Problem Description

Microsoft Fabric pipeline executions intermittently fail with authentication errors on connections that use Microsoft Entra ID (Azure AD) OAuth refresh tokens. Pipelines that previously executed successfully begin failing with authentication errors, and simply rerunning the pipeline does not resolve the issue. The connection must instead be manually re-authenticated before pipeline execution can resume.

The following Azure AD Security Token Service (AADSTS) error codes have been observed:

Error CodeDescription

AADSTS700082 – Refresh token expired due to inactivity.

AADSTS50173 – Refresh token revoked after password change/reset.

AADSTS50057 – User account disabled.

AADSTS500341 – User account deleted.

AADSTS135010 – User principal missing key ID.

Although these error codes represent different underlying causes, they all result in the same operational issue: the pipeline cannot authenticate until the connection credentials are manually refreshed.

Root Cause

Fabric currently does not automatically renew OAuth refresh tokens for pipeline connections in the background.

When a connection is created, Fabric obtains an OAuth refresh token associated with the authenticated user account. This token is later used to acquire new access tokens as required.

However, if:

• the connection remains unused for an extended period,
• the user's password is changed or reset,
• the user account is disabled or deleted, or
• the identity configuration changes,

the refresh token becomes invalid.

Unlike platforms that support service principals, managed identities, or silent token renewal, Fabric does not automatically re-establish the OAuth authorization when the refresh token becomes invalid. Instead, the connection enters a failed authentication state and requires manual user intervention to reauthenticate.

As a result, unattended or scheduled pipelines can fail unexpectedly even though no pipeline logic has changed.

Impact

Pipeline Reliability

Scheduled and unattended pipelines may fail unexpectedly after weeks or months of successful execution without any advance indication that the authentication token is nearing expiration.

Operational Overhead

Operations teams must monitor for AADSTS authentication failures and manually reauthenticate affected connections before pipelines can resume. This introduces ongoing maintenance effort that is inconsistent with unattended data integration workloads.

Data Freshness and SLA Risk

Failed pipeline executions delay downstream datasets, reports, and business processes until the authentication issue is resolved, increasing the risk of missed reporting deadlines and SLA violations.

Longer Troubleshooting

Multiple AADSTS error codes can produce similar pipeline failures while requiring different remediation actions. This increases investigation time and makes root-cause identification less straightforward.

Current Resolution / Workarounds

Option 1 – Re-authenticate the Connection

1. Open the affected pipeline connection.
2. Edit the connection credentials.
3. Reauthenticate with Microsoft Entra ID.
4. Save the connection.
5. Rerun the pipeline.

Option 2 – Trigger a Connection Refresh

A temporary workaround is to make a minor, non-functional modification to the pipeline (for example, updating its description) and save the pipeline.

This action has been observed to refresh the authentication token without requiring the user to manually re-enter credentials.

Microsoft also provides a PowerShell script that automates this "dummy update" process across multiple pipelines, making it suitable for larger environments:

https://github.com/microsoft/fabric-samples/tree/main/docs-samples/data-factory

Additional Mitigations

Where possible, we recommend the following operational practices:

• Use service principal or managed identity authentication instead of user credentials whenever the connector supports it.
• Schedule a lightweight keep-alive pipeline to execute at an interval shorter than the refresh token inactivity period to reduce the likelihood of AADSTS700082.
• Monitor pipeline execution failures for the relevant AADSTS error codes and automatically notify support teams so that reauthentication can be completed before business users are impacted.
• Maintain documentation identifying which pipelines depend on user-based authentication to simplify incident response.

Product Enhancement Suggestions

To improve reliability for unattended workloads, we recommend the following enhancements to Microsoft Fabric.

1. Automatic Background Token Refresh

Support silent background renewal of OAuth refresh tokens for pipeline connections so that authentication remains valid without requiring manual credential re-entry.

2. Proactive Expiration Notifications

Provide advance notifications (for example, email alerts or Fabric activity warnings) before a refresh token expires due to inactivity, allowing administrators to take corrective action before scheduled executions fail.

3. Expanded Support for Service Principals and Managed Identities

Enable all first-party Fabric connectors to support service principal or managed identity authentication. Eliminating dependence on user accounts would significantly reduce authentication failures caused by password changes, disabled accounts, or deleted users.

4. Improved Error Messaging

Present a unified, user-friendly authentication error that clearly distinguishes between:

• Token expired due to inactivity
• Password reset or credential revocation
• Disabled account
• Deleted account
• Identity configuration issues

Providing targeted remediation guidance alongside each error would substantially reduce troubleshooting time.

Conclusion

Current Microsoft Fabric pipeline connections that rely on Microsoft Entra ID user authentication require manual intervention whenever OAuth refresh tokens become invalid. This behavior reduces the reliability of unattended pipelines, increases operational overhead, and introduces avoidable risks to data availability and service-level agreements.

Implementing automatic background token refresh, proactive token expiry notifications, broader support for service principals and managed identities, and clearer authentication diagnostics would significantly improve the robustness and maintainability of Fabric pipeline authentication.