API permissions
PowerToolBox signs in as the app registration itself, not as a user. It requests tokens with the .default scope, which means every permission it uses must be an application permission, and an administrator must grant consent before the first token request succeeds.
The permissions
The connection wizard lists four permissions across two Microsoft APIs:
| API | Permission | What PowerToolBox uses it for |
|---|---|---|
| Microsoft Graph | User.Read | Directory and user lookups, such as resolving flow owners |
| Microsoft Graph | Directory.Read.All | Reading directory data for findings context |
| Power Platform API | Environment.Read | Enumerating environments through api.bap.microsoft.com |
| Power Platform API | Flow.Read.All | Reading flow definitions through api.flow.microsoft.com |
One caveat: these are the permissions the app’s connection wizard lists. What actually gets consented is up to whoever grants consent in your tenant. If a permission from this list is missing, expect the matching part of the audit to fail or return empty — for example, no environment list without Environment.Read.
Granting consent
Application permissions do not work until an Entra ID administrator grants consent on the app registration. The consent step happens once, in the portal, not in PowerToolBox.
Two things sit on top of API permissions and are easy to confuse with them:
- Power Platform Admin role. The service principal needs this role to enumerate environments and flows. It is assigned outside the API permissions screen. Missing role means
403 Forbiddeneven with perfect consent. - Dataverse security role. Only relevant if you configure a Dataverse URL. A read-only role is enough for auditing; System Administrator is the default.
Reading the errors
401 Unauthorized— consent was not granted, the credential expired, or the tenant ID and client ID do not point at a real registration.403 Forbidden— consent is fine but the service principal lacks the Power Platform Admin role (or a Dataverse security role for Dataverse calls).- Empty environment list — the service principal has no Power Platform Admin role, or
api.bap.microsoft.comis unreachable from your network.
Token requests and API calls go only to Microsoft endpoints. The app keeps the acquired tokens in a DPAPI-encrypted cache under %LocalAppData%\PowerToolBox\, tied to your Windows user profile.
Next steps
- Entra app registration — the full setup sequence.
- Certificate vs client secret — the credential half of the connection.
Last updated: July 27, 2026