Governance rules

Governance rules check ownership, sharing, licensing, and DLP posture. The category carries a 1.0 multiplier in scoring; findings here accumulate rather than spike.

In 1.2.0 the scan does not collect flow owners or DLP policies, which changes how several of these rules behave — each rule below is marked. See Known limitations in 1.2.0.

DLP-01 — Child Flow DLP Bypass (High)

What it checks. Whether the flow calls child flows and its own connectors appear in both the Business and the Non-Business (or Blocked) groups of the tenant’s DLP policies.

Why it matters. Splitting connectors across parent and child flows can sidestep DLP. Each flow looks clean on its own; the combination is not.

What to do. Review the child flow definitions named in the finding and keep connector classifications within a single DLP boundary.

In 1.2.0. This rule cannot fire — no DLP policy data is collected, so the Business/Non-Business comparison has nothing to work with.

OWN-01 — Orphaned Flow (Medium)

What it checks. Whether the flow has any owner of type User.

Why it matters. An orphaned flow breaks when the original creator’s credentials expire, and nobody is accountable for it in the meantime.

What to do. Assign a dedicated owner or service account with the licenses and permissions the flow needs.

In 1.2.0. This rule flags every audited flow — no owner list is collected, so no flow can prove it has an owner. Treat hits as “owner not confirmed”, not “no owner”.

OWN-03 — Admin Account Ownership (Medium)

What it checks. Whether a Production flow’s creator or owner identifier contains “admin”.

Why it matters. Admin ownership violates least privilege and muddies the audit trail when something goes wrong.

What to do. Transfer ownership to a dedicated service account or to the business user responsible for the flow.

In 1.2.0. This rule cannot fire — it needs owner data and a Production environment type, and the scan collects neither.

HYG-02 — Default Environment Usage (Low)

What it checks. Whether the flow lives in the Default environment.

Why it matters. The Default environment lacks the isolation and governance controls of dedicated environments, and every tenant user can build in it.

What to do. Migrate business-critical flows to a dedicated Production or Sandbox environment with DLP policies in place.

In 1.2.0. This rule flags every flow — environment type is not discovered, so every environment is treated as Default.

What it checks. Whether the flow is shared with guests or broad groups (owner identifiers containing ”@”, “everyone”, or “guest”, or starting with “S-1-”), or whether it has more than 10 owners.

Why it matters. Broad sharing widens who can edit, run, and export the flow.

What to do. Review the sharing list, remove guest access, and keep owners to essential personnel.

In 1.2.0. This rule cannot fire — it evaluates the owner list, which the scan does not collect.

CON-02 — Premium Connector Unlicensed (Medium)

What it checks. Whether the flow uses a connector from the rule’s premium list, for example shared_sql, shared_sharepointonline, shared_salesforce, shared_dynamics365, the Azure service connectors, SAP, Oracle, or the cognitive services connectors.

Why it matters. Premium connectors require premium licenses; unlicensed use fails at run time and breaches licensing terms.

What to do. Assign Per-user or Per-flow licenses to the owner and the users who run the flow, or switch to a standard connector where one exists.

DLP-04 — Unclassified Connector (Medium)

What it checks. Whether a connector used by the flow appears in no DLP policy connector group at all.

Why it matters. Unclassified connectors fall back to the most restrictive default classification, which can block flows unexpectedly. Nobody has made a decision about where the connector belongs.

What to do. Classify the connector explicitly as Business or Non-Business in your DLP policy.

In 1.2.0. This rule flags every connector in every flow — no DLP policy data is collected, so nothing can be classified. Treat hits as a prompt to confirm your DLP coverage by hand.

Last updated: July 27, 2026