Multi-Factor Authentication (MFA) prompts that break background refreshes occur when automated tasks, VBA macros, or Power Query background threads attempt to query a database secured by Microsoft Entra ID (formerly Azure Active Directory) without an active, non-interactive authentication session. Because background refresh worker threads execute silently in isolated processes without a graphical user interface, they cannot render interactive browser login windows or mobile authenticator prompts. When the stored security token expires or requires re-validation, the background process halts or fails immediately.
Quick Answer
To fix MFA prompts breaking background refreshes, open Excel and go to Data > Queries & Connections, right-click the query, select Properties, and uncheck Enable background refresh. For fully unattended automation (such as scheduled tasks or command-line scripts), replace interactive user accounts with a non-interactive Microsoft Entra Service Principal or a dedicated SQL database login.
Why MFA Breaks Background Data Operations
When you connect Excel or Power Query to Azure SQL Database or an on-premises database using modern cloud authentication (such as Microsoft Account or Organizational Account), the connection relies on OAuth 2.0 access tokens. These tokens are designed to expire regularly.
When a token expires during a normal interactive session, Excel displays a small sign-in dialog asking you to confirm your identity via SMS, the Microsoft Authenticator app, or a FIDO2 security key. However, background operations run on secondary worker threads (Microsoft.Mashup.Container.NetFX45.exe) that intentionally lack user-interface hooks.
When a background thread encounters an authentication challenge:
- It cannot spawn the interactive browser popup.
- The authentication challenge times out or throws an access denied exception.
- Excel reports a silent failure or displays an error stating that the background refresh failed.
If this occurs within an automated workbook that runs unattended, the entire scheduled report pipeline stops working. To review broader connection breakages, see Troubleshooting SQL Connection Failures: Fixing ODBC and Provider Errors.
Step-by-Step Fixes
Method 1: Force Foreground Refresh in Query Properties
If you are working directly in Excel and want to prevent refreshes from failing silently while you work, disabling background execution forces authentication requests into the main Excel thread where interactive MFA popups can appear.
- In Excel, go to the Data tab.
- Click Queries & Connections to display the side pane.
- Right-click the affected SQL or Power Query connection and select Properties.
- In the Usage tab, locate the Refresh control section.
- Uncheck the box labeled Enable background refresh.
- Click OK.
When you click Refresh All, Excel will pause the grid momentarily. If your MFA token has expired, Excel will display the Microsoft sign-in window in the foreground, allowing you to approve the notification on your phone before the data loads.
If turning off background refresh triggers a different failure code, refer to Fixing “The background refresh of ‘Query’ failed.”
Method 2: Use Service Principals for Automated and Unattended Refreshes
If your workbook must refresh automatically without human intervention (for example, through Windows Task Scheduler, PowerShell, or Power Automate), you cannot use a personal user account protected by interactive MFA. You must use an unattended identity known as a Service Principal.
- In the Azure Portal, navigate to Microsoft Entra ID > App registrations and register a new application.
- Under Certificates & secrets, generate a new Client Secret. Record the Application (Client) ID, Directory (Tenant) ID, and Secret Value.
- In your target Azure SQL Database, create a database user mapped to the Application ID:
CREATE USER [YourAppName] FROM EXTERNAL PROVIDER; ALTER ROLE db_datareader ADD MEMBER [YourAppName]; - Update your connection string or script to use the Service Principal authentication mode instead of an interactive user prompt.
If using a standard SQL Server on-premises, consider creating a dedicated database account with restricted read-only permissions instead of relying on domain-level MFA accounts. For credential selection best practices, see Troubleshooting “Login failed for user”: Windows vs. SQL Authentication..
Method 3: Clear and Re-authenticate Stale OAuth Tokens
Sometimes an expired or corrupted authentication token remains stuck in Excel’s local identity cache. Power Query continues passing the bad token in the background instead of requesting a fresh one.
- Open Excel and click Data > Get Data > Data Source Settings.
- Select Global permissions.
- Locate your database server endpoint in the list.
- Click Clear Permissions (or Delete).
- Close the dialog and click Data > Refresh All.
- When prompted, select Microsoft account or Organizational account, click Sign in, and complete the MFA challenge.
For step-by-step guidance on managing stored credentials, consult Managing Data Source Settings: How to clear and reset Global Permissions.
Diagnostic Branches: Cloud Workbooks and Password Rotations
If MFA issues persist after adjusting connection properties:
- Corporate Password Rotations: When your company enforces periodic password resets, saved tokens in Excel often fail silently in the background while still appearing valid in your Windows profile. See Handling “The credentials provided for the SQL source are invalid” after password rotation..
- Excel Online and SharePoint Environments: Cloud versions of Excel cannot prompt for desktop MFA when refreshing connected workbooks hosted on SharePoint. If your files fail to refresh when opened in a web browser, review Handling “External Data Refresh Failed” on Excel Online / SharePoint..