How it works
The pipeline
- Connect Authenticate with Microsoft Entra ID using a certificate or client secret. Credentials never leave your machine.
- Discover Enumerate environments and flows through the Power Platform Admin APIs and Dataverse.
- Audit Twenty rules inspect each flow definition: actions, connectors, and inputs.
- Report Export JSON, CSV, Markdown, HTML, or Excel with a weighted 0–100 risk score per flow.
What the scores mean
Each finding carries base points by severity: Critical 25, High 10, Medium 4, Low 1. A flow's raw total is multiplied by its worst finding's category weight — Exfiltration ×2, Security ×1.5, AI ×1.3, everything else ×1 — then by the environment weight: Default ×1.5, Production ×1, Sandbox ×0.8. The result caps at 100. In the current release every flow is scored with the Default weight.
Example: a flow with a hardcoded secret (Critical, 25) and outbound HTTP posts (High, 10) totals 35. The worst category is Exfiltration (×2.0), and at the Default weight (×1.5) that comes to 105, capped at 100. In the scoring model, the same findings in a Production environment would multiply by 1.0 instead: 70.
| Score | Meaning | Action |
|---|---|---|
| 80–100 | Immediate action | fix within 24 hours |
| 50–79 | Review | review within 7 days |
| 20–49 | Monitor | monthly review |
| 0–19 | Acceptable | no action needed |
Where your data goes
The app runs on your desktop. Audit data is not uploaded anywhere — there is no PowerToolBox cloud. The only network calls the app makes are to Microsoft: Entra ID for token acquisition, the Power Platform Admin and Flow APIs for discovery, Dataverse for metadata, and Microsoft's own hosts for connector icons.
Reports are files you write to disk yourself. Logs stay local under
%APPDATA%\PowerToolBox\logs, with secrets redacted before anything is written.
One app, audit and documentation
The WPF app is the whole product. It audits a live tenant through the
pipeline above. Its Flow Documentation tool turns exported flow
.json files and solution .zip packages into interactive
HTML documentation — no account, no registration, fully offline.