Best Practice Analysis
Best Practice Analysis scans your crawled solutions against 12 rules covering deprecated features, unsupported code, naming, error handling, performance, security, maintainability, and configuration. It identifies issues before they become problems — free, for every solution.
What It Analyzes
Best Practice Analysis examines every component discovered during a crawl and evaluates it against a set of rules. Each rule checks for a specific pattern, anti-pattern, or configuration issue that could impact maintainability, performance, security, or reliability.
The analysis runs entirely within Dataverse using plugin logic — no data leaves your environment. Results are stored in Cartographer's database and can be reviewed and resolved at any time.
How to Run Analysis
- 1Open the Cartographer app and go to Best Practices
- 2Select a crawled solution from the picker in the header
- 3Click Run Analysis
- 4Issues appear below as a list of cards, with summary counts by severity at the top
Use the filter bar to narrow the list by solution, severity, or category, and toggle Show Resolved to bring resolved issues back into view.
Severity Levels
Critical
Issues that pose a security risk, rely on deprecated or unsupported code, or significantly impact system reliability. These should be addressed first.
Warning
Issues that may cause problems over time or indicate a deviation from best practices. These should be reviewed and addressed when possible.
Info
Suggestions for improvement that are not urgent. These are recommendations that can improve code quality and maintainability over time.
Rules Reference
The following 12 rules are checked during every Best Practice Analysis run:
| ID | Rule | Severity | Category | What It Checks |
|---|---|---|---|---|
| BP001 | Deprecated Workflow | Critical | Deprecated Feature | Flags any classic workflow — deprecated by Microsoft and slated for eventual removal |
| BP002 | Synchronous Plugin on Retrieve | Warning | Performance | A plugin step registered synchronously on a Retrieve or RetrieveMultiple message |
| BP003 | Flow Without Error Handling | Warning | Error Handling | A cloud flow with no "Configure run after — has failed" branch on its actions |
| BP004 | Hardcoded GUIDs in JavaScript | Warning | Maintainability | A JavaScript web resource containing literal GUIDs, which break when a solution moves between environments |
| BP005 | Poor Naming Convention | Info | Naming Convention | A component using the default "new_" publisher prefix, or an unreadable, unseparated name |
| BP006 | Deprecated SDK Usage | Critical | Unsupported Code | JavaScript referencing XrmServiceToolkit, Xrm.Page, or other unsupported or internal Microsoft namespaces |
| BP007 | Async Plugin Without Error Logging | Info | Error Handling | Flags asynchronous plugin steps as a reminder to verify they log failures |
| BP008 | Large JavaScript File | Warning | Performance | A JavaScript web resource over 50,000 characters, which can affect page load |
| BP009 | Business Rule on All Forms | Info | Configuration | A business rule with no form scoping, so it applies to every form for the table |
| BP010 | Disabled Flow | Info | Configuration | A cloud flow that is currently turned off |
| BP011 | Missing Description | Info | Maintainability | A flow, classic workflow, custom action, or business process flow with no description |
| BP012 | XSS Risk in JavaScript | Critical | Security | JavaScript containing eval(), document.write(), or a direct innerHTML assignment |
Resolving Issues
Each issue card shows its title, rule ID, severity, category, and the affected component, with expandable Recommendation and Details sections for the specifics.
- Mark Resolved — after fixing the issue in your solution, mark it resolved. It drops out of the default list; toggle Show Resolved to bring it back, or Reopen it if you marked it too soon.
- Filter — narrow the list by solution, severity, or category to focus on what matters most.