MetricSign
EN|NLRequest Access
Medium severitycredentials

Power BI Refresh Error:
SftpInvalidHostKeyFingerprint

What does this error mean?

The SFTP server's host key fingerprint does not match the ADF linked service configuration — a security check against man-in-the-middle attacks.

Common causes

  • 1The SFTP server was migrated to new hardware and its SSH host keys changed
  • 2The SFTP server was reinstalled and new host keys were generated
  • 3The fingerprint in the ADF linked service was entered incorrectly during initial configuration

How to fix it

  1. 1Connect to the SFTP server from a trusted machine and obtain the current host key fingerprint: ssh-keyscan <host>.
  2. 2Update the host key fingerprint in the ADF SFTP linked service to match the current server fingerprint.
  3. 3Verify with the SFTP server administrator that the key change was intentional before trusting the new fingerprint.

Frequently asked questions

Does this error affect all pipeline runs?

Yes — once credentials expire or are revoked, every scheduled and manual pipeline run fails until updated.

How do I store credentials more securely in ADF?

Store secrets in Azure Key Vault and reference them in linked services — rotating a credential requires only updating the Key Vault secret.

Can I set up monitoring for credential expiry before pipelines fail?

For service principal secrets, set Azure Monitor alerts on Key Vault or App Registration expiry. For OAuth tokens, proactive rotation on a fixed schedule prevents failures.

Will re-entering credentials in the ADF linked service fix all pipelines that use it?

Yes — all pipelines using the same linked service succeed immediately after credentials are updated.

Official documentation: https://learn.microsoft.com/en-us/azure/data-factory/connector-troubleshoot-ftp-sftp-http

Other credentials errors