"Credentials are invalid" is one of the most common Power BI refresh errors and one of the most frustrating to diagnose because the error message doesn't tell you which credential is wrong or why it was rejected.
Where credentials live in Power BI
Power BI stores credentials in multiple places depending on the connection type:
- Gateway-connected datasets: Credentials are stored in the gateway cluster configuration (Manage gateways → Data source settings). These are separate from your Windows or database credentials — they must be explicitly updated whenever the underlying password changes.
- Cloud-to-cloud connections: Credentials are stored in the dataset's data source settings in Power BI Service (accessed via dataset Settings → Data source credentials). These are also separate from the underlying source system's credential store.
- OAuth-connected sources (SharePoint, Dynamics, Salesforce): Credentials take the form of an OAuth token stored against your user account. These expire and require re-authorization through the "Edit credentials" workflow.
Common causes and their fixes
Service account password change: This is the most common cause for on-premises SQL Server and Azure SQL datasets. The database password was changed by IT security rotation, but the gateway's stored credential wasn't updated. Fix: go to Manage gateways, find the data source, and re-enter the updated password.
OAuth token expiry: For SharePoint Online, Dynamics 365, or Salesforce connections using OAuth, the stored token expires after a period of inactivity or when the user account's permissions change. Fix: go to dataset Settings → Data source credentials and click "Edit credentials" to re-authorize.
Account lockout: The service account used for the database connection was locked out due to failed login attempts (often from a concurrent process using a stale password). Fix: unlock the account in Active Directory and update the gateway credential.
Azure AD service principal expiry: For Managed Identity or Service Principal connections to Azure services, the certificate or secret may have expired. Fix: renew the secret/certificate in Azure AD and update the connection configuration.
SAS token expiry: For Azure Blob Storage or ADLS connections using SAS tokens, the token has a defined expiry date. Fix: generate a new SAS token with an appropriate expiry and update the data source credential.
Diagnosing when credentials are valid but the error persists
Occasionally, re-entering correct credentials doesn't resolve the error. Check: the account may lack read permissions on the database (a permissions issue, not just a wrong password), the server may be requiring Kerberos authentication and the account can't negotiate it, or the gateway data source is mapped to the wrong server/database combination.