Low severityauthentication
Power BI Refresh Error:
AADSTS90014
What does this error mean?
The token request to Microsoft Entra ID (Azure AD) is missing a required parameter such as grant_type, client_id, or scope.
Common causes
- 1Missing 'grant_type' parameter in the token endpoint request body
- 2Missing 'client_id' or 'client_secret' on a confidential-client flow
- 3Missing 'scope' or 'resource' parameter when requesting an access token
- 4Empty or missing 'assertion' field in a client_credentials or on-behalf-of flow with a client assertion JWT
- 5Custom connector, gateway, or middleware stripping form-encoded parameters before they reach login.microsoftonline.com
How to fix it
- 1Capture the raw HTTP request to https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token (Fiddler, browser DevTools, or gateway log) and identify which form field is empty or absent
- 2Add the missing parameter — typically grant_type (e.g. 'client_credentials' or 'authorization_code'), client_id, scope, or assertion — and ensure Content-Type is application/x-www-form-urlencoded
- 3If using an on-behalf-of or client-assertion flow, verify the JWT assertion is generated and included as the 'client_assertion' field, with 'client_assertion_type' set to 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'
- 4For Power BI / Fabric custom data connectors or ADF linked services, check the connector configuration — a blank tenant ID, resource URL, or scope frequently causes this error
- 5If the error originates in MSAL or ADAL code, upgrade to the latest MSAL version and use the library's builder pattern instead of constructing the request manually