Fix: Power Platform scan returns 0 flows + 0 apps
If the Dependency Graph, the Power Platform Inventory, or the Power Platform part of a governance assessment reports "BAP returned N environments but 0 flows + 0 apps across all of them", or can’t list environments at all, the app registration MigrationFox signs in with is missing tenant-wide Power Platform admin API access. This is a one-time fix of a few minutes.
What's happening
These scans call the Power Platform admin APIs with an app’s own credentials (app-only), not as a signed-in person. The Power Platform Inventory requires a governance Service Account connection (tenant ID, client ID and client secret). The Power Platform Administrator directory role alone is not enough for app-only calls: the app must also be registered with the Power Platform admin API (BAP) as a management app. The Power Apps portal shows your apps fine because it signs in as you, not as an app.
The fix: one PowerShell command
Run this as a Global Administrator from any machine with PowerShell 5.1+ or 7.x. You only do this once per tenant, not per environment.
1. Install the module (first time only)
Install-Module -Name Microsoft.PowerApps.Administration.PowerShell -Scope CurrentUser -Force
If your tenant has an execution-policy restriction, you may need -AllowClobber or to run as Administrator. This module is published by Microsoft.
2. Sign in as a Global Administrator
Add-PowerAppsAccount
A browser window opens. Sign in with an account that has the Global Administrator directory role. If the next step fails while signed in as a Power Platform Administrator, sign in again as a Global Administrator.
3. Register your app registration as a management app
New-PowerAppManagementApp -ApplicationId <YOUR_CLIENT_ID>
Replace <YOUR_CLIENT_ID> with the Application (client) ID you entered when you added the governance Service Account connection. The setup checklist on the Power Platform Inventory results page and the Power Platform finding in an assessment report also print this client ID.
Heads up
Also make sure the same app has the Power Platform Administrator directory role (Microsoft Entra admin center → Roles and administrators). If the command errors, the most common cause is that the signed-in account isn’t a Global Administrator.
4. Wait a few minutes, then re-run the scan
The registration can take a few minutes to take effect. Re-run the Dependency Graph, Power Platform Inventory or assessment from the MigrationFox dashboard and you should see real flow and app counts.
Verifying the registration worked
From the same PowerShell session:
Get-PowerAppManagementApp
You should see a row for your ApplicationId. If it’s there and the scan still reports 0 flows and 0 apps, see the troubleshooting section below.
Why this registration is needed
Power Platform admin APIs (api.bap.microsoft.com and api.flow.microsoft.com) authorize calls in two layers:
- Directory role: the calling app needs Power Platform Administrator (or Global Administrator).
- Management-app registration: apps calling with app-only tokens must also be explicitly allowed to call tenant-wide admin endpoints. People don’t need this extra step because they call the APIs with tokens tied to their own identity.
The New-PowerAppManagementApp cmdlet adds your app to the second list. MigrationFox only reads through these APIs; it doesn’t change environments, flows or apps.
Troubleshooting
| Symptom | Likely cause | Fix |
|---|---|---|
Add-PowerAppsAccount fails with "user is not a licensed Power Apps user" |
The admin account has no Power Apps license assigned. | Assign a Power Apps license (many Microsoft 365 plans include one) to the admin account and retry. |
New-PowerAppManagementApp fails with "403 Forbidden" |
The signed-in account is not a Global Administrator. | Sign out (Remove-PowerAppsAccount), sign back in as a Global Administrator, and retry. |
| Command succeeds but scans still report 0 flows and 0 apps after a few minutes | Wrong ApplicationId registered (it’s easy to confuse the tenant ID with the client ID), or the scan used a different connection. | Compare the client ID of the Service Account connection you scanned with against Get-PowerAppManagementApp. If they differ, run New-PowerAppManagementApp again with the right ID. |
| Environments are listed, but apps and flows are still 0 for environments with a Dataverse database | The app also needs access inside each Dataverse environment. | Add the app as an Application user with the System Administrator security role in each environment. See Access requirements (Tier 2). |
| Some environments return flows but others don’t | Per-environment access is missing on those environments, or they have their own restrictions. | Check the Application user on those environments in the Power Platform admin center. The scan still works for all other environments. |
Per-environment access for Dataverse environments
The management-app registration above is required for every scan. For environments that have a Dataverse database, flows, apps and solutions also need the app to exist as an Application user in that environment:
- Open the Power Platform admin center.
- Go to Environments and open each environment you want scanned.
- Go to Settings → Users + permissions → Application users and choose + New app user.
- Find the app by its Application (client) ID, keep the root business unit, assign the System Administrator security role, and choose Create.
The older Set-AdminPowerAppEnvironmentRoleAssignment cmdlet returns LinkedEnvironmentForbiddenOperation on Dataverse environments, so use the Application user steps above instead.
Related
- Power Platform Inventory: what the inventory reads and the access each tier unlocks
- Dependency Graph scan: per-site references to flows, apps and Teams tabs
- Continuous monitoring: scheduled re-runs of governance assessments
- Microsoft: PowerShell support for Power Platform administrators