Configuration reference

Where configuration lives

File	Purpose
`appsettings.json` next to `PowerToolBox.exe`	Application configuration: endpoints, retries, rules, scoring, logging. Ships with defaults; the file is optional and reloads on change.
Environment variables, prefix `PowerToolBox_`	Same configuration as `appsettings.json`, supplied through the environment. Use `__` for nesting, for example `PowerToolBox_Rules__CategoryToggles__Security=false`. Overrides `appsettings.json`.
`%APPDATA%\PowerToolBox\settings.json`	UI and AI preferences (theme, notifications, AI provider). A separate schema — see UI preferences below.
`%APPDATA%\PowerToolBox\connections.json`	Connection profiles that Connection Manager reads at startup. In 1.2.0 no UI path writes new profiles; secrets are stored through Windows DPAPI or Windows Credential Manager, not in plain text.
`%LocalAppData%\PowerToolBox\msal_{clientId}.cache`	Sign-in token cache. Safe to delete; the next sign-in is slower.

Restart the app after editing configuration. Options are bound at startup, so a restart is the reliable way to apply changes.

Never commit appsettings.json, settings.json, client secrets, or certificate private keys to source control.

The shipped appsettings.json

This is the file as it ships in the download. Sections the 1.2.0 app actually binds and uses: Authentication, PowerPlatform, Scan, Rules, Scoring, Logging, Security. Sections that ship but are not wired in 1.2.0: Filtering, Output, Licensing — documented below.

{
  "Logging": {
    "LogLevel": { "Default": "Information", "Microsoft": "Warning" },
    "RetainedDays": 90,
    "AuditRetainedDays": 365,
    "StructuredLogs": true,
    "WindowsEventLog": true,
    "MinimumLevel": "Debug"
  },
  "Security": {
    "AlertSeverity": "High",
    "MaxAuthFailuresBeforeAlert": 3,
    "EnableAuditChain": true
  },
  "Authentication": {
    "TenantId": "",
    "ClientId": "",
    "CertificateThumbprint": ""
  },
  "PowerPlatform": {
    "ApiBaseUrl": "https://api.flow.microsoft.com",
    "BapBaseUrl": "https://api.bap.microsoft.com",
    "DataverseBaseUrl": "",
    "MaxParallelism": 8,
    "RetryPolicy": { "MaxRetries": 3, "DelaySeconds": 2 }
  },
  "Scan": {
    "BatchSize": 100,
    "IncludeDefaultEnvironment": true,
    "CacheDefinitions": true,
    "CachePath": "./cache",
    "MaxRetryCount": 3,
    "RetryBaseDelaySeconds": 2
  },
  "Filtering": {
    "EnvironmentAllowlist": [],
    "EnvironmentBlocklist": [],
    "FlowNameExcludePatterns": []
  },
  "Rules": {
    "CategoryToggles": {
      "Security": true,
      "Governance": true,
      "Operational": true,
      "Compliance": true,
      "AI": true,
      "Exfiltration": true
    },
    "SeverityOverrides": {}
  },
  "Scoring": {
    "CriticalBase": 25,
    "HighBase": 10,
    "MediumBase": 4,
    "LowBase": 1,
    "CategoryMultipliers": {
      "Exfiltration": 2.0,
      "Security": 1.5,
      "AI": 1.3,
      "Governance": 1.0,
      "Operational": 1.0,
      "Compliance": 1.0
    },
    "EnvironmentMultiplier": { "Default": 1.5, "Production": 1.0, "Sandbox": 0.8 }
  },
  "Output": {
    "ReportFormats": ["Json", "Markdown"],
    "OutputDirectory": "./reports",
    "AlertOnSeverity": "Critical"
  },
  "Licensing": {
    "TerraKodeBaseUrl": "https://api.terrakode.io",
    "ProductId": "powertoolbox-v1",
    "TrialDays": 14,
    "OfflineGracePeriodHours": 72,
    "EnforcementEnabled": false
  }
}

(The shipped file also carries a few licensing tuning keys omitted above for brevity; they are inert while enforcement is disabled.)

Authentication

The sign-in Flow Auditor uses in 1.2.0. Put your app registration values here (or in PowerToolBox_ environment variables) and restart the app.

Key	Type	Default	Description
`TenantId`	GUID string	`""`	Entra ID directory (tenant) ID. Validated at startup when the section is used.
`ClientId`	GUID string	`""`	Application (client) ID of the app registration.
`CertificateThumbprint`	string	`""`	Thumbprint of the certificate in `CurrentUser\My`. Preferred over a secret.
`ClientSecret`	string	`""`	Client secret value, as plain text in the file. Use a certificate where you can; the app logs a warning at startup when a plaintext secret is configured.

The thumbprint must match the certificate store entry exactly, with no spaces, and the certificate must be installed in CurrentUser\My and still be valid. See connecting with an Entra app registration.

PowerPlatform

Key	Type	Default	Description
`ApiBaseUrl`	URL	`https://api.flow.microsoft.com`	Power Automate Management API base URL.
`BapBaseUrl`	URL	`https://api.bap.microsoft.com`	Business Applications Platform (BAP) API base URL, used for environment discovery.
`DataverseBaseUrl`	URL	`""`	Dataverse environment URL, for example `https://org.crm.dynamics.com`.
`MaxParallelism`	int	`8`	Reserved — parsed but not used by the 1.2.0 scan.
`RetryPolicy.MaxRetries`	int	`3`	Retries for environment discovery HTTP calls.
`RetryPolicy.DelaySeconds`	int	`2`	Base delay for discovery retry backoff.

