How it works

The pipeline

  1. Connect Authenticate with Microsoft Entra ID using a certificate or client secret. Credentials never leave your machine.
  2. Discover Enumerate environments and flows through the Power Platform Admin APIs and Dataverse.
  3. Audit Twenty rules inspect each flow definition: actions, connectors, and inputs.
  4. Report Export JSON, CSV, Markdown, HTML, or Excel with a weighted 0–100 risk score per flow.

What the scores mean

Each finding carries base points by severity: Critical 25, High 10, Medium 4, Low 1. A flow's raw total is multiplied by its worst finding's category weight — Exfiltration ×2, Security ×1.5, AI ×1.3, everything else ×1 — then by the environment weight: Default ×1.5, Production ×1, Sandbox ×0.8. The result caps at 100. In the current release every flow is scored with the Default weight.

Example: a flow with a hardcoded secret (Critical, 25) and outbound HTTP posts (High, 10) totals 35. The worst category is Exfiltration (×2.0), and at the Default weight (×1.5) that comes to 105, capped at 100. In the scoring model, the same findings in a Production environment would multiply by 1.0 instead: 70.

ScoreMeaningAction
80–100 Immediate action fix within 24 hours
50–79 Review review within 7 days
20–49 Monitor monthly review
0–19 Acceptable no action needed

Where your data goes

The app runs on your desktop. Audit data is not uploaded anywhere — there is no PowerToolBox cloud. The only network calls the app makes are to Microsoft: Entra ID for token acquisition, the Power Platform Admin and Flow APIs for discovery, Dataverse for metadata, and Microsoft's own hosts for connector icons.

Reports are files you write to disk yourself. Logs stay local under %APPDATA%\PowerToolBox\logs, with secrets redacted before anything is written.

One app, audit and documentation

The WPF app is the whole product. It audits a live tenant through the pipeline above. Its Flow Documentation tool turns exported flow .json files and solution .zip packages into interactive HTML documentation — no account, no registration, fully offline.

Download for Windows