PP:UNDOC MCP connector for Power Platform

April 08, 2026

David Wyatt has extensively watched network traffic from the Power Platform Admin Center, the maker portal, and the Flow portal. He catalogued every undocumented endpoint he found and published them at ppundoc.com with Postman collections on GitHub.

My MCP connector wraps 119 of those endpoints across 9 collections into a single custom connector with 34 MCP tools for Copilot Studio admin agents. Tenant settings, environment management, flow administration, Dataverse operations, DLP policies, licensing, analytics, and more—the endpoints that power the admin center UI, now available in your flows and agent conversations.

These are undocumented APIs. They were discovered from browser network traffic and may change or break without notice. Don’t use them in production-critical scenarios without fallback handling.

Full source: GitHub repository

The 9 collections

MCP tools (34 tools)

Discovery and inventory

Governance and security

Flow management

Licensing and capacity

Analytics

How it works

Admin: "Which environments are using the most capacity?"

1. Orchestrator calls get_tenant_capacity({})

   → Returns storage breakdown: database, file, log
     across all environments

2. Orchestrator calls licenses_by_environment({})

   → Returns per-environment license allocations
     with usage percentages

Admin: "Show me all flows that are erroring
        in the Sales environment"

1. Orchestrator calls list_flows_admin({
     environment_id: "abc123..."
   })

   → Returns all flows with status

2. Orchestrator calls check_flow_errors({
     flow_id: "def456..."
   })

   → Returns error details and suggested fixes

Admin: "What DLP policies do we have
        and are there any unblockable connectors?"

1. Orchestrator calls list_dlp_policies({})
   → Returns all DLP policies with rules

2. Orchestrator calls list_unblockable_connectors({})
   → Returns connectors exempt from DLP enforcement

API hosts

The connector routes to 10 different API hosts depending on the operation:

The script handles host routing automatically based on operation ID. Connection parameters (Dataverse URL, Tenant ID, Environment ID) populate the dynamic host templates.

Use cases

Admin agent for tenant governance: Build a Copilot Studio agent that Power Platform admins talk to in natural language. “What are our DLP policies?” “Which environments have Copilot enabled?” “Show me the governance advisor recommendations.” The agent calls the right MCP tools and summarizes the responses.

Environment capacity monitoring: Run a scheduled Power Automate flow that checks tenant capacity and per-environment licensing daily. Alert when storage exceeds thresholds or when AI Builder credits are running low.

Flow administration at scale: List all flows across all makers in an environment, check for errors, view run history, and enable or disable flows—all without opening the admin center. The cancel_all_runs operation handles runaway flows that are consuming resources.

License audit and reporting: Generate license reports, check add-on allocations, and get per-environment breakdowns. Pair with the security insights operation for a combined governance and licensing dashboard.

Security role auditing: Use check_role_permissions to audit what privileges a security role grants. Use find_user to look up specific accounts. Combine with DLP policy listing for a complete security posture review.

Analytics inventory: Get full inventory of canvas apps, cloud flows, desktop flows, and Copilot Studio agents with usage data. Identify orphaned resources, unused apps, and flows that haven’t run in months.

Prerequisites

1. Power Platform admin or Global admin role
2. A bearer token obtained from browser developer tools or an OAuth flow

How to get a bearer token

1. Open admin.powerplatform.microsoft.com or make.powerapps.com
2. Press F12 to open Developer Tools
3. Go to the Network tab
4. Perform any action in the UI
5. Select a request, go to Headers, and copy the Authorization header value
6. Remove the Bearer prefix—paste just the token

Tokens expire after approximately 60 minutes. Refresh manually or automate via an OAuth flow.

Connection parameters

Known limitations

• Undocumented APIs — may break without notice. Not supported by Microsoft. Use fallback handling.
• Bearer token auth — tokens expire (~60 minutes). Must be refreshed manually or via OAuth flow.
• Admin Analytics — requires Global Admin role. Region prefix (na.) may differ for non-US tenants.
• BAP API — limited SPN support. May require user-context token from browser.
• PP-Environment API — requires a special environment ID format (no hyphens, period before last 2 characters).
• Per-user UPN usage data — not available through any of these APIs. Use the Power Platform Admin Center UI or Center of Excellence Starter Kit.

Files

Resources

• ppundoc.com — endpoint catalogue by David Wyatt
• David Wyatt’s Postman collections
• David Wyatt on X