Tenant-wide inventory · live

Power Platform Inventory

A read-only scan of every Power Platform environment in your tenant. Solutions, flows, apps, connectors, and DLP policies — in one report, in five minutes. Find the orphan flows your departed makers left behind, the premium connectors going unlicensed, and the actual Business / Non-Business / Blocked counts under your DLP policy.

One-time payment · 90-day access · locked to one Microsoft 365 tenant

A taste of the output

What you actually get

Every environment, every solution, every flow's connector dependencies. Numbers below are illustrative.

app.migrationfox.com/governance/power-platform-inventory
6
Environments
44
Solutions
11
Flows
43
Apps
1
DLP Policy
DLP policy
Default (tenant-wide)
MATCHES PPAC
Business
57
Non-Business
1,486
Blocked
0
Connector usage matrix 5 of 1,543 connectors shown
SharePoint BUSINESS Used by 8 flows / 14 apps
Office 365 Outlook BUSINESS Used by 6 flows / 4 apps
Microsoft Dataverse BUSINESS Used by 4 flows / 12 apps PREMIUM
Excel Online NON-BUSINESS Used by 3 flows / 2 apps
Twitter NON-BUSINESS Used by 1 flow / 0 apps
Risk highlights
2 orphan flows — original maker offboarded, no co-owner. Will fail silently when the connection auth expires.
4 stale flows — not modified in 60+ days, still consuming API entitlements.
3 premium connectors in active flows where the maker has no per-user premium license.
0 blocked-but-in-use connectors — DLP enforcement is consistent.

Mock data based on a real five-environment tenant. Your numbers will differ.

What it scans

Six focus areas, one report

Environment inventory

Every Power Platform environment in the tenant — default, production, sandbox, trial — with creation dates, owner counts, Dataverse capacity, and whether it has a CDS database. Catches the “47 trial environments nobody owns” problem before it eats your storage.

Solutions across Dataverse environments

Every solution in every Dataverse-linked environment, with publisher, version, install date, and managed-vs-unmanaged status. Surfaces unmanaged solutions blocking orderly ALM, and orphaned solutions whose publisher or owner is gone.

Flows with full connector resolution

Every flow in every environment, with its real connector dependencies resolved — including solution-scoped flows and Dynamics OOB flows that BAP hides by default. Shadow IT, Copilot Studio bots, and AI Builder flows all surface here.

Apps with maker concentration

Every Power App with display name, owner, last-modified date, and connector reference list. Group by maker to find your “5% built 80% of the apps” risk concentration. Flag system apps (Plugin Monitor, Portal Management) so they don’t skew your per-maker counts.

DLP policies with real classifications

Every tenant-level DLP policy with the actual count of connectors in Business, Non-Business, and Blocked groups — matching what you see in the Power Platform Admin Center, by-the-number. Catches connectors that drifted into the wrong group, the most common Power Platform exfiltration vector.

Connector usage matrix + premium flag

Every connector referenced anywhere in the tenant, paired against its DLP classification and premium status. See in one view which premium connectors are in use, by which apps and flows, and whether the makers using them carry per-user premium licenses.

How the inventory works

One service principal, two token audiences

The Power Platform admin surface lives at api.bap.microsoft.com and the API Hub is at api.powerapps.com — both reachable from a single Azure AD service account. The inventory acquires tokens for both audiences, walks /admin/environments, then for each Dataverse-linked environment queries /api/data/v9.2/solutions directly. No extra OAuth app, no CLI, no PowerShell.

For solution-scoped flows that BAP hides behind the management envelope, the scan falls back to Dataverse's workflows entity by workflowidunique, parses the flow's clientdata JSON, and extracts the connector reference list. That's how Dynamics OOB flows, AI Builder flows, and Copilot Studio bots end up in the report — the surfaces most inventory tools quietly skip.

DLP policies come from the legacy /admin/apiPolicies endpoint, which still returns the authoritative per-policy apiGroups classifications. Numbers in the report match what you see in the Power Platform Admin Center side-by-side.

Prerequisite: the service principal needs the Power Platform Administrator role assigned in Microsoft Entra ID, and the System Administrator security role on each Dataverse-linked environment. Setup is one-time; the assessment surface includes a step-by-step guide.

Run the Power Platform Inventory now

CA$399 one-time, 90-day access, locked to one tenant. Free Snapshot first — no credit card required.