"The credentials provided are invalid" in the Power BI service means Power BI can no longer sign in to one of your data sources with the credentials it has saved. Usually a password changed, a sign-in token expired, the person who saved the credentials left, or the wrong sign-in method was picked. To fix it, open the semantic model's settings, expand Data source credentials, select Edit credentials on the source with the warning, and sign in again. If the source goes through a gateway, update the credentials on the gateway connection instead.
Where Power BI keeps credentials
This is the part that confuses people. Credentials live in different places depending on the source:
- Cloud sources (SharePoint Online, Azure SQL Database, Dynamics 365, most online services): in the semantic model's settings, under Data source credentials. No gateway is involved.
- On-premises sources (a SQL Server in your office, files on a network drive): on the gateway connection, under Settings, then Manage connections and gateways.
- Personal mode gateway: in the semantic model's Data source credentials, like a cloud source.
Credentials you type into Power BI Desktop don't travel with the file when you publish. You always have to enter them again in the service.
Common causes and fixes
A password changed
If the source signs in with a username and password (a SQL login, a service account, a database user), and someone changed that password, every model using it breaks at the next refresh. Edit the credentials in the right place from the list above and enter the new password.
To stop this from happening again, use an account that doesn't expire on a schedule for data connections, and write down every model and gateway connection that uses it.
A sign-in token expired
Sources that use your Microsoft 365 sign-in (called OAuth2 in the credentials screen) rely on a token that expires. Power BI normally renews it in the background, but it can stop working after a password reset, a multi-factor authentication change, or an admin revoking sessions. Signing in again under Edit credentials fixes it.
For SharePoint Online, Microsoft notes that you need to use the same account you use to sign in to Power BI. Connecting to a source in a different Microsoft 365 tenant with OAuth2 isn't supported.
The person who set it up left
Credentials are saved per person. When the model's owner leaves and their account is disabled, refresh fails. Another workspace member with the right permissions can take over the model from its settings and then enter their own credentials for each source.
Plan for this before it happens: have models owned by a shared account or by someone who isn't about to leave, and keep a list of which accounts every data source uses.
The wrong authentication method
The Edit credentials screen asks for an authentication method: Basic (username and password), OAuth2 (your Microsoft 365 sign-in), Windows, Anonymous or Key. Picking the wrong one produces "credentials are invalid" even when the password is right. Match the method to how the source actually signs people in. A SharePoint list uses OAuth2. A SQL Server login uses Basic. A web API with a key uses Key or Anonymous with the key in the query.
Check the privacy level in the same screen too. Power BI Desktop doesn't publish privacy settings, so you have to set them again in the service, and a mismatch can block a refresh that combines two sources.
"Access to the resource is forbidden"
This one is often an old sign-in cached in your browser rather than a real permissions problem. Microsoft's fix: clear your browser cache, sign in to Power BI again, and then go to https://app.powerbi.com?alwaysPromptForContentProviderCreds=true, which forces Power BI to ask for fresh credentials.
If it still fails, the account really doesn't have access to that data. Check permissions on the source itself.
"GatewayNotReachable" when saving credentials
If you see this while setting credentials on a gateway source, the gateway is usually out of date or offline. Update it to the latest version and try again. Our post on gateway disconnects covers the rest.
"You cannot schedule refresh for this semantic model"
The full message says the model "gets data from sources that currently don't support refresh." Either the connector isn't supported for refresh in the service, or the query builds its connection address on the fly (a dynamic data source). Check the source in Power BI Desktop under Transform data, then Data source settings, and compare it against Microsoft's list of supported sources. A dynamic query usually needs a small rewrite so the base address stays fixed.
After you fix it
- Run Refresh now and watch the refresh history to confirm it works.
- If the scheduled refresh was disabled after repeated failures, turn it back on under Refresh, then Schedule refresh.
- Add yourself or a shared mailbox to the refresh failure emails in the model's settings, so the next failure doesn't go only to someone who left.
If refresh still fails and the error isn't about credentials, work through our list of 7 causes of a failed scheduled refresh.
When to call someone
Re-entering credentials takes two minutes. It's worth getting help when you don't know which account a source was set up with, when the owner has left and nobody has access, when a gateway is involved and the error keeps coming back, or when several models broke at once after an IT change.
For one broken model, our $299 Power BI fix gets a senior consultant on it, and you don't pay if we can't fix it. If you'd like your data connections set up so this stops happening, see Power BI advisory.
Sources: Microsoft Learn, Data refresh in Power BI, Troubleshoot refresh scenarios, Troubleshooting unsupported data source for refresh.