Desktop - Sorry, a security policy is preventing access issue

[RubenSO]

Hello! My first post here.
I reveived access to Teams, sharepoints and any relevant source in my company. I can use data cubes without issue but I'm struggling with Excel/CSV files stored in my personal Onedrive as well in Org. Sharepoint. 

When I tried to enter my credentials the next error appear:

Error message
Sorry, a security policy is preventing access

An organization security policy requiring token protection is preventing this application from accessing the resource. You may be able to use a different application.

ErrorDetail:
Error Code: 53003
Request Id: 635b94da-08af-43e8-b49d-462a21e76b00
Correlation Id: cf59db66-993f-4b5f-846d-7c18020b54a9
Timestamp: 2024-12-20T21:35:53.286Z
App name: Microsoft Power Query for Excel
App id: a672d62c-fc7b-4e81-a576-e60dc46e951d
IP address: 177.249.160.215
Device identifier: 4fd4ac38-de2d-43a7-a389-0e7bc3c18197
Device platform: Windows 10
Device state: Compliant

The odd thing is that I tried to create a file directly in Power BI service using my credentials there and works well, only issue is when I tried to use it in Desktop.

[Idrissshatila]

Hello @RubenSO ,

the error says it all, you need to check with the IT guys at your company.

Error message
Sorry, a security policy is preventing access

An organization security policy requiring token protection is preventing this application from accessing the resource. You may be able to use a different application.

[Ritaf1983 · Accepted solution]

Hi @RubenSO 

It seems that the issue arises due to an organizational security policy requiring token protection, which is preventing access to the resources (Excel/CSV files on your OneDrive and SharePoint) via Power BI Desktop or Power Query in Excel. Here's how you can address the issue:

Steps to Troubleshoot and Resolve:
Confirm Organization Security Policies:

Reach out to your IT administrator or security team to confirm the specifics of the token protection policy. Policies like Conditional Access or device compliance may be restricting access via certain applications, such as Power BI Desktop or Power Query in Excel.
Use Power BI Service for Connection:

Since you mentioned that the Power BI Service works without issues, you can use the service to create a dataflow connecting to your OneDrive or SharePoint files. Afterward, you can connect to the dataflow from Power BI Desktop.
Enable Device Compliance:

Ensure your device is compliant with organizational policies. From the error details, it seems your device is marked as compliant, but recheck that all required configurations are met:
Sign in to Microsoft Endpoint Manager to review compliance.
Install or update Microsoft Authenticator if required.
Ensure Updated Applications:

Make sure your Power BI Desktop and Microsoft Office applications are updated to the latest versions. Sometimes, older versions can conflict with token policies.
Try Alternate Authentication:

Sign out and sign back in using the organizational account associated with the files. You can do this by:
In Power BI Desktop or Excel, go to File > Options and Settings > Data Source Settings, and clear the credentials for OneDrive/SharePoint.
Reconnect using your work account.
Change File Location:

If you urgently need access and cannot resolve the token issue, temporarily move the files to a location without token protection (e.g., local storage) and load them into Power BI Desktop or Excel. However, note that this is a temporary workaround and may not align with your organization's data security policies.
Contact IT Support:

Share the full error details, including the error code (53003) and correlation ID, with your IT department. They can investigate logs and verify if specific applications like Power BI Desktop or Power Query in Excel are excluded from token protection.
Enable App-Specific Access:

Request your IT team to whitelist Power Query for Excel and Power BI Desktop within Conditional Access policies to allow them to bypass token protection, if permissible.

If this post helps, then please consider Accepting it as the solution to help the other members find it more quickly.

[lbendlin]

That's a question you will need to take to your company's DLP office. They likely implemented these policies.