Azure App Configuration
An Azure service that provides hosted, universal storage for Azure app configurations.
How do I resolve a token refresh error when trying to create a service principal connection to a fabric lakehouse sql endpoint
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(192, 86%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECV%3C/text%3E%3C/svg%3E)
Christopher Van Coops SH
0
Reputation points
When I attempt to create a new cloud connection in "Manage Connections and Gateways" I get an error message, "Unable to update connection credentials. It looks like the refresh token expired. Please go to this dataset's settings page, and reenter the credentials for the data source."
I'm using service principal authentication when it fails. If I use my own credentials with OAuth 2.0, it works fine. I cannot figure out what I did wrong in setting up the service principal or what to do to resolve it.
Azure App Configuration
{count} votes
-
Raja Pothuraju 32,395 Reputation points Microsoft External Staff Moderator2025-08-25T19:52:14.8466667+00:00 Hello Christopher Van Coops SH, As per the error message you mentioned:
"Unable to create connection for the following reason: It looks like the refresh token expired. Please go to this dataset's settings page and reenter the credentials for the data source."
This issue can occur if the connectivity settings are not configured correctly.
For connecting to Fabric Lakehouse through a proxy or firewall, the required FQDNs must be allowed, as outlined here: 🔗 Add Fabric URLs to your allowlist - Microsoft Learn
Additionally:
- Port 1433 must be open.
- Allowing FQDNs alone is not sufficient. You also need to allow Power BI service tags for proper access. Details are documented here: 🔗 Allow Power BI Service Tags through firewall
To ensure reliable connectivity, download and whitelist the full range of IPs under the Power BI Service tag. These can change over time, so it’s recommended to automate updates from Microsoft’s published ranges.
You can obtain them here:
- Service tags in JSON format: Download JSON
- Automate via PowerShell: Service Tags overview
For more information: Power BI Service Tags
Since your request is more related to Microsoft Fabric, we recommend posting your query in the dedicated Microsoft Fabric Community Forum under the General Discussion section. Experts and moderators are available there to provide assistance and guidance. You can access the community at https://community.fabric.microsoft.com/.
-
Christopher Van Coops SH 0 Reputation points
2025-08-25T20:18:56.28+00:00 Thank you so much for your response Raja. I'm doing this completely within my Fabric environment so I don't believe proxies or firewalls are involved here. It only fails if I use a service principal for authentication. If I use my user credentials, it works fine. I will repost on the Fabric community forum as you suggested.
Sign in to comment
Sign in to answer