PowerToolBox
Download

Install and first run

Install

  1. Download the latest PowerToolBox zip from the install page.
  2. Extract the zip to a folder you control.
  3. Open the win-x64 folder and run PowerToolBox.exe.
win-x64\PowerToolBox.exe

The .NET 8 runtime is bundled in the download. You do not need to install .NET, and there is no setup wizard. To uninstall later, delete the folder.

The build is not code-signed, so Windows SmartScreen may warn on first launch. Verify the download’s SHA-256 against the value on the install page, then choose More info → Run anyway; see SmartScreen blocks the app.

The main window

The app opens on a Welcome tab. The sidebar on the left lists every tool, grouped by category; Flow Auditor is under Audit and Connection Manager is under Administration. Clicking a tool opens it in a new tab. A status bar at the bottom shows the version and open tabs.

First run: connect a tenant

In 1.2.0, Flow Auditor takes its sign-in from configuration, not from a saved profile:

  1. Open appsettings.json next to PowerToolBox.exe.
  2. Fill in the Authentication section: Tenant ID, Client ID, and a CertificateThumbprint (recommended) or ClientSecret.
  3. Restart the app, then open Flow Auditor and run your first scan.

If you do not have an app registration yet, follow Entra app registration first. For help choosing the credential, see Certificate vs client secret.

You can also open Connection Manager and use the wizard to test those same values — the test is a real sign-in check — but in 1.2.0 the wizard does not save the connection as a reusable profile. The Authentication section is what the audit uses. See Known limitations in 1.2.0.

No tenant handy

The Flow Documentation tool works without any sign-in: point it at exported flow .json files or a solution .zip and it generates interactive HTML documentation locally. See Document your flows. Flow Auditor itself audits live environments and needs the app registration above.

Where your data goes

Settings are saved to %APPDATA%\PowerToolBox\settings.json. Logs go to %APPDATA%\PowerToolBox\logs and are redacted before they are written — tokens and secrets stay out of the log files.

If sign-in fails, the error categories are short. 401 usually means admin consent is missing or a credential expired. 403 means the service principal is missing the Power Platform Admin role. The API permissions page and Sign-in errors 401 and 403 cover both.

Next steps

Last updated: July 27, 2026