the compose actions.

Exclude certain makers

Add a Filter Array before the ForEach loop to exclude system accounts or non-human makers.

Add Teams notification

Insert a Teams Post Message action parallel to Send Maker Email to post violation alerts in a security channel.

Implement retry logic

Wrap the ForEach body in a Scope with Configure Run After to handle transient failures gracefully.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

items('For_Each_DLP_Violation')?['flowlibs_makeremail']

items('For_Each_DLP_Violation')?['flowlibs_violationname']

concat('DLP Policy Violation: ', items('For_Each_DLP_Violation')?['flowlibs_violationname'])

variables('varAdminEmail')

variables('varPolicyDocUrl')

items('For_Each_DLP_Violation')?['flowlibs_dlpviolationid']

@{flowlibs_notificationsent: true}