Google BigQuery (Microsoft Entra ID): "Invalid connection credentials" (400) from Manage connections

Google BigQuery (Microsoft Entra ID): "Invalid connection credentials" (400) from Manage connections and gateways — identical connection works via Dataflow Gen2; sign-in logs show the service never requests the connector token

TL;DR: Creating a Google BigQuery (Microsoft Entra ID) cloud connection from Manage connections and gateways always fails with 400 "Invalid connection credentials". The identical configuration succeeds via the Get data dialog in a Dataflow Gen2, and that connection loads BigQuery data fine. Entra sign-in logs show the failing path never requests a token for the connector resource before returning the error. I've verified every other layer manually (details below). This looks like a bug in the connections page's credential validation for the GoogleBigQueryAad source. Diagnostic Session IDs / Request IDs are available on request via private message.

Setup (verified against both the Microsoft connector docs and Google's Power BI workforce federation guide)

• Google Workforce Identity Federation: workforce pool + OIDC provider (location global), issuer https://sts.windows.net/<TENANT_ID>/, client ID https://analysis.windows.net/powerbi/connector/GoogleBigQuery, web-sso-response-type=id-token, assertion-claims-behavior=only-id-token-claims, attribute mapping google.subject=assertion.sub, provider state ACTIVE, detailed audit logging enabled
• Power BI tenant setting Google BigQuery SSO: Enabled
• IAM: roles/serviceusage.serviceUsageConsumer, roles/bigquery.user, roles/bigquery.dataViewer granted to the workforce pool on the billing project
• User: native tenant member (not a guest), no conditional access beyond Security Defaults, MFA available

What fails

Manage connections and gateways → New connection → Google BigQuery (Microsoft Entra ID) → Billing Project ID set → Advanced options → Audience Uri //iam.googleapis.com/locations/global/workforcePools/<POOL_ID>/providers/<PROVIDER_ID> → Authentication OAuth 2.0, fresh interactive sign-in → Create:

Unable to create connection for the following reason: Invalid connection credentials. Status code: 400 — "The credentials provided for the GoogleBigQueryAad source are invalid."

Reproduced with: implementation default and 2.0; Use Storage API on/off; brand-new connection names; all prior connections to the source deleted first; incognito window with full re-sign-in. Cluster region us2. Exact Session/Request IDs and timestamps available via PM.

What works (same tenant, same user, same parameters, same day)

Dataflow Gen2 → Get data → Google BigQuery (Microsoft Entra ID) → same Billing Project ID and Audience Uri (entered in Advanced options) → new connection → Organizational account sign-in → connection created, navigator lists projects and datasets, table data loads.

Why I believe it's the connections page, not configuration

1. Entra sign-in logs (interactive + non-interactive, exported for the exact failure windows): during failing attempts, the only activity is the "Power BI Data Refresh" first-party app acquiring tokens for the "Power BI Service" resource (all successful). There are zero token requests — successful or failed — for https://analysis.windows.net/powerbi/connector/GoogleBigQuery. The 400 is returned without the service ever attempting the token acquisition that the federation flow requires.
2. Entra can issue that token: a manual OAuth device-code flow with scope https://analysis.windows.net/powerbi/connector/GoogleBigQuery/.default returns a valid v1 JWT with the correct aud, iss, and sub claims for the same user.
3. Google accepts that token: manually exchanging the JWT at https://sts.googleapis.com/v1/token against the workforce pool provider returns a Google access token that successfully calls the BigQuery API and reads data.
4. Google Cloud org-level STS audit logs (detailed audit logging enabled on the provider): no inbound token-exchange attempts at the times the connections page fails — confirming the request never leaves Microsoft's side.

Two related symptoms on the same page

• The working, dataflow-created connections are displayed as "Offline" in Manage connections and gateways — while they demonstrably load BigQuery data in a dataflow at the same time. The page's status check appears to rely on the same broken validation path.
• Minor, possibly separate: with a working connection, the default (ODBC) implementation's navigator does not list my project (only bigquery-public-data); switching to Implementation = "2.0" (ADBC) lists the project and loads data. Same credential, same IAM roles, different enumeration result per driver.

Ask

Could someone from the community support team route this to the product team? Server-side logs for the failing requests should show where the connections page's credential validation for GoogleBigQueryAad short-circuits before initiating the OIDC token acquisition. I can provide via private message: Session IDs, Request IDs, exact UTC timestamps, sign-in log exports, GCP audit-log queries, and screenshots. The environment is a test tenant and the issue is reproducible on demand.

This looks architecturally similar to a previously confirmed bug where the manage-gateways/dataset-settings page failed Google BigQuery credential updates while Desktop and dataflows worked ("Not able to Add Credentials to Google BigQuery", ~2022, fixed with "fix for manage gateways and dataset settings page is checked in").