API permissions

PowerToolBox signs in as the app registration itself, not as a user. It requests tokens with the .default scope, which means every permission it uses must be an application permission, and an administrator must grant consent before the first token request succeeds.

The permissions

The connection wizard lists four permissions across two Microsoft APIs:

APIPermissionWhat PowerToolBox uses it for
Microsoft GraphUser.ReadDirectory and user lookups, such as resolving flow owners
Microsoft GraphDirectory.Read.AllReading directory data for findings context
Power Platform APIEnvironment.ReadEnumerating environments through api.bap.microsoft.com
Power Platform APIFlow.Read.AllReading flow definitions through api.flow.microsoft.com

One caveat: these are the permissions the app’s connection wizard lists. What actually gets consented is up to whoever grants consent in your tenant. If a permission from this list is missing, expect the matching part of the audit to fail or return empty — for example, no environment list without Environment.Read.

Application permissions do not work until an Entra ID administrator grants consent on the app registration. The consent step happens once, in the portal, not in PowerToolBox.

Two things sit on top of API permissions and are easy to confuse with them:

  • Power Platform Admin role. The service principal needs this role to enumerate environments and flows. It is assigned outside the API permissions screen. Missing role means 403 Forbidden even with perfect consent.
  • Dataverse security role. Only relevant if you configure a Dataverse URL. A read-only role is enough for auditing; System Administrator is the default.

Reading the errors

  • 401 Unauthorized — consent was not granted, the credential expired, or the tenant ID and client ID do not point at a real registration.
  • 403 Forbidden — consent is fine but the service principal lacks the Power Platform Admin role (or a Dataverse security role for Dataverse calls).
  • Empty environment list — the service principal has no Power Platform Admin role, or api.bap.microsoft.com is unreachable from your network.

Token requests and API calls go only to Microsoft endpoints. The app keeps the acquired tokens in a DPAPI-encrypted cache under %LocalAppData%\PowerToolBox\, tied to your Windows user profile.

Next steps

Last updated: July 27, 2026