When an admin blocks a connector with a low-code data policy, makers can no longer save flows that use it, and existing flows that violate the policy can be suspended and their connections disabled. Enforcement is not instant. Microsoft says it is usually within an hour and can reach 24 hours.
Two moments: design time and runtime
Microsoft's Power Platform documentation separates these clearly, and the idea applies to any governed automation platform.
- Design time: a person is building. If a connector is blocked, they get an error when saving a flow or app that uses it.
- Runtime: a flow is running on a schedule or trigger. If its connector or connection is now blocked, it fails with a broken connection message.
Both matter. Admins often test only the first, then discover the second when a nightly job fails.
What the platform does after you change a policy
Per the documentation, the process runs in order:
- The policy is saved at the tenant level.
- It cascades to each environment.
- Resources in each environment check periodically for new configuration.
- Each app, flow and chatbot is evaluated against the policy.
- A violating resource is put in a suspended or quarantine state.
- If the whole connector is blocked, its connections are set to disabled.
- Anything still running that uses a blocked action, trigger or tool fails at runtime.
The time to full enforcement depends on how many environments and resources you have. In most cases it is within an hour, and in the most extreme cases 24 hours.
A rollout plan that avoids surprises
| Phase | What to do |
|---|---|
| Inventory | List the connectors in use and the flows that depend on them |
| Classify | Decide which connectors are allowed together, and which are blocked |
| Notify | Tell owners of affected flows what will stop and when |
| Pilot | Apply the policy to a test environment first |
| Enforce | Apply to production at a quiet time, with an owner on call |
| Verify | Check for suspended flows and failed runs after the lag window |
What a connection is
A connection is a saved credential for a connector, stored in the environment that hosts the flow. So blocking a connector is also a way to cut off a stored credential. It does not delete the credential at the provider. If a connection pointed at an account you no longer trust, revoke it there too.
Custom connectors need extra care
Custom connectors let makers wrap any API. Microsoft's guidance is that they need careful consideration to make sure they follow data policies. Treat each as a new integration: review the API, the auth method and who owns it.
Quick check
If I block a connector, are the stored credentials deleted?
Not at the provider. The platform disables the connection, but you should revoke the grant on the service side if you no longer trust it.
Do data policies stop AI steps in a flow?
They govern connectors, including some that expose tools to AI features. Check your platform's current documentation for what each rule covers.
Safeguard's policies, gates and asset discovery are built for the same idea: decide the rule, check it automatically, and keep evidence. Try the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
