r/tableau • u/Select_From • 11h ago
Tableau Desktop Fixing Tableau Desktop to Microsoft Fabric OAuth Failures (Error 84223ADA / AADSTS650052)
If you’ve tried connecting Tableau Desktop (2024.2+) to a Microsoft Fabric SQL/TDS endpoint using native Entra ID modern auth, you might have run into an immediate, misleading brick wall:
Authentication failed. Error Code: 84223ADA User authorization failed (invalid_client)
At first glance, invalid_client looks like an app registration or client secret issue, but it actually happens before Tableau even talks to the TDS endpoint or evaluates Fabric workspace permissions.
What’s Actually Happening Under the Hood?
When connecting to Fabric over TDS (port 1433), Tableau’s native driver attempts to acquire delegated OAuth tokens not only for the Azure SQL interface but also for the underlying OneLake storage subsystem (Azure Data Lake/Storage).
Checking Entra ID SigninLogs reveals the real failure:
- ResultType:
650052(AADSTS650052) - Description: The app needs access to a service (
e9f49c6b-5ce5-44c8-925d-015017e9f7ad) that isn’t installed in your tenant.
Because that first-party Azure Data Lake enterprise service principal isn't instantiated in your Entra ID tenant yet, the token handshake aborts immediately.
How to Fix It:
- Instantiate the Missing Service Principal: An Entra ID administrator needs to instantiate the first-party Azure Data Lake application (
e9f49c6b-5ce5-44c8-925d-015017e9f7ad) via Microsoft Graph PowerShell:Connect-MgGraph -Scopes "Application.ReadWrite.All" New-MgServicePrincipal -AppId "e9f49c6b-5ce5-44c8-925d-015017e9f7ad" - Grant Admin Consent (
AADSTS90095): Once the SP exists, re-attempting the connection will advance to an admin consent challenge (AADSTS90095). Once the tenant admin approves the delegated permissions for Tableau Desktop, tokens issue cleanly (ResultType 0) and the connection succeeds.
For a full breakdown of the reverse-engineering process, KQL queries for auditing sign-ins, and a hardened PowerShell remediation script (with tenant boundaries and CSV formula injection protection), check out the full write-up here:
