The credentials provided for the sql source are invalid - Azure SQL Mirror

[JAnder]

We are trialing using Azure SQL Mirrors in the workspaces to take the load off the SQL server at busy times. We have a connection set up to the database which the mirror uses for its data. It uses a service principal for authentication was has the relevant db permisisons. Replication all works and reports connect to the mirror no problem.

It was running for about 4 weeks then one day we got the error 

The credentials provided for the sql source are invalid, the exception was raised by the IdbCommand interface.

Without making any changes to the connection, mirror or the service principal account we just refreshed and it worked again. It was then fine for about 4 weeks and then it happened again. Refreshing all the reports then worked.

When it happens, the refreshes fail across all reports. I am just looking for ideas as to why it might happen. Clearly the service principal is fine and permissions are fine.

[v-dineshya]

Hi @JAnder ,

Thank you for reaching out to the Microsoft Community Forum.

It is a intermittent authentication issue rather than a permissions or configuration problem.

Please try below things to fix the issue.

1. Please Enable Diagnostic Logging, Turn on Azure SQL and Azure AD sign-in logs to see if there are failed token refresh attempts or conditional access blocks.

2. Default token lifetime is usually 1 hour. If refresh fails, you will see intermittent issues.

3. Check if there were any Azure AD or SQL outages during the failure windows.

4. Restart the mirror service or clear connection pools when the error occurs to confirm if it’s token-related.

5. Review Conditional Access, Ensure no policies intermittently affect the service principal.

Note: Implement retry logic for authentication failures. Use Managed Identity instead of a service principal, as it handles token refresh more reliably. Schedule mirror refreshes or restart jobs periodically to avoid stale tokens.

I hope this information helps. Please do let us know if you have any further queries.

Regards,

Dinesh

[JAnder]

I have checked and confirmed there was no cycling of the secrets during that time. I will look into the possibility of a managed identity and get back to this thread once done. Thanks

[v-dineshya]

Hi @JAnder ,

As you mentioned in your previous response, you are working on manged identity options, Once it is done .Please do let us know.

Regards,

Dinesh

[v-bmanikante]

Hi @JAnder ,

Thank you for reaching out to Microsoft Fabric Community Forum.

@JAnder , Azure SQL Mirror issue, where refreshes fail once every few weeks with a “credentials invalid” error and then work again after a manual refresh, is almost certainly caused by an authentication problem rather than SQL permissions. The most common reason is that the service principal is using a client secret that expires periodically, or the gateway is holding an old Azure AD token in its connection pool, which becomes invalid after some time. When the token or secret expires, all report refreshes fail until the gateway resets or new credentials are provided. The fix is to check and rotate the service principal secret, re-enter credentials in the gateway, or restart the gateway to clear expired tokens. For long term stability, use certificates or managed identities instead of short life secrets and set up alerts for expiring credentials.
If this doesn't fix the issue, please share a screenshot of the error message so we can work on a solution based on that.

Regards,
B Manikanteswara Reddy