Running an audit

PowerToolBox audits Power Automate flows in connected mode: you sign in, pick an environment, and the app downloads every flow definition and runs the rule set against it. Every flow gets a 0–100 risk score, and findings export in five report formats.

Connected mode

In 1.2.0 the audit takes its sign-in from configuration: an Entra ID tenant ID, a client ID from an app registration, and either a certificate thumbprint (recommended) or a client secret.

1. Open appsettings.json next to PowerToolBox.exe and fill in the Authentication section (tenant ID, client ID, thumbprint or secret), then start the app. See Entra app registration for the full setup.
2. Open Flow Auditor from the sidebar, under the Audit category.
3. Pick an environment from the dropdown, or scan every environment the app registration can see.
4. Click Run Audit Scan. A progress bar shows each flow as it is audited.
5. Review the severity summary cards and the findings grid. Filter by severity, category, or search text.
6. Click Export and pick a format: JSON, CSV, Markdown, HTML, or Excel. Choose where to save the file in the dialog.

The Connection Manager wizard can test the same values with a real sign-in check, but in 1.2.0 it does not save connection profiles — configuration is what the audit uses. See Known limitations in 1.2.0.

What the audit reads in 1.2.0

The audit evaluates each flow’s definition — its actions, connectors, and inputs — against the 20 rules. In 1.2.0 the scan does not collect flow owners, DLP policies, or run history. Rules that need those inputs either flag broadly (OWN-01, DLP-04, AI-03, HYG-02) or cannot fire (OWN-03, DLP-01, PERM-01, PER-10, LOG-03), and every environment is scored with the Default multiplier. Treat those findings as review prompts, not confirmed violations. Details: Known limitations in 1.2.0.

AI resolutions

Select a finding and click AI Resolution for remediation guidance, or Generate All to do every finding at once. By default this runs in demo mode: locally generated template advice, with nothing leaving the machine. You can point it at your own OpenAI or Azure OpenAI endpoint; see Configure AI resolutions.

Working with exported flow files

Flow Auditor audits live environments only. To process exported flow .json files or a solution .zip without a sign-in, use the Flow Documentation tool, which turns local files into interactive HTML documentation; see Document your flows.

Scoping what runs

• Pick a single environment in the dropdown instead of scanning everything.
• Disable whole rule categories or override severities per rule ID through the Rules section of appsettings.json next to the executable; see Audit rules overview. (The Filtering section in that file is not wired in 1.2.0.)

After the scan

Each flow gets a 0–100 risk score and an action level; see Scoring explained. Exports go wherever you choose in the Save-As dialog; see Report formats for what each format contains and Export and share findings for the mechanics.

Last updated: July 27, 2026