You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The advantage of this approach (versus the tenant-wide solution) is that this solution is very targeted. It provisions only the **Power Query** service principal, but no other permission changes are made to the tenant.
Copy file name to clipboardExpand all lines: support/power-platform/power-automate/desktop-flows/troubleshoot-ui-flow-invalid-credentials-error-using-aad-account.md
+37-17Lines changed: 37 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,13 +1,15 @@
1
1
---
2
2
title: Desktop flow invalid credentials error when using a Microsoft Entra account
3
-
description: Resolves the InvalidConnectionCredentials or WindowsIdentityIncorrect error that occurs when you run a desktop flow using a Microsoft Entra account.
4
-
ms.reviewer: guco，aartigoyle
3
+
description: Learn how to resolve InvalidConnectionCredentials, WindowsIdentityIncorrect, and AADSTS50126 errors in Power Automate desktop flows caused by Microsoft Entra account issues.
# Desktop flow invalid credentials error when you use a Microsoft Entra account
9
9
10
-
This article provides a resolution for the `InvalidConnectionCredentials` or `WindowsIdentityIncorrect` error code that occurs when you run a desktop flow using a [Microsoft Entra account](/entra/fundamentals/whatis#terminology).
10
+
This article provides resolutions for the `InvalidConnectionCredentials` or `WindowsIdentityIncorrect` errors that might occur when you run a desktop flow using a [Microsoft Entra account](/entra/fundamentals/whatis#terminology). These errors typically indicate issues with device join status, account synchronization, or credential mismatches between the desktop flow connection and the target machine.
11
+
12
+
This article also covers the `AADSTS50126` error, which occurs when credential validation fails because of an invalid username or password, particularly in scenarios involving federated users.
11
13
12
14
_Applies to:_ Power Automate
13
15
_Original KB number:_ 4555623
@@ -34,15 +36,20 @@ When you run a desktop flow using a Microsoft Entra account, it fails with the `
34
36
}
35
37
```
36
38
39
+
You might also receive the following error message:
40
+
41
+
> AADSTS50126: Error validating credentials due to invalid username or password
42
+
37
43
## Cause
38
44
39
45
You might encounter the error when using a Microsoft Entra account for several reasons:
40
46
41
-
- The account credentials entered into the connection might not match those on the machine.
42
-
- The device might not be [Microsoft Entra joined](/entra/identity/devices/concept-directory-join) or [Microsoft Entra hybrid joined](/entra/identity/devices/concept-hybrid-join) to support [Microsoft Entra authentication](/entra/identity/authentication/overview-authentication).
43
-
- The Microsoft Entra account might not be synchronized to the machine.
47
+
- You enter account credentials into the connection that don't match the credentials on the machine.
48
+
- The device isn't [Microsoft Entra joined](/entra/identity/devices/concept-directory-join) or [Microsoft Entra hybrid joined](/entra/identity/devices/concept-hybrid-join) to support [Microsoft Entra authentication](/entra/identity/authentication/overview-authentication).
49
+
- The Microsoft Entra account isn't synchronized to the machine.
50
+
- The user account attempting to connect is a [federated user (ADFS)](/windows-server/identity/ad-fs/ad-fs-overview) while the tenant is configured to run on Microsoft Entra ID.
44
51
45
-
## Resolution
52
+
## Solution
46
53
47
54
1. Ensure that the device is Microsoft Entra joined or domain-joined:
48
55
@@ -54,31 +61,44 @@ You might encounter the error when using a Microsoft Entra account for several r
54
61
55
62
Make sure that one of the `DomainJoined` or `AzureAdJoined` values is `YES`.
56
63
57
-
If this isn't the case, a Microsoft Entra account can't be used unless the device is joined. For more information, see [How to join a device](/azure/active-directory/user-help/user-help-join-device-on-network#to-join-an-already-configured-windows-10-device).
64
+
If this condition isn't true, you can't use a Microsoft Entra account unless the device is joined. For more information, see [How to join a device](/azure/active-directory/user-help/user-help-join-device-on-network#to-join-an-already-configured-windows-10-device).
58
65
59
-
2. Identify the Microsoft Entra account to use in the machine configuration:
66
+
1. Identify the Microsoft Entra account to use in the machine configuration:
60
67
61
68
1. Open **Settings** and select **Accounts**.
62
69
63
-
2. Select **Access work or school**.
70
+
1. Select **Access work or school**.
64
71
65
-
3. Make sure you see text like "Connected to <your_organization> Microsoft Entra ID." The account it's connected to can be used in the connection.
