Excel Power Query / Azure Analysis Services: Authentication failed after reopening workbook, no Entra login prompt shown

Kateryna Kravchenko 10 Reputation points

Hi everyone,

I am experiencing an issue in Excel desktop when using Power Query to connect to an Analysis Services model with Microsoft Entra SSO. I am using SQL Server Analysis Services database connector (for Import), but the model is in Azure Analysis Services.

The first sign-in and refresh work fine. However, after I close and reopen the workbook, refresh often fails with “AnalysisServices: Authentication failed.”

What seems unexpected is that Excel does not show a sign-in prompt again. If the existing Entra session cannot be reused, I would expect the login window to appear instead of only returning an authentication error.

The only workaround I found so far is to clear/recreate the credentials in Data Source Settings, but that is only temporary.

Has anyone seen this issue with Excel + Power Query + Analysis Services using Entra SSO? Is it a known issue or related to a specific Excel build?

Thank you!

  1. Manoj Kumar Boyini 17,060 Reputation points Microsoft External Staff Moderator

    Hi Kateryna Kravchenko

    I hope you had a chance to review the information shared earlier, and I hope this information has been helpful! If you still have questions, please let us know what is needed in the comments so the question can be answered.

  2. Kateryna Kravchenko 10 Reputation points

    Hi @Manoj Kumar Boyini

    Thank you for your suggestions.

    Unfortunately this connector is not available in Excel. It only exists in Power BI Desktop, Power Apps, Fabric, and Dynamics 365. The SQL Server Analysis Services Database (Import) connector under Get Data >> From Database should be the correct one for Excel when connecting to Azure AAS.I checked the connection string in the Power Query Advanced Editor and there is no Integrated Security=SSPI present.

    Clearing cached credentials does work, but only temporarily, the issue returns every time I close and reopen the workbook.

    If I attempt to connect using the Azure SQL Database connector, I experience a completely different error:
    "Details: "Microsoft SQL: A network-related or instance-specific error occurred while establishing a connection to SQL Server. The server was not found or was not accessible. Verify that the instance name is correct and that SQL Server is configured to allow remote connections. (provider: Named Pipes Provider, error: 40 - Could not open a connection to SQL Server)""

    Regarding updating Excel, I'm on Version 2512 (Build 19530.20226) on Monthly Enterprise Channel. The newer servicing build (19530.20260) is security-only with no documented authentication fixes, and updates are managed by my organization, so I cannot trigger them manually.

    For additional context, I can connect to the same AAS model from Power BI Desktop without any issues (both Import and Live Connection), and also from Excel through the Get Data >> From Database >> From Analysis Services, which works reliably across sessions. The problem appears to be specific to Power Query's token management in Excel.

    The one thing I haven't fully tested yet is the Trust Center >> Form-based Sign-in setting, which was set to "Block all sign-in prompts." Not sure, but Power Query may rely on a form-based sign-in flow that the traditional XMLA connection doesn't use, which would explain the difference. I'll test this and update the thread

  3. Manoj Kumar Boyini 17,060 Reputation points Microsoft External Staff Moderator

    Hi Kateryna Kravchenko

    Just checking in to see if you had a chance to test the Trust Center → Form‑based sign‑in setting and whether it made any difference to the behavior after reopening the workbook.Your findings would be very helpful to confirm whether this is the underlying cause in Power Query’s authentication flow.

  4. Kateryna Kravchenko 10 Reputation points

    Hi @Manoj Kumar Boyini

    After further investigation, I believe the Trust Center Form-based Sign-in setting is unlikely to be the cause. That setting controls the legacy MS-OFBA protocol, whereas Azure Analysis Services uses modern Entra ID / OAuth2 authentication, a different flow. Additionally, my Power Query connection to Azure SQL Database (which also uses Entra OAuth2) works reliably across sessions with no credential issues, which suggests the Form-based Sign-in setting isn't blocking modern auth prompts.

    What I have found instead is that this probably appears to be version-specific. A colleague on Version 2602 on the same Monthly Enterprise Channel has no issues with the same AAS model, credentials persist and refresh works after reopening the workbook.

    Since my organization manages updates centrally, I will wait for the upgrade to 2602 to come through and test whether it resolves the issue. I will update this thread with the results once that happens.

  5. Manoj Kumar Boyini 17,060 Reputation points Microsoft External Staff Moderator

    Hi Kateryna Kravchenko

    Just checking if your Excel client has now been upgraded to Version 2602, and if so, whether you were able to retest and confirm if the issue is resolved?


