What causes Fabric Pipeline Error 4121?

The service principal secret or certificate used in the AzureML connection has passed its expiry date. A managed identity token was not refreshed or the identity was disabled. OAuth2 access tokens cached in the connection were not renewed before expiry. The AzureML connection was created with short-lived credentials that have since expired

How do I fix Fabric Pipeline Error 4121?

Step 1: Navigate to the AzureML Service connection in Fabric Data Factory and check the authentication credential (service principal, managed identity, or key).. Step 2: If using a service principal, go to Azure Active Directory > App Registrations, locate the app, and check whether the client secret or certificate has expired — rotate it if needed.. Step 3: Update the Fabric connection with the new valid credential or secret.. Step 4: Test the connection to confirm authentication succeeds before re-running the pipeline.. Step 5: Set up credential expiry alerts in Azure AD or your secrets management tool (e.g., Azure Key Vault) to avoid future silent expirations.

High severityauthenticationMicrosoft Fabric →

Power BI Refresh Error:
Fabric Pipeline Error 4121

What does this error mean?

A request sent to Azure Machine Learning failed because the credential used to authenticate has expired. The pipeline cannot complete the requested ML operation until the credential is refreshed.

Common causes

1The service principal secret or certificate used in the AzureML connection has passed its expiry date
2A managed identity token was not refreshed or the identity was disabled
3OAuth2 access tokens cached in the connection were not renewed before expiry
4The AzureML connection was created with short-lived credentials that have since expired

How to fix it

1Step 1: Navigate to the AzureML Service connection in Fabric Data Factory and check the authentication credential (service principal, managed identity, or key).
2Step 2: If using a service principal, go to Azure Active Directory > App Registrations, locate the app, and check whether the client secret or certificate has expired — rotate it if needed.
3Step 3: Update the Fabric connection with the new valid credential or secret.
4Step 4: Test the connection to confirm authentication succeeds before re-running the pipeline.
5Step 5: Set up credential expiry alerts in Azure AD or your secrets management tool (e.g., Azure Key Vault) to avoid future silent expirations.

Frequently asked questions

How can I proactively prevent credential expiry from breaking my AzureML pipelines?

Store your service principal secrets in Azure Key Vault, reference them in Fabric connections via Key Vault integration, and configure Key Vault expiry alerts to notify your team 30+ days before expiration.

Does this error always mean the credential is expired, or could it be another auth issue?

Error 4121 specifically indicates an expired credential. If the credential is valid but lacks permissions, you would see error 4122 instead. Check the HTTP status code in the error message — a 401 typically confirms expiry.