Failed to update data source credentials: The credentials provided for the Fhir source are invalid.

[harikrishna_m]

I have been trying to Connect to my FHIR data connector but seeing this error,

i am trying to connect to the data source from my datflow gen1 and its giving me 400 error even though i have fhir data reader access for my Azure API for FHIR, any idea why this is happening? 
in the data connections section this is listed under cloud. does it still require some on prem gateway to connect to powerBI?

[v-ssriganesh]

Hello @harikrishna_m,

May I ask if you have resolved this issue? If so, please mark it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[harikrishna_m]

i have been trying to figure out more on this and have narrowed down the issue being that the azure API for FHIR is in tenant A with a private endpoint and PowerBI with fabric capacity SKU:F64 license is in Tenant B. 
I feel because of the resources being two separate tenants might be causing the issue, is there any suggestions on how i can solve this?

I do have seen some documentations to chose virtual network manager for cross tenant communication.

there is also a suggestion to use an Azure Function or API Management in Tenant A as a proxy, with a public endpoint, that authenticates and forwards requests to the private FHIR API but not sure if this safe on the security standpoint. 

[v-ssriganesh]

Hello @harikrishna_m,
Thank you for providing an update on the issue.

The fact that you only see Dataflow Gen1 and not Dataflow Gen2 when creating a new item indicates that Dataflow Gen2 is likely disabled at the tenant or capacity level. Here’s how to enable it:

• A Fabric tenant admin should go to the Microsoft Fabric Admin Portal >>navigate to Tenant Settings and look for a setting like "Enable Dataflow Gen2 " or "Allow Preview Features." Ensure it’s enabled for your organization or security group.
• Also, check the Capacity Settings for your F64 capacity in the Admin Portal. Under workload or feature settings, ensure Dataflow Gen2 is enabled.

You’ve correctly identified that the cross-tenant setup is causing the connectivity issue. The Azure API for FHIR in Tenant A uses a private endpoint, so Fabric in Tenant B cannot access it directly. Please consider the below option:

• Deploy an Azure Function or API Management (APIM) instance in Tenant A with a public endpoint. The Function/APIM authenticates with the FHIR API (using OAuth 2.0) within Tenant A and accesses it over the private endpoint. Fabric in Tenant B then connects to this public endpoint.

I trust this information proves useful. If it does, kindly “Accept as solution” and give it a 'Kudos' to help others locate it easily.
Thank you.

[v-ssriganesh]

Hi @harikrishna_m,

Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to @BhavinVyas3003 & @Poojara_D12  for sharing valuable insights.

Could you please confirm if your query has been resolved by the provided solution? If so, please mark it as the solution. This will help other community members solve similar problems faster.

Thank you.

[BhavinVyas3003]

Power BI Dataflow Gen1 cannot authenticate to Azure API for FHIR because it doesn’t support OAuth2/Azure AD token-based auth hence the 400 error even with FHIR Data Reader access.

You can work on either of these options.

1. Use Dataflow Gen2 (Fabric):

• Supports Azure AD / OAuth2
• Use Organizational Account or Service Principal
• Assign correct FHIR roles (Data Reader or Contributor)
• No on-prem gateway needed

1. Use an Azure Function or API App as a proxy:

• Function handles AAD token and calls FHIR API
• Power BI Dataflow Gen1 connects to the function using Basic or Anonymous auth
• Returns JSON to Power Query

[harikrishna_m]

Hi Bhavin,

Thank you for sharing your valuable information,

I dint know that dataflow gen1 does not support OAuth2/AzureAD is there any MS documentation that i could refer to? i did try to save the dataflow gen1 file to gen2 and was seeing the below error,

i am guessing there is some changes need to be done in fabric capacity? we do have a fabric capacity with sku:F64.

[BhavinVyas3003]

Use https://app.fabric.microsoft.com, open a Fabric workspace (like with SKU F64), and create the Dataflow Gen2 from there. don’t use “Save As Gen2” from Gen1 and check once.

[harikrishna_m]

my current workspace where i am facing issues does have a fabric capacity with sku:F64 and when i am trying to create any new item, i can only see dataflow gen1,

 is there enabling to be done on the tenant side to allow dataflow gen2?

[BhavinVyas3003]

Please refer this link for prerequisites,

https://learn.microsoft.com/en-us/fabric/data-factory/create-first-dataflow-gen2?utm_source=chatgpt....

[Poojara_D12]

Hi @harikrishna_m 

The error you're encountering—“Failed to update data source credentials” with a 400 (Bad Request) status code—typically indicates that the authentication method or token used to access your Azure FHIR API is invalid or not accepted by the endpoint. Even though you have FHIR Data Reader permissions on the Azure API for FHIR, Power BI (especially through Dataflow Gen1) requires the correct OAuth2 credential flow and authentication header setup, which must match what the FHIR API expects. From your screenshot, it looks like you're trying to authenticate using Organizational account, which relies on Azure Active Directory (AAD) to provide a token. If this isn't correctly configured—for instance, if the service principal or user identity used doesn't have explicit API permissions in Azure or the correct audience scope—then the call to the FHIR API will fail.

Additionally, since your data connection is marked as cloud, no on-premises gateway is needed for this connection—Azure FHIR APIs are fully cloud-based and support direct HTTP(S) access. The issue is almost certainly related to token acquisition or permission misalignment rather than network routing.

To resolve this, ensure:

The Azure API for FHIR instance is configured to allow AAD authentication, and your user or app has the right FHIR roles (FHIR Data Reader alone may not be enough; you may need FHIR Contributor depending on what the dataflow is trying to do).

The client application ID Power BI is using to authenticate (if using service principal) is registered in Azure AD with proper API permissions.

You’re using the correct authentication method in Power BI’s dataflow connection—some FHIR endpoints require a specific aud (audience) in the token which must be configured in the Azure App Registration.

Lastly, review the FHIR API’s diagnostics logs in Azure and the Activity ID from Power BI’s error message in Azure Monitor to get exact information on what part of the request is being rejected.

[harikrishna_m]

Hi Poojara,

Thank you sharing valuable soultions,

I did run checks of the solutions you provided but still seeing the same error.
@BhavinVyas3003 suggested that dataflow gen1 does not support OAuth2/AD. 
Currently still trying to figure out what am i missing.