72
+
1. Make sure you see text like "Connected to <your_organization> Microsoft Entra ID." The account it's connected to can be used in the connection.
66
73
67
-
3. Synchronize the Microsoft Entra account on the device:
74
+
1. Synchronize the Microsoft Entra account on the device:
68
75
69
76
1. Select the **Info** button when selecting your Microsoft Entra connection on the **Access work or school** page.
70
77
71
-
2. This will open a page that describes your connection information and device synchronization status. Select the **Sync** button at the end of the page, and wait for this process to complete.
78
+
1. This action opens a page that describes your connection information and device synchronization status. Select the **Sync** button at the end of the page, and wait for this process to complete.
79
+
80
+
1. Verify that the configured Microsoft Entra account can sign in to the device:
81
+
82
+
1. Try to sign in to the machine by using the Microsoft Entra account you identified in step 2.
83
+
1. The device authentication must be successful to use the account in a connection.
84
+
85
+
1. Make sure the flow is configured properly with the right username and password. This information must match the account on your computer.
86
+
87
+
### AADSTS50126 error
88
+
89
+
To resolve an AADSTS50126 error, the preferred and most secure method is to configure [Certificate-Based Authentication (CBA)](/power-automate/desktop-flows/configure-certificate-based-auth).
90
+
91
+
If you can't configure CBA, federated users can use an alternative approach when administrators of the on-premises Identity Provider (IdP) configure [password hash synchronization](/entra/identity/hybrid/connect/whatis-phs) (PHS) to synchronize password hashes to the cloud. In this scenario, federated users can authenticate directly against Microsoft Entra ID (ESTS) by configuring a [Home Realm Discovery](/entra/identity/enterprise-apps/home-realm-discovery-policy) (HRD) policy that explicitly allows cloud password validation.
72
92
73
-
4. Verify that the configured Microsoft Entra account can sign in to the device:
93
+
To enable this configuration, set the following HRD policy value:
74
94
75
-
1. Try to sign in to the machine using the Microsoft Entra account identified in step 2.
76
-
2. The device login must be successful in order to be used in a connection.
95
+
`"AllowCloudPasswordValidation": true`
77
96
78
-
5. Make sure the flow is configured properly with the right username and password. This must match the account on your computer.
97
+
For detailed instructions, see [Enable direct ROPC authentication of federated users for legacy applications](/entra/identity/enterprise-apps/home-realm-discovery-policy#enable-direct-ropc-authentication-of-federated-users-for-legacy-applications).
Copy file name to clipboardExpand all lines: support/sql/database-engine/connect/tls-exist-connection-closed.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -91,7 +91,7 @@ To resolve the issue, follow these steps:
91
91
1. Select the **Certificate** tab and follow the relevant step:
92
92
- If a certificate is displayed, select **View** to examine the Thumbprint algorithm to confirm whether it's using a weak-hash algorithm. Then, select **Clear** and go to step 4.
93
93
- If a certificate isn't displayed, review the SQL Server error log for an entry that resembles the following and note down the hash or thumbprint value:
94
-
`2017-05-30 14:59:30.89 spid15s The certificate [Cert Hash(sha1) "B3029394BB92AA8EDA0B8E37BAD09345B4992E3D"] was successfully loaded for encryption`
94
+
`2017-05-30 14:59:30.89 spid15s The certificate [Cert Hash(sha1) "AA11BB22CC33DD44EE55FF66AA77BB88CC99DD00"] was successfully loaded for encryption`
