What is PowerToolBox

PowerToolBox is a free .NET 8 desktop application for Windows. Its Flow Auditor tool scans Power Automate flows across your Power Platform environments and reports security gaps, governance violations, operational risks, and compliance issues. The current version is 1.2.0.

It is built for Power Platform administrators, security reviewers, and anyone who has to answer the question: what are the flows in this tenant actually doing.

What an audit covers

The audit engine runs 20 rules across six categories: Security, Exfiltration, Governance, Operational, Compliance, and AI. The rules catch things like flows that send data out over HTTP, flows that forward content by email, and anonymous file-sharing links. Findings for data exfiltration are weighted higher than other categories.

Every flow gets a weighted risk score from 0 to 100. Findings come back with a severity and a category, so you can filter the grid and triage what matters first.

A connected audit

Sign in with an Entra ID app registration, using a certificate or a client secret. PowerToolBox discovers your environments and flows through Microsoft’s own APIs and audits them in place. See Running an audit.

If you have exported flow .json files or a solution .zip, the Flow Documentation tool turns them into interactive HTML documentation without any sign-in; see Document your flows.

Reports

Findings export to JSON, CSV, Markdown, HTML, or Excel, so you can archive them, hand them to a reviewer, or feed them into another tool.

Local-first by design

By default, PowerToolBox talks only to Microsoft endpoints: Entra ID for sign-in, the Power Platform admin and flow APIs, Dataverse if you configure it, and Microsoft hosts for connector icons. No audit data leaves your machine. Logs are redacted before they are written to disk. If you configure your own AI provider for AI resolutions, finding metadata goes to the endpoint you choose; see Configure AI resolutions.

Also in the box

PowerToolBox is a tabbed multi-tool host. Alongside Flow Auditor it ships 21 tools for Dataverse and Power Platform administration, including Connection Manager, a metadata browser, and solution tools. Flow Auditor and Flow Documentation are the fully live tools; Connection Manager runs real sign-in tests but does not save profiles yet, and several Dataverse tools still show sample data. See Use the toolbox shell.

Next steps

• System requirements — what you need before installing.
• Install and first run — get the app running and connected.
• Quickstart: your first audit — from download to an exported report.

Last updated: July 27, 2026