What causes DF-SAPODP-StageAuthInvalid?

The storage account key used in the staging linked service was rotated and the linked service was not updated. A SAS token in the staging linked service has expired. A service principal used to access staging storage has an expired secret or certificate. The staging linked service references a different storage account than the one where the staging container exists

How do I fix DF-SAPODP-StageAuthInvalid?

In ADF Studio, open Manage > Linked services and find the linked service used for SAP ODP staging storage.. Click Test connection — if it fails, the staging storage credentials are the problem.. For account key authentication: go to the storage account in the Azure portal, copy a fresh key, and update the linked service.. For SAS token authentication: generate a new SAS token with sufficient permissions (Read, Write, List, Delete on the container) and update the linked service.. For service principal authentication: check the secret expiry date in Azure AD > App registrations > Certificates & secrets and renew if expired.. Save the linked service, re-run Test connection, and retry the ADF pipeline.

Medium severitydata source

Power BI Refresh Error:
DF-SAPODP-StageAuthInvalid

What does this error mean?

The credentials for the SAP ODP staging storage are invalid or expired. SAP ODP extractions use an Azure Blob or ADLS Gen2 storage account as a staging area — this error means ADF cannot authenticate to that staging storage, not to SAP itself.

Common causes

1The storage account key used in the staging linked service was rotated and the linked service was not updated
2A SAS token in the staging linked service has expired
3A service principal used to access staging storage has an expired secret or certificate
4The staging linked service references a different storage account than the one where the staging container exists

How to fix it

1In ADF Studio, open Manage > Linked services and find the linked service used for SAP ODP staging storage.
2Click Test connection — if it fails, the staging storage credentials are the problem.
3For account key authentication: go to the storage account in the Azure portal, copy a fresh key, and update the linked service.
4For SAS token authentication: generate a new SAS token with sufficient permissions (Read, Write, List, Delete on the container) and update the linked service.
5For service principal authentication: check the secret expiry date in Azure AD > App registrations > Certificates & secrets and renew if expired.
6Save the linked service, re-run Test connection, and retry the ADF pipeline.

Frequently asked questions

Why does SAP ODP need a staging storage account?

The SAP ODP connector uses a cloud staging area as an intermediate buffer between the on-premises SAP system and data flow compute. The staging storage is separate from the SAP connection and requires its own credentials.

How do I tell whether this is a staging auth error versus a SAP auth error?

DF-SAPODP-StageAuthInvalid refers to staging storage — not SAP. If SAP credentials were the issue, you would see DF-SAPODP-AuthInvalid. Test the staging and SAP linked services separately to isolate which is failing.

Can multiple SAP ODP pipelines share the same staging linked service?

Yes — and this is common. If the staging linked service credentials expire, all pipelines using that staging storage will fail simultaneously. Updating the linked service once fixes all of them.

Is there a way to avoid this from recurring?

Use managed identity for the staging storage account — credentials don't expire. Switch the auth method to 'Managed identity' and assign Storage Blob Data Contributor to the ADF managed identity in the storage account IAM.

Official documentation: https://learn.microsoft.com/en-us/azure/data-factory/data-flow-troubleshoot-guide