What causes SalesforceOauth2ClientCredentialFailure?

The Salesforce Connected App client ID or client secret stored in the linked service is incorrect or expired. The Salesforce org's OAuth settings have been changed after the linked service was created. The Salesforce Connected App does not have the required API scopes (api, refresh_token) enabled. IP allowlist restrictions on the Salesforce org are blocking the ADF integration runtime IP

How do I fix SalesforceOauth2ClientCredentialFailure?

In the ADF linked service for Salesforce, verify the client ID and client secret match the values in the Salesforce Connected App.. Log into Salesforce Setup > App Manager and confirm the Connected App is enabled and has "api" scope.. Regenerate the client secret in Salesforce if it may have expired and update the linked service.. Check the Salesforce org's login IP restrictions and add the ADF integration runtime IP if needed.. Use the "Test connection" button on the linked service to verify credentials.

High severitycredentials

Power BI Refresh Error:
SalesforceOauth2ClientCredentialFailure

What does this error mean?

ADF failed to authenticate to Salesforce using OAuth 2.0 Client Credentials. The client ID, client secret, or token endpoint configuration in the Salesforce linked service is incorrect or the connected app permissions are insufficient.

Common causes

1The Salesforce Connected App client ID or client secret stored in the linked service is incorrect or expired
2The Salesforce org's OAuth settings have been changed after the linked service was created
3The Salesforce Connected App does not have the required API scopes (api, refresh_token) enabled
4IP allowlist restrictions on the Salesforce org are blocking the ADF integration runtime IP

How to fix it

1In the ADF linked service for Salesforce, verify the client ID and client secret match the values in the Salesforce Connected App.
2Log into Salesforce Setup > App Manager and confirm the Connected App is enabled and has "api" scope.
3Regenerate the client secret in Salesforce if it may have expired and update the linked service.
4Check the Salesforce org's login IP restrictions and add the ADF integration runtime IP if needed.
5Use the "Test connection" button on the linked service to verify credentials.

Frequently asked questions

Does this error affect all pipeline runs?

Yes — once credentials expire or are revoked, every scheduled and manual pipeline run fails until updated.

How do I store credentials more securely in ADF?

Store secrets in Azure Key Vault and reference them in linked services — rotating a credential requires only updating the Key Vault secret.

Can I set up monitoring for credential expiry before pipelines fail?

For service principal secrets, set Azure Monitor alerts on Key Vault or App Registration expiry. For OAuth tokens, proactive rotation on a fixed schedule prevents failures.

Will re-entering credentials in the ADF linked service fix all pipelines that use it?

Yes — all pipelines using the same linked service succeed immediately after credentials are updated.

Official documentation: https://learn.microsoft.com/en-us/azure/data-factory/connector-troubleshoot-salesforce