High severityauthentication
Power BI Refresh Error:
Refresh fails when updating data from sources that use Microsoft Entra ID OAuth
What does this error mean?
The Microsoft Entra ID (formerly Azure AD) OAuth token used to authenticate against a data source expires approximately one hour into the refresh, causing it to fail before data loading completes. This affects any OAuth2-authenticated data source where the refresh duration approaches or exceeds the token lifetime.
Common causes
- 1Large semantic models that take more than one hour to load, causing the OAuth token to expire mid-refresh
- 2Power BI service waiting up to two hours for data to load, during which the initially-issued one-hour OAuth token becomes invalid
- 3Multitenant OAuth2 connection scenarios, which are not supported — the data source must reside in the same tenant as the Power BI service
- 4Using a different account for OAuth2 data source authentication than the account used to sign in to the Power BI service
How to fix it
- 1Step 1: Confirm that the account used to configure OAuth2 credentials for the data source in Power BI service settings is the same account used to sign in to the Power BI service — mismatched accounts are a common cause.
- 2Step 2: Reduce the volume of data loaded during each refresh by implementing incremental refresh policies, which load only new or changed rows rather than the full dataset on every run.
- 3Step 3: Optimize your Power Query transformations and data source queries to minimize refresh duration — push filtering and aggregation to the source system to reduce data transfer time.
- 4Step 4: Verify that the data source tenant matches the Power BI service tenant — multitenant OAuth2 connections are not currently supported and will consistently fail authentication.
- 5Step 5: If the data source supports service principal authentication as an alternative to OAuth2, consider switching to a service principal with a client secret or certificate, which does not have the same one-hour token expiry constraint.