What Power Insights is
An assessment tool for a Microsoft 365 tenant's Power Platform estate. It reads what exists, keeps a copy of the inventory, and answers questions about it.
Most tenants have accumulated more apps and flows than anyone can name, spread across environments nobody audits, bound to data sources nobody has listed. Power Insights walks the whole tenant, normalises what four different Microsoft APIs return, and presents it as one estate you can search, filter and export.
- Environments — type, region, Dataverse database, Managed Environment status.
- Apps — canvas and model-driven, with owners, connectors, connections and data sources.
- Flows — cloud flows with triggers, connectors, connection references and their steps.
- Solutions — publishers, versions, managed state and what is inside each one.
- Dataverse — tables, columns and row counts, per environment.
- Connections and connectors — what authenticates as whom, and what it points at.
- Power BI — workspaces, reports, datasets and dataflows, when the module is switched on.
Every Microsoft call Power Insights makes is a read. It creates nothing, changes nothing and deletes nothing in Power Platform, and it does not copy the contents of your Dataverse tables or the data your flows move. It records the inventory — names, owners, versions, dependencies — not the data itself.
How it works
Power Insights separates reading Microsoft from reading the screen. Understanding that split explains almost everything about how the app behaves.
- 1You run a syncFrom the Dashboard. Power Insights walks every environment across the BAP, PowerApps admin, Flow admin and Dataverse APIs. On a real tenant this takes minutes, not seconds.
- 2The result is storedOne assessment per connected tenant, held in the application's own database. A re-sync replaces it in place.
- 3Every page reads the stored copyWhich is why pages open instantly and why the figures do not change until you sync again. The timestamp at the top right of each page tells you which sync you are looking at.
A few things are deliberately read live rather than stored, because capturing them for every object would turn a sync that takes minutes into one that takes hours. Sharing (who an app is shared with) is the main one — it costs one call per app, so it is fetched when you open an app rather than during the sync.
The scan runs in the background and the page polls it, because the hosting platform cuts any single web request at 230 seconds and a real tenant takes longer than that. The live log on the Dashboard shows which environment is being read. Leaving the page does not stop the scan.
Getting started
- 1Sign in with MicrosoftUse an account with one of the administrator roles below. The first sign-in asks for consent to read your Power Platform estate.
- 2Run the first syncOpen the Dashboard and press Refresh. Watch the log — it names each environment as it is read, and flags anything it could not reach.
- 3Read the estateThe Objects menu holds the tenant-wide lists. Every table searches, sorts and filters in the browser, so nothing costs another round trip.
- 4Invite colleaguesFrom Settings. Colleagues join your organisation as read-only members: they can read the last assessment without being able to run one.
Permissions and roles
This is the single most common cause of an inventory that looks wrong, so it is worth checking first.
Microsoft's admin APIs return tenant-wide results only for Power Platform Administrator, Dynamics 365 Administrator or Global Administrator. Any other account gets back only the environments it personally belongs to — and nothing announces this. If your environment count looks low, check the role before anything else.
| API | Permission | What it unlocks |
|---|---|---|
| PowerApps Service | User | Environments, canvas apps, connections, connectors |
| Power Automate | Flows.Read.All | Cloud flows, triggers, connection references |
| Dataverse | user_impersonation | Solutions, tables, columns, model-driven apps |
| Microsoft Graph | User.Read, User.ReadBasic.All | Turning owner object ids into people's names |
Reading tables, solutions and connection references needs a security role inside each environment's database — normally System Administrator on that environment. Entra permissions alone are not enough. Environments where this is missing still appear; their Dataverse sections show an explicit 'could not read' state rather than a misleading empty list.
Migrations
A migration project is a saved selection of apps and flows, plus everything Power Insights can work out about moving them.
- Select by picking from a list, or by pasting names from a spreadsheet or an email — a name that matches nothing is reported back rather than quietly dropped.
- Dependencies shows every connector, connection, table and solution the selection touches.
- Risks flags what will break: an app calling a flow that is not coming, a connection nobody owns, an object in no solution.
- Solutionise groups apps and flows that depend on each other, and checks existing solutions first so it never re-proposes one you already have.
- Export all produces one workbook or PDF per app and per flow, zipped, in apps/ and flows/ folders.
- Share this plan creates a read-only link for somebody without an account.
A canvas app records which SharePoint site or SQL server each data source actually points at inside its own package, which the admin API does not expose. Pressing Extract data sources opens each app and reads those addresses out. It is slower than the rest of the page, which is why it is a button rather than something the sync always does.
Exports
| Where | What you get |
|---|---|
| An app or flow detail page | That object as a PDF, an Excel workbook, or the raw Microsoft API response. |
| Any list, with rows selected | One file per selected object, zipped, foldered by environment. |
| The Export menu | The whole assessment as JSON, per-object CSVs, an environments workbook, or a PDF report. |
| A migration project | An Excel report, a PowerPoint deck, or one file per object in the plan. |
An app workbook has six sheets: summary, connectors, sharing, data sources, the flows it calls, and its connections. A flow workbook mirrors it, with its steps in place of the flows sheet.
