System requirements
To run the app
- Windows 10 or Windows 11, 64-bit.
- Nothing else. The download ships a self-contained
PowerToolBox.exewith the .NET 8 runtime bundled. There is no runtime to install and no installer to run.
For connected mode
To audit a live tenant you need:
- An Entra ID app registration in the tenant you want to audit.
- A certificate (recommended) or a client secret for that app. See Certificate vs client secret.
- Admin consent for the app’s API permissions, granted by an Entra ID administrator.
- The Power Platform Admin role for the app’s service principal. Without it, API calls return
403 Forbidden. - Network access to Microsoft endpoints: Entra ID sign-in,
api.bap.microsoft.com,api.flow.microsoft.com, and your Dataverse URL if you use one.
For offline documentation
No account and no sign-in. The Flow Documentation tool only needs exported Power Automate .json files or a solution .zip on disk; see Document your flows.
Where PowerToolBox writes data
| Data | Location |
|---|---|
| Logs | %APPDATA%\PowerToolBox\logs |
| Settings | %APPDATA%\PowerToolBox\settings.json |
| Saved connections | %APPDATA%\PowerToolBox\connections.json |
| Token cache | %LocalAppData%\PowerToolBox\ |
| Flow cache | %TEMP%\PowerToolBox\FlowCache |
| Reports | Wherever you choose in the export Save-As dialog |
A few things worth knowing about these locations:
- Logs are redacted before they are written. Passwords, tokens, and client secrets do not end up in log files.
- Audit and security events are also written to an append-only hash chain, verified at startup, so tampering with the audit trail is detectable.
- The token cache is encrypted with Windows DPAPI and tied to your Windows user profile. It does not travel to another machine or another user.
Next steps
Last updated: July 27, 2026