ADF Power Query cannot evaluate Azure SQL source with system-assigned managed identity

Question

ADF Power Query cannot evaluate Azure SQL source with system-assigned managed identity

豊田明 0

Issue

In Azure Data Factory Power Query (Data Wrangling), an Azure SQL Database dataset cannot be evaluated in the Power Query Online editor.

The following error is displayed:

Credentials are invalid or missing, so this query could not be evaluated.

Goal

I want to copy multiple Microsoft Dataverse tables into Azure SQL Database and then use ADF Power Query to merge and transform those tables for use by internal reporting and mapping applications.

Configuration

Azure Data Factory
Azure SQL Database
Azure Integration Runtime with Managed Virtual Network
Managed Private Endpoint: Approved
Azure SQL public network access: Disabled
Authentication: System-assigned managed identity
Interactive authoring: Enabled
Azure SQL connector versions tested: 2.0 and 1.0

Operations that succeed

The following operations succeed with the same Azure SQL linked service and managed identity:

Linked service connection test
Copy Activity from Dataverse to Azure SQL Database
Automatic creation of the Azure SQL destination table
Writing data to the Azure SQL table
Azure SQL dataset connection test
Dataset data preview
Importing the Azure SQL table schema

The Azure SQL database user for the Data Factory system-assigned managed identity exists and has the required read and write permissions.

Operation that fails

When the Azure SQL dataset is added as a source to an ADF Power Query resource, the Power Query Online editor opens, but the source query cannot be evaluated.

The error is:

Credentials are invalid or missing, so this query could not be evaluated.

Troubleshooting already performed

Confirmed that the managed private endpoint is Approved
Confirmed that the Azure SQL linked service connection test succeeds
Confirmed that Copy Activity succeeds
Confirmed that data exists in the Azure SQL source table
Confirmed that dataset data preview succeeds
Imported the SQL table schema into the dataset
Enabled interactive authoring on the Managed VNet Azure Integration Runtime
Tested Azure SQL connector version 2.0
Tested Azure SQL connector version 1.0
Deleted and recreated the Power Query resource
Removed and re-added the source dataset
Refreshed the ADF Studio browser session

The same credentials error continues to occur only in the Power Query Online interactive evaluation.

Questions

Is an Azure SQL source using system-assigned managed identity and a Managed Private Endpoint officially supported in ADF Power Query (Data Wrangling)?
Is there a known limitation or issue where Copy Activity and dataset preview succeed, but Power Query Online reports invalid or missing credentials?
Is any additional credential, linked service, or interactive authoring configuration required for Power Query Online to use the system-assigned managed identity?
In the Power Query pipeline activity, the Managed VNet Azure Integration Runtime is not available in the "Run on Azure IR" list, and only AutoResolveIntegrationRuntime is shown. Is this expected behavior?
What is the supported configuration for using ADF Power Query while keeping Azure SQL public network access disabled?

I would like to keep system-assigned managed identity and Managed Private Endpoint authentication. I would prefer not to enable permanent public access or change to SQL authentication.

This issue is unrelated to SharePoint Online or Azure Access Control Service retirement.

SIVASANKAR YEDDULA 20 Reputation points Microsoft External Staff Moderator

2026-08-21T10:29:53.28+00:00

Hi 豊田明 ,

Thanks for reaching out to Microsoft Q&A.

Based on the troubleshooting completed, the Azure SQL connectivity and System-assigned Managed Identity appear to be working as expected. The connection test, dataset preview, Copy Activity, and schema import are successful.

As the issue occurs only when evaluating the query in Power Query Online, we recommend the following: Verify the ADF Managed Identity has the required permissions on the Azure SQL database. Confirm the Managed Private Endpoint is in Approved status. Ensure Interactive Authoring is enabled on the Managed VNet Integration Runtime. Recreate the Azure SQL source in Power Query and test again. Run the Power Query through the ADF pipeline and check whether the pipeline execution succeeds. If the pipeline execution is successful but Power Query Online still shows “Credentials are invalid or missing,” the issue is likely related to the Power Query interactive evaluation layer rather than the Azure SQL connectivity. In that scenario, we recommend raising a Microsoft Support case with the error details and pipeline run ID to confirm whether this is a known limitation or product issue.

At this stage, we do not recommend enabling public network access or switching from Managed Identity to SQL authentication.
SIVASANKAR YEDDULA 20 Reputation points Microsoft External Staff Moderator

2026-08-21T10:31:51.74+00:00

Hi 豊田明 ,

Thanks for reaching out to Microsoft Q&A.