Where the numbers come from, and what they cannot say
Some questions cannot be answered from what Microsoft discloses. Power Insights says so rather than guessing, and these are the cases you will meet.
| What you might expect | What is actually true |
|---|---|
| A connection shows where it points | A SharePoint or Office 365 connection carries an identity, not an address. Which site or list is decided per action in a flow, or per data source in an app — so the target appears there, not on the connection. |
| The connector list is every connector Microsoft publishes | The platform only lists connectors registered in an environment, which in practice means your custom ones. Built-in connectors are discovered from the apps, flows and connections that use them, so a connector nothing uses will not appear. |
| Every flow shows its full set of steps | Solution-aware flows sometimes return only a summary of their steps. Where a definition is withheld, Power Insights looks for it in Dataverse; if that fails too, the flow says its definition could not be read rather than showing an empty list. |
| Sharing is part of the assessment | It is read live when you open an object, because capturing it during a sync would mean one extra call per app across the whole tenant. |
| An app knows which flows it calls | It records the flow's name as a code identifier with spaces stripped, not its display name, and no id. Power Insights reconciles the two, but a flow renamed after the app was built may not resolve. |
| Every environment can be read equally | Environments without a Dataverse database have no solutions, tables or connection references to read. Those sections say so explicitly. |
A sync touches four services across every environment, and something is usually unreachable. Each part of the assessment carries its own outcome, so one failed service becomes a warning banner rather than a blank page. The warnings are worth reading — they say exactly what is missing.
Frequently asked questions
Does Power Insights change anything in my tenant?
No. Every call it makes is a read. It creates, modifies and deletes nothing in Power Platform.
Does it copy my data?
No. It records the inventory — names, owners, versions, dependencies, and where things point. It does not read the contents of your Dataverse tables or the data your flows move. The one exception is deliberate and on demand: the table preview on a Dataverse table page shows a sample of rows while you are looking at it.
Why has my figure not changed since I fixed something?
Pages read the last stored sync, not Microsoft. Run a sync from the Dashboard and the figures update. The timestamp at the top right of every page tells you how old the current one is.
Can I see how the estate changed over time?
No. Power Insights keeps exactly one assessment per tenant and replaces it on each sync. There is no history and no run-to-run comparison.
Why does my tenant look smaller than it is?
Almost always the signed-in account's role. Without Power Platform Administrator, Dynamics 365 Administrator or Global Administrator, Microsoft returns only the environments that account personally belongs to — with no error to tell you so.
Why do so many apps show no solution?
The apps and flows APIs do not report which solution an object belongs to; that only exists in Dataverse. Power Insights resolves it during the sync, so an assessment taken before that was added will show none until you re-sync.
Why does a sync take so long?
It walks every environment across four Microsoft APIs, and those APIs throttle hard per user. Calls are deliberately paced with backoff rather than run flat out, because being throttled mid-scan costs more time than going steadily.
Can I leave the page while a sync runs?
Yes. The scan runs on the server, not in your browser. Come back to the Dashboard to see where it got to.
Two apps have the same name. Are they the same app?
Usually not. Copying an app between environments produces a separate object with its own id. Compare the app id, shown on the detail page and in a migration project's expanded row — the name alone does not settle it.
Can colleagues use this without admin rights?
Yes. Invite them from Settings and they join as read-only members: they can read the last assessment without being able to run one. Only an account with the admin roles can sync.
Can I assess more than one tenant?
On the Enterprise plan, yes — connect each tenant and switch between them. Each keeps its own separate assessment.
What happens to my data if I stop using Power Insights?
Deleting a migration project removes only the saved selection; nothing in your tenant and nothing in the assessment is touched. To remove the assessment itself, clear it from Settings.
Troubleshooting
| Symptom | Where to look |
|---|---|
| Far fewer environments than expected | The signed-in account's role. See Permissions above — this is the usual cause. |
| An environment's tables or solutions say they could not be read | A Dataverse security role is missing inside that environment's database. Entra permissions do not cover it. |
| Sign-in fails immediately | Admin consent has not been granted for the application's permissions. |
| A page shows a warning banner with results underneath | One service was unreachable during the sync. The banner names it. The rest of the page is still accurate. |
| The first page load after a quiet period is slow | The database pauses when idle and takes a moment to wake. Only the first request pays for it. |
| An export produced nothing | Exports need a plan that includes them, and model-driven apps have no app-package export — their definition lives in a Dataverse solution instead. |
Still stuck?
Every screen in the product carries the same guidance in context, and anything this manual does not cover is a question worth asking us directly.