ODATA Feed : credentials error

Hi G_CR_23 

You're spot on—your Fiddler trace caught the exact root cause. The "Invalid Credentials" error isn't about the wrong password; it's an authentication protocol mismatch.

The Diagnosis
You are 100% correct. Power BI Desktop works because it uses your local Windows session (NTLM) via the VPN. However, the Power BI Service is a cloud-native entity. When it talks to your Gateway, it passes an Azure AD Bearer token (JWT). Your on-prem Business Central server, which is expecting a Windows-based challenge (NTLM/Kerberos), simply doesn't know what to do with a cloud token, so it rejects the request.

The Solution: Kerberos Constrained Delegation (KCD)
Requesting IT to set up KCD on a Standard Gateway is indeed the definitive and most professional way forward. It acts as the "translator" between the cloud and your local domain.

What IT needs to do:

SPNs: Ensure Service Principal Names (SPNs) are correctly registered for the account running the Business Central service.

Delegation: Configure the Gateway service account in Active Directory to "Trust this user for delegation" to the BC service.

SSO settings: Once the AD work is done, you’ll need to tick the "Use SSO via Kerberos for OData queries" box in the Gateway cluster settings in Power BI.

Are there workarounds?
If your IT department pushes back on KCD (which happens often due to the complexity of AD configurations), you have one "Plan B":

Web Service Access Key (Basic Auth): In Business Central, you can generate a specific "Web Service Access Key" for your user. In the Power BI Service, you can then switch the authentication method to Basic and use that key as the password. It bypasses the NTLM handshake entirely.

Note: This is less secure and many modern IT policies are deprecating Basic Auth, so KCD remains the superior choice.

Verdict: Your conclusion is solid. KCD is the "right" way to handle identity flow from the cloud to an on-prem OData feed. Stick to your guns with IT.

If this post helps, then please consider Accepting it as the solution to help the other members find it more quickly