PowerToolBox
Download

Sign-in errors 401 and 403

What you see

Testing a connection or starting a scan fails with 401 Unauthorized or 403 Forbidden, or the app reports that your certificate was not found.

401 Unauthorized

A 401 means the app could not get a token at all. Work through these in order:

  1. Grant admin consent for every application permission on the app registration. Consent that covers only some permissions still fails; see API permissions.
  2. Check the client secret or certificate has not expired. Create a new one if it has; see Certificate vs client secret.
  3. Confirm the tenant ID and client ID in the connection are valid GUIDs from the same app registration. A typo in either one also produces a 401. The registration steps are in Entra app registration.

403 Forbidden

A 403 means sign-in worked but the identity lacks permission:

  • The service principal needs the Power Platform Admin role to list environments and flows.
  • For Dataverse tools, it also needs a security role in the target environment; a custom read-only role is enough.

Certificate not found

  • The thumbprint must match exactly, with no spaces. Paste it straight from the certificate properties.
  • The certificate must be installed in CurrentUser\My for the Windows account running the app, and it must still be valid.
  • MSAL may not support certificates with CNG keys. Use a certificate with an RSA key instead.

Stale token cache

Tokens are cached on disk, encrypted with Windows DPAPI, at:

%LocalAppData%\PowerToolBox\msal_{clientId}.cache

If you changed the app registration (new secret, new permissions, different client ID) and sign-in still fails, delete the msal_*.cache file for that client ID and sign in again. The cache is per client ID, so other connections are unaffected. The app deletes a cache file itself when it can no longer decrypt it, but a stale entry can survive a registration change.

If it still fails

Check the newest log in %APPDATA%\PowerToolBox\logs for the MSAL error behind the dialog; see Find logs and diagnostic data. Then open a ticket on the support page with the error text and the correlation ID from the dialog. More fixes are listed in the troubleshooting reference.

Last updated: July 27, 2026