Forum Discussion
How will Power Query in Excel handle MFA after September 15, 2025?
Starting September 15, 2025, Microsoft will enforce MFA by default for Microsoft 365 accounts. However, the actual application of MFA depends on your organization’s Entra ID (Azure AD) Conditional Access policies.
1. MFA is required, but IT can exclude specific accounts like service or break glass accounts.
2. Policies may make MFA conditional, such as only for risky sign ins or when accessing from external networks.
3. Trusted locations or compliant devices can minimize the frequency of MFA prompts.
So technically, your account could be excluded from MFA, but that depends entirely on how your organization’s policies are set up.Regards,
Yugandhar.
Hi VJoicic
Nothing new changes in Excel Power Query because of Sept 15, 2025. MFA is enforced by Entra ID (Azure AD) policies, Excel keeps using refresh tokens and only prompts when policy or token expiry requires it not on every Refresh.
Key points
-
Use Organizational account (OAuth) for all connectors, avoid Basic/legacy auth.
-
Prompts appear when: token expires, Conditional Access sign-in frequency triggers, you change device/network, or cookies are cleared.
-
To reduce prompts, ask IT to tune CA: reasonable sign-in frequency, Persistent browser session, trusted locations, and (if used) compliant-device rules.
-
Unattended refresh isn’t supported in desktop Excel. For no-touch updates, move queries to Power BI/Fabric (Dataflow/semantic model) and use scheduled refresh with a service principal/managed identity.
-
Connector tips:
-
SharePoint/OneDrive/Dataverse/Dynamics >> stay on OAuth (Organizational account).
-
Azure SQL/Synapse >> use Entra ID (Azure AD) authentication, not SQL username/password.
-
Hi rohit1991,
Thanks for the detailed explanation — that clears up a lot.
So, if I understand correctly, the September 15, 2025 MFA enforcement doesn’t introduce any new prompt behaviour for Excel Power Query itself, because MFA challenges are handled by Entra ID policies and Excel is already using refresh tokens.
Prompts will still only appear when the token expires, Conditional Access sign-in frequency kicks in, or something like a device/network change or cookie clear happens.
I’ll discuss with our IT team about tuning Conditional Access to reduce prompts where possible — like longer sign-in frequency and trusted locations — so day-to-day manual refreshes in Excel stay smooth.
Hi VJoicic ,
rohit1991, explanation has made things clear, and your understanding is correct. The September 15, 2025 MFA enforcement will not affect how Excel Power Query works; prompts will still follow Entra ID policies and token expiry.To keep refreshes smooth, it’s best to work with your IT team on Conditional Access settings. For unattended, automated refreshes without prompts, using Power BI or Fabric workflows is a good option.
Thank you for the clear explanation, rohit1991 .
Let us know if you see any unexpected MFA prompts after the policy changes.
Regards,
Yugandhar.Hi V-yubandi-msft ,
Thanks for the time and explanation.
With the Conditional Access settings after September 15th, would it be possible that my account is excluded from MFA, and it is up the our internal policies, or MFA will be strictly enforced for O365 accounts?Starting September 15, 2025, Microsoft will enforce MFA by default for Microsoft 365 accounts. However, the actual application of MFA depends on your organization’s Entra ID (Azure AD) Conditional Access policies.
1. MFA is required, but IT can exclude specific accounts like service or break glass accounts.
2. Policies may make MFA conditional, such as only for risky sign ins or when accessing from external networks.
3. Trusted locations or compliant devices can minimize the frequency of MFA prompts.
So technically, your account could be excluded from MFA, but that depends entirely on how your organization’s policies are set up.Regards,
Yugandhar.