Forum Discussion
Failed to update data source credentials: The credentials provided for the Fhir source are invalid.
Hello harikrishna_m,
Thank you for providing an update on the issue.
The fact that you only see Dataflow Gen1 and not Dataflow Gen2 when creating a new item indicates that Dataflow Gen2 is likely disabled at the tenant or capacity level. Here’s how to enable it:- A Fabric tenant admin should go to the Microsoft Fabric Admin Portal >>navigate to Tenant Settings and look for a setting like "Enable Dataflow Gen2 " or "Allow Preview Features." Ensure it’s enabled for your organization or security group.
- Also, check the Capacity Settings for your F64 capacity in the Admin Portal. Under workload or feature settings, ensure Dataflow Gen2 is enabled.
You’ve correctly identified that the cross-tenant setup is causing the connectivity issue. The Azure API for FHIR in Tenant A uses a private endpoint, so Fabric in Tenant B cannot access it directly. Please consider the below option:
- Deploy an Azure Function or API Management (APIM) instance in Tenant A with a public endpoint. The Function/APIM authenticates with the FHIR API (using OAuth 2.0) within Tenant A and accesses it over the private endpoint. Fabric in Tenant B then connects to this public endpoint.
I trust this information proves useful. If it does, kindly “Accept as solution” and give it a 'Kudos' to help others locate it easily.
Thank you.
The error you're encountering—“Failed to update data source credentials” with a 400 (Bad Request) status code—typically indicates that the authentication method or token used to access your Azure FHIR API is invalid or not accepted by the endpoint. Even though you have FHIR Data Reader permissions on the Azure API for FHIR, Power BI (especially through Dataflow Gen1) requires the correct OAuth2 credential flow and authentication header setup, which must match what the FHIR API expects. From your screenshot, it looks like you're trying to authenticate using Organizational account, which relies on Azure Active Directory (AAD) to provide a token. If this isn't correctly configured—for instance, if the service principal or user identity used doesn't have explicit API permissions in Azure or the correct audience scope—then the call to the FHIR API will fail.
Additionally, since your data connection is marked as cloud, no on-premises gateway is needed for this connection—Azure FHIR APIs are fully cloud-based and support direct HTTP(S) access. The issue is almost certainly related to token acquisition or permission misalignment rather than network routing.
To resolve this, ensure:
The Azure API for FHIR instance is configured to allow AAD authentication, and your user or app has the right FHIR roles (FHIR Data Reader alone may not be enough; you may need FHIR Contributor depending on what the dataflow is trying to do).
The client application ID Power BI is using to authenticate (if using service principal) is registered in Azure AD with proper API permissions.
You’re using the correct authentication method in Power BI’s dataflow connection—some FHIR endpoints require a specific aud (audience) in the token which must be configured in the Azure App Registration.
Lastly, review the FHIR API’s diagnostics logs in Azure and the Activity ID from Power BI’s error message in Azure Monitor to get exact information on what part of the request is being rejected.
Hi Poojara,
Thank you sharing valuable soultions,
I did run checks of the solutions you provided but still seeing the same error.
BhavinVyas3003 suggested that dataflow gen1 does not support OAuth2/AD.
Currently still trying to figure out what am i missing.
