Known limitations in 1.2.0

This page lists behavior in 1.2.0 that can surprise you, so you can read your results correctly. None of it blocks an audit; it changes how much trust to put in specific findings.

Owner, DLP, and run-history data is not collected

In 1.2.0 the audit pipeline downloads flow definitions only. It does not collect flow owners, the tenant’s DLP policies, or run history, and it passes empty collections for all three to the rule engine. Two consequences follow.

These rules fire on almost everything, because the data that would clear a flow is missing:

OWN-01 Orphaned Flow flags every audited flow, since no owner list exists to prove an owner.
DLP-04 Unclassified Connector flags every connector in every flow, since no DLP policy exists to classify it.
AI-03 AI Connector Unclassified flags every AI connector for the same reason.
HYG-02 Default Environment Usage flags every flow, because every environment is treated as Default (see below).

Treat these findings as review prompts, not confirmed violations. An OWN-01 hit in 1.2.0 means “the app could not confirm an owner”, not “this flow has no owner”.

These rules cannot fire at all in 1.2.0, because they need the missing data:

OWN-03 Admin Account Ownership (also requires a Production environment type, which 1.2.0 never assigns).
DLP-01 Child Flow DLP Bypass.
LOG-03 Run History Retention.
PER-10 Auto-Shutdown Risk.
PERM-01 Flow Over-Sharing.

Definition-based rules such as SEC-01, EXF-03, and RES-03 work from the flow JSON alone and are unaffected.

Every environment scores as Default

The audit pipeline marks every environment’s type as Default, so the environment multipliers do not change scores in 1.2.0: every flow is scored at the Default multiplier of 1.5, never Production 1.0 or Sandbox 0.8. Scores are comparable across your environments, but they sit higher than a Production multiplier would produce.

Preview and placeholder features

Managed Identity and Connection String sign-in: the connection test reports success for these two methods, but they are not implemented; the success result is a placeholder. Use client credentials or a certificate, as described in Sign-in methods.
Connection profiles are not saved: the Connection Manager wizard’s final step shows a “saved successfully” message but does not write the profile anywhere, and no other UI path does. Connection Manager can read, test, and remove profiles in connections.json, but 1.2.0 cannot create them from the app. Flow Auditor signs in through the Authentication section of appsettings.json instead; see Entra app registration.
Tool Library: the catalog is a preview loaded from mock package data, not a live feed.
Dataverse tools: most Dataverse tools show sample data in 1.2.0. Flow Auditor and Flow Documentation work with live data when connected.
Command palette: opening tools from the palette works; some global actions are stubs and do nothing.

What to do with results

Export findings as usual, but review the four over-firing rules by hand and expect the five silent rules to produce nothing. Each release’s news post on this site notes what changed.

Last updated: July 27, 2026