Power BI Error:
AADSTS120020

What does this error mean?

Password change required at sign-in failed — the user could not complete the forced password update.

Common causes

• 1The user's password is expired and the forced change at sign-in did not complete successfully
• 2New password did not meet the tenant's password complexity, length, or history policy
• 3Self-Service Password Reset (SSPR) is not enabled or the user is not registered for it
• 4Network or proxy interruption during the password change flow on login.microsoftonline.com
• 5Account is used as a service identity for a Power BI / ADF / Fabric data source — service accounts hit password expiry policies and cannot interactively change a password

How to fix it

1. 1Have the affected user sign in at https://aka.ms/sspr (or https://passwordreset.microsoftonline.com) and complete the password change, ensuring the new password meets the tenant policy (length, complexity, no recent reuse)
2. 2If SSPR is not available or fails, ask a Global Admin / User Admin to reset the password from the Microsoft Entra admin center (Users → select user → Reset password)
3. 3For Power BI / ADF / Fabric data sources or gateway connections using this account: after the reset, update the stored credentials in the dataset settings, Data Factory linked service, or On-premises Data Gateway — old cached credentials will keep failing with AADSTS50076/50079 follow-ups
4. 4Migrate any service-account-based connections to a Service Principal or Managed Identity so password expiry no longer breaks scheduled refreshes
5. 5Review the user's password expiration policy in Entra ID (Microsoft 365 admin center → Settings → Org settings → Security & privacy) and consider 'Set passwords to never expire' for genuine service accounts that cannot be moved to SPN

Frequently asked questions

Other authentication errors