From 5833018154d251b6a34364bd53dc8b7119cfdc37 Mon Sep 17 00:00:00 2001 From: Innocent Wafula Date: Mon, 29 Jun 2026 19:42:48 -0400 Subject: [PATCH] Fix: remove StopPolicyProcessing from custom AI app DLP rules StopPolicyProcessing is only supported for Exchange and Teams workloads. When the DLP policy uses EnforcementPlanes = @("Application") (the entire purpose of these samples), New-DlpComplianceRule rejects the parameter with: Using the 'StopPolicyProcessing' parameter is supported only for Exchange, Teams. Either remove this parameter or turn on only Exchange, Teams. This causes the rule-creation step to fail every time either sample is run as-published. The policy gets created (step 3 succeeds) but the rule creation (step 4) fails, leaving a policy with no rules and therefore no DLP enforcement -- a silent failure that's easy to miss until you test the custom AI app and find no upload/download blocking happens. Reproduced against tenant in us-east-1 with the AWSBedrock sample and an Entra app registration. Removing the line allows New-DlpComplianceRule to succeed and produces the intended UploadText=Block + DownloadText=Block rule under the Application enforcement plane (verified with protectionScopes/compute returning an evaluateInline scope for downloadText after the fix). --- AWSBedrock/create_purview_dlp_policy_customer_sample.ps1 | 1 - DLPforCustomAIApps/Create-DlpPolicyForCustomAIApps.ps1 | 1 - 2 files changed, 2 deletions(-) diff --git a/AWSBedrock/create_purview_dlp_policy_customer_sample.ps1 b/AWSBedrock/create_purview_dlp_policy_customer_sample.ps1 index 076a4ff..20bcd70 100644 --- a/AWSBedrock/create_purview_dlp_policy_customer_sample.ps1 +++ b/AWSBedrock/create_purview_dlp_policy_customer_sample.ps1 @@ -149,7 +149,6 @@ if ($EnableDlpPolicy) { @{ Setting = "UploadText"; Value = "Block" }, @{ Setting = "DownloadText"; Value = "Block" } ) - StopPolicyProcessing = $true Comment = "Blocks prompts and responses containing common sensitive information types in custom AI apps." } diff --git a/DLPforCustomAIApps/Create-DlpPolicyForCustomAIApps.ps1 b/DLPforCustomAIApps/Create-DlpPolicyForCustomAIApps.ps1 index 9b1533e..a6ea67d 100644 --- a/DLPforCustomAIApps/Create-DlpPolicyForCustomAIApps.ps1 +++ b/DLPforCustomAIApps/Create-DlpPolicyForCustomAIApps.ps1 @@ -157,7 +157,6 @@ $ruleParams = @{ @{ Setting = "UploadText"; Value = $RestrictAction }, @{ Setting = "DownloadText"; Value = $RestrictAction } ) - StopPolicyProcessing = $true Comment = "Blocks prompts and responses containing the listed sensitive information types." }