What causes DF-Blob-InvalidAuthConfiguration?

The linked service uses account key authentication but the key has been rotated in the Azure portal and the linked service was not updated with the new key. The linked service uses a service principal but the client secret has expired, or the service principal does not have the required RBAC role on the storage account. The linked service uses managed identity (MSI) but the ADF managed identity has not been granted 'Storage Blob Data Reader' or 'Storage Blob Data Contributor' on the target storage account. The authentication type selected in the linked service does not match what the storage account supports (e.g., SAS token selected but SAS is disabled on the account)

How do I fix DF-Blob-InvalidAuthConfiguration?

Open the Azure Blob Storage linked service in ADF Studio and click 'Test connection' — note the specific authentication error returned.. If using account key: go to the storage account in the Azure portal → Access keys, rotate or copy the current key, and update the linked service.. If using service principal: verify the client secret is not expired in Azure AD, and confirm the service principal has 'Storage Blob Data Reader' or 'Contributor' role on the storage account.. If using managed identity: in the Azure portal, go to the storage account → IAM → Role assignments, and confirm the ADF managed identity has the required role.. If using SAS: regenerate the SAS token from the Azure portal and confirm the token's allowed services, resource types, and expiry date are appropriate.

Medium severitydata source

Power BI Refresh Error:
DF-Blob-InvalidAuthConfiguration

What does this error mean?

The ADF Mapping Data Flow Azure Blob Storage linked service authentication is misconfigured. The authentication method or credentials provided do not allow the data flow to access the storage account.

Common causes

1The linked service uses account key authentication but the key has been rotated in the Azure portal and the linked service was not updated with the new key
2The linked service uses a service principal but the client secret has expired, or the service principal does not have the required RBAC role on the storage account
3The linked service uses managed identity (MSI) but the ADF managed identity has not been granted 'Storage Blob Data Reader' or 'Storage Blob Data Contributor' on the target storage account
4The authentication type selected in the linked service does not match what the storage account supports (e.g., SAS token selected but SAS is disabled on the account)

How to fix it

1Open the Azure Blob Storage linked service in ADF Studio and click 'Test connection' — note the specific authentication error returned.
2If using account key: go to the storage account in the Azure portal → Access keys, rotate or copy the current key, and update the linked service.
3If using service principal: verify the client secret is not expired in Azure AD, and confirm the service principal has 'Storage Blob Data Reader' or 'Contributor' role on the storage account.
4If using managed identity: in the Azure portal, go to the storage account → IAM → Role assignments, and confirm the ADF managed identity has the required role.
5If using SAS: regenerate the SAS token from the Azure portal and confirm the token's allowed services, resource types, and expiry date are appropriate.

Frequently asked questions

How do I know which authentication method my linked service uses?

In ADF Studio, open the linked service and check the 'Authentication method' dropdown — it shows the current method (Account key, Service principal, Managed identity, or SAS URI).

My service principal credentials look correct but the connection still fails. Why?

Valid credentials alone aren't enough — the service principal must also have an RBAC role on the storage account. Check IAM → Role assignments for the service principal.

Can I use managed identity instead of account keys to avoid rotation issues?

Yes. ADF managed identity removes the need to manage credentials — assign 'Storage Blob Data Contributor' to the ADF managed identity on the storage account and switch the linked service to 'Managed identity' authentication.

Official documentation: https://learn.microsoft.com/en-us/azure/data-factory/data-flow-troubleshoot-guide