PowerToolBox
Download

Troubleshooting

Before you start

Most errors leave a detailed trace in the log files. Check the newest file in %APPDATA%\PowerToolBox\logs first, then verify your settings against the configuration reference. The knowledge base has focused articles for the most common problems: SmartScreen, sign-in errors, throttling and empty environment lists, logs and diagnostic data, and known limitations in 1.2.0.

Startup

The app does not start, or closes on the splash screen

  • PowerToolBox requires Windows 10 or 11.
  • The download is self-contained — the .NET 8 runtime is bundled, so there is nothing to install. If the app folder may be corrupted, delete it and extract the download zip again.
  • If SmartScreen blocks the launch, see SmartScreen blocks the app.

Sign-in and authentication

401 Unauthorized

  1. Grant admin consent for all application permissions on the Entra app registration.
  2. Check that the client secret or certificate has not expired.
  3. Confirm TenantId and ClientId are valid GUIDs.

More causes and fixes: Sign-in errors 401 and 403.

403 Forbidden

  • The service principal needs the Power Platform Admin role.
  • For Dataverse access, it needs at least a custom read-only security role.

Certificate not found

  • The thumbprint must match exactly, with no spaces, and the certificate must be installed in CurrentUser\My and still be valid.
  • MSAL may not support CNG keys. Use a certificate with an RSA key instead.

Token cache errors

  • Delete %LocalAppData%\PowerToolBox\msal_{clientId}.cache and sign in again.
  • Make sure your Windows user account has write access to %LocalAppData%\PowerToolBox\.

Managed Identity or Connection String reports success but does nothing

These two wizard methods are not implemented in 1.2.0 — the test reports success regardless. Use one of the other methods; see Choose a sign-in method and Known limitations in 1.2.0.

Scanning and discovery

429 Too Many Requests

  • Discovery retries automatically with backoff, but the current retry policy does not read Retry-After headers or add jitter.
  • Increase RetryBaseDelaySeconds and reduce MaxRetryCount in the Scan section of appsettings.json next to the executable.
  • Avoid scanning all environments during peak hours.

More detail: 429 throttling and empty environment lists.

The environment list is empty

  • Confirm the account or service principal has the Power Platform Admin role.
  • Check that https://api.bap.microsoft.com is reachable from the machine.

Flow definitions fail to download

  • Confirm a token is being acquired for https://api.flow.microsoft.com.
  • Check that the configured Scan:CachePath exists and is writable.
  • Review the log for export errors.

Reports and findings

The export does not produce a file

  • Exports go through a Save-As dialog in the Flow Auditor; check that the folder you picked is writable and review the log for errors.
  • The Output section in appsettings.json (ReportFormats, OutputDirectory) is not wired in 1.2.0, so it has no effect on exports.

Risk scores look too low on exfiltration-heavy flows

Exfiltration findings carry the Exfiltration category, which uses a 2.0× multiplier. Make sure Scoring:CategoryMultipliers in appsettings.json includes "Exfiltration": 2.0. It is present in the defaults, so this usually means a custom settings file dropped it.

Note that in 1.2.0 every flow is scored with the Default-environment multiplier (1.5), because environment type is not yet discovered. See Known limitations in 1.2.0.

OWN-01, DLP-04, or AI-03 flags everything

In 1.2.0 the scan does not collect flow owners or DLP policies, so these rules fire broadly: OWN-01 flags every flow, DLP-04 flags every connector, AI-03 flags every AI connector, and HYG-02 flags every flow. Treat those findings as review prompts. Details: Known limitations in 1.2.0.

Interface

Flow Auditor fails with sign-in errors

In 1.2.0 the audit takes its sign-in from the Authentication section of appsettings.json (or PowerToolBox_ environment variables) — not from Connection Manager. Check the tenant ID, client ID, and credential there, then restart the app. The Connection Manager wizard can test the same values but does not save profiles yet.

A tool shows no data

Many tools display sample data until you connect — and several Dataverse tools show sample data regardless in 1.2.0. Flow Auditor and Connection Manager work against live tenants; the Flow Documentation tool works on local files. See Use the toolbox shell.

Ctrl+T focuses the wrong box

A known limitation: the shortcut focuses the first text box in the window, which is not always the sidebar search. Click the sidebar search box manually.

A command palette action does nothing

Some global actions in the command palette are placeholder stubs and are not wired yet.

The AI assistant gives generic answers

By default the AI assistant and AI resolutions run in demo mode: locally generated template answers, with no connection to a live AI service. To use your own OpenAI or Azure OpenAI endpoint, see Configure AI resolutions.

The theme does not persist

Check that your Windows user account has write access to %APPDATA%\PowerToolBox\settings.json.

Logs

Operational logs live in %APPDATA%\PowerToolBox\logs as rolling powertoolbox-.txt files, alongside structured JSON and audit-trail logs. Secrets are redacted before any line is written. If no logs appear, make sure the app has write access to that directory. See Find logs and diagnostic data.

Still stuck

Open a ticket on the support page. Attach the newest log file, and include the correlation ID if the error message showed one — user-facing errors display a generic message with a correlation ID, and the full exception is in the log.

Last updated: July 27, 2026