Low severityauthentication
Power BI Error:
AADSTS90100, Empty or Malformed OAuth Parameter
What does this error mean?
The Microsoft Entra ID (Azure AD) authorization endpoint received a request where a required OAuth parameter is missing, empty, or malformed.
Common causes
- 1A required OAuth parameter (client_id, redirect_uri, scope, response_type, grant_type, or resource) is missing or sent as an empty string
- 2URL-encoding issue: the redirect_uri or scope contains unencoded characters (spaces, '+', ':') causing Entra ID to parse it as empty
- 3Stale or hardcoded resource URI in a custom connector or Power BI gateway data source (e.g. the old https://analysis.windows.net/powerbi/api passed without the trailing '/.default')
- 4On-premises data gateway or ADF Linked Service referencing a deleted/renamed App Registration, so client_id resolves to empty at runtime
- 5Custom OAuth2 connector in Power BI or Fabric where a token request template variable (like {{tenantId}} or {{clientId}}) was never substituted
How to fix it
- 1Read the parameter name in the error URL or response body — AADSTS90100 always names the offending parameter (e.g. 'parameter: scope'). Fix that specific one, don't guess.
- 2Inspect the actual outbound request: in Power BI Desktop use Fiddler/Edge DevTools, in ADF check the Linked Service test-connection diagnostics, in Fabric check the Monitoring Hub activity output. Confirm every required OAuth parameter is present and URL-encoded.
- 3If it's a Power BI custom connector or gateway data source: re-bind the data source under Manage Gateways → Data Source Settings, re-enter credentials so the OAuth parameters are regenerated from the current App Registration.
- 4Verify the App Registration in Entra ID (portal.azure.com → Microsoft Entra ID → App registrations) still exists and that client_id, tenant_id, and the redirect_uri match exactly what the application is sending — including trailing slashes.
- 5For service principal / client_credentials flows used by ADF or Databricks: ensure 'scope' is set to '<resource>/.default' (e.g. 'https://analysis.windows.net/powerbi/api/.default'), not an empty string or a v1-style 'resource' parameter mixed into a v2 endpoint call.