Working Backwards from Error Logs: Reverse Engineering the Tableau-to-Fabric OAuth Breakdown

The article details a complex issue that arose when connecting Microsoft Tableau Desktop to Microsoft Fabric Warehouse using the Azure SQL Database connector and Microsoft Entra ID modern authentication. The error encountered, Error Code 84223ADA, translates to "User authorization failed (invalid_client)" – a message that typically indicates an unregistered client_id, a secret mismatch, or an unapproved redirect URI in OAuth 2.0 RFC 6749 specification.

However, in this case, the issue was not with the client secret or redirect URI, but rather with the underlying infrastructure.

The problem stemmed from the fact that the connection to the Fabric SQL/TDS endpoint aborted during token acquisition before any traffic reached the Microsoft Fabric endpoint. The root cause of the error was traced back to a missing service principal in the tenant directory. This service principal is required for the OAuth 2.0 handshake, and its absence led the Microsoft Entra ID to abort the token issuance process, resulting in the authentication failure.

The author explains that Tableau Desktop's native driver architecture requests dual-resource delegated scopes during modern authentication – authorization for both the Azure SQL endpoint and the underlying storage subsystem. Since the tenant directory had never instantiated the Azure Data Lake enterprise application service principal, the Entra ID service immediately aborted the OAuth handshake.

To resolve the issue, the author instanced the missing first-party Azure Data Lake service principal using Microsoft Graph PowerShell. This step allowed the OAuth 2.0 handshake to proceed successfully, enabling the Tableau Desktop client to connect to the Microsoft Fabric Warehouse without encountering the authentication error.