95
95
1. Use the following steps to remove server authentication:
96
96
1. Select **Start** > **Run**, and type *MMC*. (MMC also known as the Microsoft Management Console.)
97
97
1. In MMC, open the certificates and select **Computer Account** in the **Certificates** snap-in screen.
IF EXISTS( SELECTDs.DataSourceIDFROM tbl_IM_DataSource Ds JOIN tbl_PRM_LogicalReplica Lr ONDs.DataSourceId=Lr.DataSourceIdWHEREDs.AppId='18BEE66C-826F-4499-A663-9805C8688AD3')
15
+
IF EXISTS( SELECTDs.DataSourceIDFROM tbl_IM_DataSource Ds JOIN tbl_PRM_LogicalReplica Lr ONDs.DataSourceId=Lr.DataSourceIdWHEREDs.AppId='00001111-aaaa-2222-bbbb-3333cccc4444')
16
16
PRINT 'VMware DataSource in Active/Inactive protected state'
17
-
ELSE IF EXISTS ( SELECT DataSourceID FROM tbl_IM_DataSource WHERE CloudProtectionStatus!=0AND AppId='18BEE66C-826F-4499-A663-9805C8688AD3')
17
+
ELSE IF EXISTS ( SELECT DataSourceID FROM tbl_IM_DataSource WHERE CloudProtectionStatus!=0AND AppId='00001111-aaaa-2222-bbbb-3333cccc4444')
18
18
PRINT 'VMware DataSource in Cloud are Active/Inactive protected state'
19
19
ELSE
20
20
PRINT 'All VMware datasource protections are removed'
@@ -102,7 +102,7 @@ ELSE
102
102
END
103
103
DROPTABLE#serverIdTable3
104
104
105
-
SELECT DatasourceID INTO #datasourceIdTable2 FROM dbo.tbl_IM_DataSource WHERE AppId='18BEE66C-826F-4499-A663-9805C8688AD3'
105
+
SELECT DatasourceID INTO #datasourceIdTable2 FROM dbo.tbl_IM_DataSource WHERE AppId='00001111-aaaa-2222-bbbb-3333cccc4444'
106
106
DECLARE @datasourceId2 nvarchar(100)
107
107
WHILE exists ( SELECT*FROM#datasourceIdTable2 )
108
108
BEGIN
@@ -114,7 +114,7 @@ ELSE
114
114
END
115
115
DROPTABLE#datasourceIdTable2
116
116
117
-
Deletefrom tbl_IM_DataSource where AppId='18BEE66C-826F-4499-A663-9805C8688AD3'
117
+
Deletefrom tbl_IM_DataSource where AppId='00001111-aaaa-2222-bbbb-3333cccc4444'
Copy file name to clipboardExpand all lines: support/system-center/scom/regular-expression-support.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -129,7 +129,7 @@ You can use comparison operators when you construct a criteria expression. The v
129
129
|MATCHES|Evaluates to **true** if the left operand matches the regular expression defined by the right operand.|`Name MATCHES 'SQL*05'`<br/> Evaluates to **true** if the `Name` value is **SQL2005**. |
130
130
|IS NULL|Evaluates to **true** if the value of the left operand is null.|`ConnectorId IS NULL`<br/> Evaluates to **true** if the `ConnectorId` property doesn't contain a value. |
131
131
|IS NOT NULL|Evaluates to **true** if the value of the left operand isn't null.|`ConnectorId IS NOT NULL`<br/> Evaluates to **true** if the `ConnectorId` property contains a value. |
132
-
|IN|Evaluates to **true** if the value of the left operand is in the list of values defined by the right operand.<br/><br/>**Note** The **IN** operator is valid for use only with properties of type [Guid](/dotnet/api/system.guid).|`Id IN ('080F192C-52D2-423D-8953-B3EC8C3CD001', '080F192C-53B2-403D-8753-B3EC8C3CD002')`<br/>Evaluates to **true** if the value of the `Id` property is one of the two globally unique identifiers provided in the expression. |
132
+
|IN|Evaluates to **true** if the value of the left operand is in the list of values defined by the right operand.<br/><br/>**Note** The **IN** operator is valid for use only with properties of type [Guid](/dotnet/api/system.guid).|`Id IN ('aaaabbbb-0000-cccc-1111-dddd2222eeee', 'bbbbcccc-1111-dddd-2222-eeee3333ffff')`<br/>Evaluates to **true** if the value of the `Id` property is one of the two globally unique identifiers provided in the expression. |
133
133
|AND|Evaluates to **true** if the left and right operands are both true.|`Name = 'SQL%' AND Description LIKE 'MyData%'`|
134
134
|OR|Evaluates to **true** if either the left or right operand is true.|`Name = 'SQL%' OR Description LIKE 'MyData%'`|
135
135
|NOT|Evaluates to **true** if the right operand isn't true.|`NOT (Name = 'IIS' OR Name = 'SQL')`|
![learn-build-service-prod[bot]](https://avatars.githubusercontent.com/in/237442?v=4&size=40){kind=avatar}
0 commit comments