Entra app registration

PowerToolBox connects to a live tenant with app-only credentials: an Entra ID app registration in the tenant you want to audit. There is no interactive sign-in. You need three values from the registration — the tenant ID, the client ID, and a certificate or client secret.

Create the registration

1. Sign in to the Entra admin center and go to Entra ID → App registrations → New registration. A single-tenant registration is the right fit here.
2. From the registration’s overview page, copy the Directory (tenant) ID and the Application (client) ID.
3. Under API permissions, add the application permissions the connection wizard lists, then grant admin consent. The exact list is on the API permissions page.
4. Under Certificates & secrets, upload a certificate (recommended) or create a client secret. The trade-offs are on Certificate vs client secret.
5. Give the app’s service principal the Power Platform Admin role. Without it, discovery calls fail with 403 Forbidden. If you plan to use Dataverse-aware tools, the service principal also needs a security role in that environment — a read-only role is enough for auditing.

Enter it in PowerToolBox

In 1.2.0, Flow Auditor reads its sign-in from the Authentication section of appsettings.json next to PowerToolBox.exe (or from PowerToolBox_ environment variables). Edit the file and restart the app:

{
  "Authentication": {
    "TenantId": "your-tenant-guid",
    "ClientId": "your-app-registration-guid",
    "CertificateThumbprint": "your-thumbprint-no-spaces"
  }
}

Use "ClientSecret": "your-secret" instead of the thumbprint line if you chose a secret. The full set of options is in the configuration reference.

The Connection Manager wizard accepts the same values and runs a real connectivity test against them, but in 1.2.0 it does not save them as a reusable profile — the configuration above is what the audit uses. See Known limitations in 1.2.0. For more than one tenant, see Multiple tenants.

If sign-in fails

• 401 Unauthorized — admin consent has not been granted for the application permissions, the secret or certificate has expired, or the tenant ID and client ID are not valid GUIDs.
• 403 Forbidden — the service principal is missing the Power Platform Admin role. For Dataverse, it is missing a security role in the environment.
• Certificate not found — the thumbprint must match exactly, with no spaces, and the certificate must be in the CurrentUser\My store. Use an RSA key; MSAL does not support CNG keys for this flow.

More fixes: Sign-in errors 401 and 403. Full error output is in the redacted logs at %APPDATA%\PowerToolBox\logs.

Next steps

• API permissions — the exact permissions and why they are needed.
• Certificate vs client secret — pick the credential type.

Last updated: July 27, 2026