What causes Credentials are invalid?

Service account password was rotated (manually or by Azure AD password policy) without updating the stored credentials in Power BI Service or the on-premises data gateway.. OAuth token for SharePoint Online, Dynamics 365, or Azure Data Lake has expired. Azure AD access tokens last 60-90 minutes; refresh tokens last up to 90 days but can be revoked by admins or Conditional Access policies.. A Conditional Access policy was added or modified in Azure AD that now blocks sign-in from the Power BI Service IP range or requires MFA, which non-interactive refresh cannot satisfy.. The SQL Server or Azure SQL database user was disabled, dropped, or had its password reset by a DBA — often during routine credential rotation or after a security audit.. The account used for the data source lost its role assignment. For example, a db_datareader role was removed in Azure SQL, or the user was removed from a SharePoint site collection.. API key or SAS token used as a credential was rotated or revoked — common with REST API sources, Azure Blob Storage, or third-party connectors.. The on-premises data gateway was updated or reinstalled, and the data source credentials were not re-entered after the gateway re-registration.

How do I fix Credentials are invalid?

Open Power BI Service → Workspace → Dataset → Settings → Data source credentials. Click 'Edit credentials' for each connection marked with a warning icon.. For username/password sources: re-enter the current password. If you're unsure whether the password changed, verify by connecting directly from SSMS or Azure Data Studio: sqlcmd -S your-server.database.windows.net -U your_user -P 'your_password' -Q 'SELECT 1'.. For OAuth sources (SharePoint, Dynamics, Azure Data Lake): click 'Sign in' to trigger a fresh OAuth flow. You must sign in with the account that has access to the source — not just any Azure AD account.. Check the service account status in Azure AD: Go to Azure Portal → Azure Active Directory → Users → search for the account → verify 'Account enabled: Yes' and no sign-in blocks under Conditional Access.. For gateway-connected sources: open the on-premises data gateway app or Power BI Service → Manage gateways → Data sources. Update credentials there as well — gateway credentials are stored separately from cloud dataset credentials.. If multiple datasets share the same service account, use Power BI Service → Manage gateways to see all data sources using that account, and update them all at once instead of hunting through individual dataset settings.. After updating credentials, trigger a manual refresh to confirm the fix. Then set up a MetricSign alert on the 'credential-error' category so you catch the next expiration before reports go stale.

High severitycredentials

Power BI Refresh Error:
Credentials are invalid

Impact

Every scheduled and manual refresh fails immediately and will keep failing until someone re-enters valid credentials. Downstream dataflows, composite models, and paginated reports that depend on this dataset will also fail or show stale data. The dataset owner or gateway admin must act — this error never resolves on its own.

A credential failure stops all refreshes for the affected dataset — scheduled, manual, and API-triggered. Power BI does not retry credential errors automatically; the failure is terminal until human intervention. Downstream dataflows that use this dataset as a source will also fail on their next refresh. If the dataset feeds a composite model or paginated report, those go stale silently. In environments with 8x/day refresh schedules, an overnight password rotation can mean 8+ consecutive failures before anyone notices, violating data freshness SLAs.

What does this error mean?

Power BI rejected the stored credentials for a data source connection during a scheduled or manual refresh. The service sends the saved username/password, OAuth token, or API key to the source system, and the source responds with an authentication failure. In a pipeline context this typically surfaces as a failed refresh in Power BI Service, which blocks downstream dataflows, paginated reports, and composite models that depend on the affected dataset. The symptom is immediate: every refresh attempt returns 'Credentials are invalid' until the dataset owner re-enters valid credentials. Common triggers include password rotations on service accounts, expired OAuth tokens (default lifetime is 60-90 days for Azure AD), revoked API keys, and Conditional Access policy changes that block the service principal.

Common causes

1Service account password was rotated (manually or by Azure AD password policy) without updating the stored credentials in Power BI Service or the on-premises data gateway.
2OAuth token for SharePoint Online, Dynamics 365, or Azure Data Lake has expired. Azure AD access tokens last 60-90 minutes; refresh tokens last up to 90 days but can be revoked by admins or Conditional Access policies.
3A Conditional Access policy was added or modified in Azure AD that now blocks sign-in from the Power BI Service IP range or requires MFA, which non-interactive refresh cannot satisfy.
4The SQL Server or Azure SQL database user was disabled, dropped, or had its password reset by a DBA — often during routine credential rotation or after a security audit.
5The account used for the data source lost its role assignment. For example, a db_datareader role was removed in Azure SQL, or the user was removed from a SharePoint site collection.
6API key or SAS token used as a credential was rotated or revoked — common with REST API sources, Azure Blob Storage, or third-party connectors.
7The on-premises data gateway was updated or reinstalled, and the data source credentials were not re-entered after the gateway re-registration.

How to fix it

1Open Power BI Service → Workspace → Dataset → Settings → Data source credentials. Click 'Edit credentials' for each connection marked with a warning icon.
2For username/password sources: re-enter the current password. If you're unsure whether the password changed, verify by connecting directly from SSMS or Azure Data Studio: sqlcmd -S your-server.database.windows.net -U your_user -P 'your_password' -Q 'SELECT 1'.
3For OAuth sources (SharePoint, Dynamics, Azure Data Lake): click 'Sign in' to trigger a fresh OAuth flow. You must sign in with the account that has access to the source — not just any Azure AD account.
4Check the service account status in Azure AD: Go to Azure Portal → Azure Active Directory → Users → search for the account → verify 'Account enabled: Yes' and no sign-in blocks under Conditional Access.
5For gateway-connected sources: open the on-premises data gateway app or Power BI Service → Manage gateways → Data sources. Update credentials there as well — gateway credentials are stored separately from cloud dataset credentials.
6If multiple datasets share the same service account, use Power BI Service → Manage gateways to see all data sources using that account, and update them all at once instead of hunting through individual dataset settings.
7After updating credentials, trigger a manual refresh to confirm the fix. Then set up a MetricSign alert on the 'credential-error' category so you catch the next expiration before reports go stale.

Example log output

Refresh failed. Credentials are invalid.
Cluster URI: WABI-WEST-EUROPE-redirect.analysis.windows.net
Activity ID: 3a7f2c10-8e4d-4b1a-9c3f-0d5e6f7a8b9c
Request ID: b2c4d6e8-1f3a-5b7c-9d0e-2f4a6b8c0d1e
Time: 2026-05-11T06:00:14.237Z
Error Code: DMTS_CredentialNotFoundError

Frequently asked questions

Does this error affect all users or just the dataset owner?

All users. Scheduled and manual refreshes use the credentials stored in dataset settings, not individual viewer accounts. Everyone consuming the dataset sees stale data until the owner fixes the credentials.

Can expired OAuth tokens cause this error even if I didn't change my password?

Yes. Azure AD refresh tokens expire after 90 days by default, and Conditional Access policies or admin actions can revoke them sooner. The fix is to re-authorize: dataset settings → Edit credentials → Sign in.

I updated the credentials but the refresh still fails — what am I missing?

Check if the dataset uses a gateway connection. Gateway credentials are stored separately from cloud credentials — you need to update both. Also verify the account still has the required permissions on the source (e.g., db_datareader role in SQL, site access in SharePoint).

How do I prevent this error from recurring after every password rotation?

Use a service principal (app registration) instead of a user account for data source connections — service principals use certificate or client-secret authentication with configurable expiry, and you control when credentials rotate instead of being surprised by password policies.

Source · learn.microsoft.com/en-us/power-bi/connect-data/service-troubleshooting-sign-in