Scan

Key	Type	Default	Description
`BatchSize`	int	`100`	Reserved — parsed but not used by the 1.2.0 scan.
`IncludeDefaultEnvironment`	bool	`true`	Include the default Power Platform environment in scans.
`CacheDefinitions`	bool	`true`	Cache downloaded flow definitions locally.
`CachePath`	string	`./cache`	Local path for the flow definition cache.
`MaxRetryCount`	int	`3`	Retries for flow export HTTP calls.
`RetryBaseDelaySeconds`	double	`2`	Base delay for flow export retry backoff.

Rules

Consumed by the rule engine. See Audit rules overview.

Key	Type	Default	Description
`CategoryToggles`	object	all `true`	Enable or disable entire rule categories: `Security`, `Exfiltration`, `Governance`, `Operational`, `Compliance`, `AI`.
`SeverityOverrides`	object	`{}`	Per-rule severity overrides. Keys are rule IDs such as `EXF-03`; values are `Critical`, `High`, `Medium`, `Low`, or `Informational`.

{
  "Rules": {
    "CategoryToggles": { "Compliance": false },
    "SeverityOverrides": { "EXF-03": "Critical", "SEC-01": "High" }
  }
}

Scoring

Consumed by the scoring engine; see Scoring explained.

Key	Type	Default	Description
`CriticalBase`	int	`25`	Base points for a Critical finding.
`HighBase`	int	`10`	Base points for a High finding.
`MediumBase`	int	`4`	Base points for a Medium finding.
`LowBase`	int	`1`	Base points for a Low finding.
`CategoryMultipliers`	object	see shipped file	Multiplier from the highest-severity category in a flow’s findings.
`EnvironmentMultiplier`	object	see shipped file	Multiplier by environment type. In 1.2.0 every flow is scored as `Default` (1.5) because environment type is not yet discovered — see Known limitations in 1.2.0.

Logging and Security

Logging: RetainedDays (90), AuditRetainedDays (365), StructuredLogs (true), WindowsEventLog (true), MinimumLevel (Debug). Logs land in %APPDATA%\PowerToolBox\logs as rolling files — redacted text, structured JSON, and the audit-trail sink. See Find logs and diagnostic data.

Security: AlertSeverity (High — minimum severity that raises a desktop alert), MaxAuthFailuresBeforeAlert (3), EnableAuditChain (true — the startup integrity check over the audit log).

Sections not wired in 1.2.0

These sections ship in appsettings.json but the 1.2.0 app never binds them. Editing them changes nothing.

Filtering (EnvironmentAllowlist, EnvironmentBlocklist, FlowNameExcludePatterns) — scope scans from the Flow Auditor environment dropdown instead.
Output (ReportFormats, OutputDirectory, AlertOnSeverity) — exports go through the Save-As dialog; see Report formats.
Licensing — the licensing client ships but is dormant (EnforcementEnabled: false); see the licensing overview.

UI preferences

%APPDATA%\PowerToolBox\settings.json holds UI and AI preferences. There is no settings UI in 1.2.0 — edit the file by hand and restart the app. The schema:

Property	Type	Default	Description
`Theme`	string	`Light`	UI theme: `Light` or `Dark`.
`ShowDashboardOnStartup`	bool	`true`	Open on the Welcome tab.
`AuditFlows` / `AuditDataverse` / `AuditConnectors` / `AuditSolutions`	bool	`true`	Area toggles for future audit coverage.
`AutoRefreshInterval`	string	`Manual`	Data refresh cadence.
`StartMinimized`	bool	`false`	Launch minimized.
`IncludeFlowRunHistory`	bool	`true`	Reserved — run history is not collected in 1.2.0.
`MaxFlowRuns`	int	`500`	Reserved — run history is not collected in 1.2.0.
`NotifyFlowFailures` / `NotifyConnectorUnauthorized`	bool	`true`	Desktop notification toggles.
`NotifySchemaChanges`	bool	`false`	Desktop notification toggle.
`NotificationMode`	string	`Desktop Toast`	How notifications are shown.
`LogVerbosity`	string	`Detailed`	UI log verbosity preference.
`LogRetentionDays`	string	`30`	UI retention preference (the file-count limits in `Logging` apply).
`CheckForUpdates`	bool	`true`	Reserved — there is no update check in 1.2.0.
`AutoClearCache`	bool	`true`	Clear cached data automatically.
`CacheSizeLimitMb`	int	`500`	Cache size limit.
`AiEnabled`	bool	`false`	Enable a real AI provider.
`AiProvider`	string	`None`	`None` (demo mode), `OpenAI`, or `Azure OpenAI`.
`AiEndpoint`	string	`""`	Endpoint for the configured provider.
`AiModel`	string	`""`	Model name; defaults to `gpt-4o` for OpenAI.
`AiApiKey`	string	`""`	Provider key, stored DPAPI-protected in the file.
`AiUseForResolution` / `AiUseForExecutiveSummary` / `AiUseForBestPractices`	bool	`true`	Present in the file but not read in 1.2.0.
`AiTimeoutSeconds`	int	`30`	Present but not read in 1.2.0; providers use a fixed 60-second timeout.
`AiMaxTokens`	int	`500`	Present but not read in 1.2.0.
`ResolutionPrompt`	string	built-in	The system prompt used for AI resolutions; editable.
`ExecutiveSummaryPrompt` / `BestPracticesPrompt`	string	built-in	Present but not used in 1.2.0.

With AiProvider at its default None, the AI assistant and AI resolutions run in demo mode: local template answers, no network calls. Configuring a real provider is covered in Configure AI resolutions. Some preferences in this file map to features still being built; leaving them at defaults is safe.