Sign in to comment

2 answers

  1. Manoj Kumar Boyini 17,060 Reputation points Microsoft External Staff Moderator

    Hi Kateryna Kravchenko

    When connecting to Azure Analysis Services (AAS) with Entra ID SSO. After reopening a workbook, Excel attempts a silent token refresh. If the cached token can’t be reused, the connector may fail with “AnalysisServices: Authentication failed” without showing a sign‑in prompt. This is a client‑side limitation in Excel/MSOLAP, not an AAS service issue.

    Recommended actions:

    • Use Data → Get Data → Azure → Azure Analysis Services database instead of the SQL Server Analysis Services connector.
    • Update Excel to the latest build to get newer MSOLAP libraries with improved Entra authentication handling.
    • Ensure Integrated Security=SSPI is not present in the connection string.
    • If needed, clear cached Office/AnalysisServices credentials to force re‑authentication.
    • For unattended refresh scenarios, use a service principal instead of interactive user credentials.

    This issue typically depends on connector choice, Excel/MSOLAP version, and how Entra tokens are cached across Excel sessions.

    References:
    https://learn.microsoft.com/en-us/analysis-services/azure-analysis-services/analysis-services-connect-excel?view=sql-analysis-services-2025
    https://learn.microsoft.com/en-us/analysis-services/client-libraries?view=sql-analysis-services-2025
    https://learn.microsoft.com/en-us/analysis-services/azure-analysis-services/analysis-services-manage-users?view=sql-analysis-services-2025
    https://learn.microsoft.com/en-us/troubleshoot/sql/analysis-services/configure-msolap-data-provider-excel

    Hope this helps, Please let us know if you have any questions and concerns

    0 comments No comments

    Sign in to comment
  2. AI answer

    Excel Power Query, Azure Analysis Services, and Microsoft Entra authentication rely on the Analysis Services client libraries (AMO/MSOLAP/ADOMD). These libraries support both interactive Microsoft Entra sign-in and non‑interactive methods, and interactive flows can show a Microsoft Entra MFA dialog when Universal Authentication is used.

    For Azure Analysis Services, the recommended and most reliable option is to use Active Directory Universal Authentication (Microsoft Entra interactive flow). This method is designed to handle token acquisition and renewal, including MFA, and can show a sign‑in dialog when the existing token cannot be reused. Other non‑interactive methods (such as AD Password or Integrated) do not show a pop‑up and can fail with authentication errors when the cached token or session is no longer valid.

    In Excel, the behavior depends on:

    • Which client library and authentication mode the connector is using.
    • How the Microsoft Entra session and token cache are handled by that library and by Excel’s build/update level.

    Power BI Desktop, SSMS, and Visual Studio explicitly support Active Directory Universal Authentication and are updated monthly with the latest client libraries. Excel receives the same client library updates through Microsoft 365, but on a less frequent cadence, and some organizations use deferred channels, so Excel may be running older client libraries or slightly different behavior around token reuse and prompts.

    Given the symptoms:

    • First connection and refresh succeed.
    • After reopening the workbook, refresh fails with AnalysisServices: Authentication failed.
    • No Microsoft Entra sign‑in dialog is shown.
    • Clearing/recreating credentials in Data Source Settings temporarily fixes it.

    This aligns with a scenario where the non‑interactive or cached token path fails, but Excel does not fall back to an interactive Universal Authentication prompt.

    Recommended actions based on the documented behavior:

    1. Ensure the connection is configured to use Active Directory Universal Authentication (Microsoft Entra interactive) for Azure Analysis Services, not Windows or legacy AD methods. Universal Authentication is the recommended mode for Azure Analysis Services and is designed to show an interactive prompt when needed.
    2. Make sure the Azure Analysis Services server users are defined as Microsoft Entra accounts (UPN/organizational email) and that the account used in Excel is the same Entra identity configured as a server admin or database user.
    3. Confirm that the Excel client is on a current Microsoft 365 update channel so it has the latest Analysis Services client libraries. Older builds or deferred channels can behave differently around authentication and token reuse.
    4. If the Azure Analysis Services firewall is enabled and the error sometimes appears as invalid credentials, verify that the client IP is allowed. For Power Query Online scenarios, the PowerQueryOnline service tag must be allowlisted; for desktop, ensure the relevant client IP ranges are permitted.

    This behavior is not described in the documentation as a specific known Excel build bug, but it is consistent with using a non‑Universal or cached authentication mode that does not trigger a new Microsoft Entra prompt when the token cannot be reused. Aligning the connection with Universal Authentication and keeping Excel and the Analysis Services client libraries current is the supported path to avoid repeated manual credential clearing.


    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.
Sign in to answer

Your answer