Based on the troubleshooting completed, the Azure SQL connectivity and System-assigned Managed Identity appear to be working as expected. The connection test, dataset preview, Copy Activity, and schema import are successful.

1 answer

Your answer

SIVASANKAR YEDDULA 20 Reputation points Microsoft External Staff Moderator

2026-08-21T10:29:53.28+00:00

Hi 豊田明 ,

Thanks for reaching out to Microsoft Q&A.

Based on the troubleshooting completed, the Azure SQL connectivity and System-assigned Managed Identity appear to be working as expected. The connection test, dataset preview, Copy Activity, and schema import are successful.

As the issue occurs only when evaluating the query in Power Query Online, we recommend the following: Verify the ADF Managed Identity has the required permissions on the Azure SQL database. Confirm the Managed Private Endpoint is in Approved status. Ensure Interactive Authoring is enabled on the Managed VNet Integration Runtime. Recreate the Azure SQL source in Power Query and test again. Run the Power Query through the ADF pipeline and check whether the pipeline execution succeeds. If the pipeline execution is successful but Power Query Online still shows “Credentials are invalid or missing,” the issue is likely related to the Power Query interactive evaluation layer rather than the Azure SQL connectivity. In that scenario, we recommend raising a Microsoft Support case with the error details and pipeline run ID to confirm whether this is a known limitation or product issue.

At this stage, we do not recommend enabling public network access or switching from Managed Identity to SQL authentication.
SIVASANKAR YEDDULA 20 Reputation points Microsoft External Staff Moderator

2026-08-21T10:31:51.74+00:00

Hi 豊田明 ,

Thanks for reaching out to Microsoft Q&A.

Based on the troubleshooting completed, the Azure SQL connectivity and System-assigned Managed Identity appear to be working as expected. The connection test, dataset preview, Copy Activity, and schema import are successful.

Answer 1

Hello @豊田明

Based on the tests you've already completed, I agree that this doesn't look like a basic Azure SQL permission or Managed Identity configuration problem.

Microsoft currently lists Azure SQL Database with MSI (Managed Identity) as a supported source/authentication combination for ADF Power Query/Data Wrangling.

The interesting part of your configuration is the network path:

Azure SQL public access is disabled
SQL is reached through a Managed Private Endpoint
Copy Activity and dataset preview work
Power Query Online evaluation fails
Your Managed VNet IR isn't available under Run on Azure IR

Power Query Activity doesn't execute through exactly the same path as Copy Activity. Microsoft documents that ADF translates the Power Query M script into a data flow script and executes it using the ADF Data Flow Spark environment.

That means a successful linked-service test or Copy Activity doesn't necessarily prove that the Power Query authoring/runtime environment has the same private-network connectivity.

The Run on Azure IR behavior is particularly relevant. Microsoft documents this setting as selecting the Azure Integration Runtime that provides the Power Query compute environment. If your Managed VNet IR can't be selected and only AutoResolveIntegrationRuntime appears, I would investigate that before changing the SQL authentication method.

I would try one additional test: publish the Power Query and execute it from a pipeline, rather than relying only on interactive evaluation in the Power Query editor.

If:

Dataset Preview -> succeeds

Copy Activity -> succeeds

Power Query editor -> fails

Power Query pipeline -> succeeds

then this strongly points to an issue specifically with the Power Query interactive authoring/evaluation layer. The Microsoft moderator on this thread has suggested the same isolation test.

If the pipeline execution also fails, capture the Power Query Activity's complete error output and run ID. At that point, I'd raise a Microsoft support case and specifically ask them to verify connectivity from the Power Query/Data Flow Spark runtime to the Managed Private Endpoint, rather than simply validating the Azure SQL linked service.

I would not enable permanent public network access or switch to SQL authentication just to work around this. Azure SQL + MSI is documented as supported, and Microsoft has also advised against changing those settings at this stage.

Interestingly, similar cases have previously been reported where an Azure SQL linked service works correctly for Copy Activity but Power Query reports "invalid or missing credentials."

Sharing these references with you:

Microsoft – Data wrangling in Azure Data Factory

Microsoft – Power Query activity in Azure Data Factory

If you can share the pipeline execution result/error (with sensitive IDs removed), that should tell us whether we're dealing specifically with the Power Query editor or with the Power Query runtime/private networking path.

Please "Accept the Answer" if this information helped you. This will help us and others in the community.