↳ GitHub sourceAnalytics ruleLow

Power Platform - DLP policy updated or removed

Description

Identifies changes to DLP policy, specifically policies which are updated or removed.
Rule type
Scheduled
Version
3.2.0
Declared status
Available
Query frequency
1h
Query period
1d
Trigger
gt 0

Declared MITRE coverage

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

Data types

KQL query

Original query, unchanged.

let create_policy_ignore_time_window = 10m;
let query_frequency = 1h;
let dlp_policy_events = PowerPlatformAdminActivity
    | where TimeGenerated >= ago(query_frequency)
    | where EventOriginalType == "GovernanceApiPolicyOperation"
    | where PropertyCollection has_any ("DeleteDlpPolicy", "UpdateDlpPolicy", "CreateDlpPolicy")
    | mv-expand PropertyCollection
    | extend
        Name = tostring(PropertyCollection.Name),
        Value = tostring(PropertyCollection.Value)
    | summarize Properties = make_bag(bag_pack(Name, Value))
        by
        TimeGenerated,
        EventOriginalUid
    | extend
        PolicyName = tostring(Properties['powerplatform.analytics.resource.display_name']),
        EventType = tostring(Properties['powerplatform.analytics.resource.tenant.governance.api_policy.operation_name']),
        ActorName = tostring(Properties['enduser.principal_name']),
        PolicyId = tostring(Properties['powerplatform.analytics.resource.id']),
        AdditionalInfo = Properties['powerplatform.analytics.resource.tenant.governance.api_policy.additional_resources'];
let delete_events = dlp_policy_events
    | where EventType == "DeleteDlpPolicy";
let update_events = dlp_policy_events
    | where EventType == "UpdateDlpPolicy";
let create_events = dlp_policy_events
    | where EventType == "CreateDlpPolicy"
    | extend ignore_time = TimeGenerated + create_policy_ignore_time_window;
union
    delete_events,
    (update_events
    | join kind=leftouter (
        create_events
        | project-away TimeGenerated
        )
        on PolicyId
    | where isempty(ignore_time) or TimeGenerated > ignore_time
    | project-away ignore_time)
| where TimeGenerated >= ago(query_frequency)
| extend
    AccountName = tostring(split(ActorName, "@")[0]),
    UPNSuffix = tostring(split(ActorName, "@")[1])
| project
    TimeGenerated,
    ActorName,
    EventType,
    PolicyName,
    PolicyId,
    AccountName,
    UPNSuffix,
    AdditionalInfo

Declared entities

Account

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
1b2e6172-85c5-417a-90c3-7cc80cb787f5
Additional source files 2Solutions/Microsoft Business Applications/Analytic Rules/Power Platform - DLP policy updated or removed.yamlsource ↗Solutions/Microsoft Business Applications/Data/Solution_PowerPlatform.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.