Multiple tenants

One app registration per tenant

An app registration only exists in the tenant where it was created. There is no way around this: for each tenant you want to audit, repeat the app registration setup in that tenant — registration, API permissions with admin consent, credential, and the Power Platform Admin role for the service principal.

The client ID will be different in every tenant.

Switching tenants in 1.2.0

Flow Auditor reads its sign-in from the Authentication section of appsettings.json (or PowerToolBox_ environment variables), so an audit covers one tenant per app launch. To audit a second tenant, edit the Authentication values to that tenant’s registration and restart the app.

If you audit several tenants regularly, the practical setup is one extracted copy of the app folder per tenant, each with its own appsettings.json. Everything is self-contained, so the copies do not interfere with each other.

Connection Manager is built around saved per-tenant profiles, but in 1.2.0 the wizard does not save new profiles — the configuration route above is the working path. See Known limitations in 1.2.0.

What a scan covers

A connected audit runs against one tenant at a time: the Flow Auditor environment dropdown lists the environments the configured app registration can see in its tenant. It does not reach across tenants.

A workable routine:

1. Point the app at the tenant you care about and restart.
2. Run the audit.
3. Export a report per tenant — the Save-As dialog suggests a timestamped file name, so add the tenant name when you archive. See Export and share findings.

Credentials and caches stay separate

The token cache is stored per app registration — %LocalAppData%\PowerToolBox\msal_{clientId}.cache — and encrypted with Windows DPAPI against your Windows user profile. Each tenant’s registration keeps its own cache file, so one tenant’s tokens are never reused for another.

If sign-in starts failing with token errors, delete the msal_{clientId}.cache file for that registration only and try again. The other tenants are unaffected.

As with everything else in PowerToolBox, the traffic goes only to Microsoft endpoints for the tenant you are connected to. No audit data leaves your machine.

Next steps

• Entra app registration — repeat this once per tenant.
• Quickstart: your first audit — the scan and export flow.

Last updated: July 27, 2026