## TL;DR
Open the dataset settings in the service and enter credentials for each data source, because publishing from Desktop does not carry your stored credentials into the cloud copy. Set the sign-in method each source expects, apply the gateway mapping if any source is on premises, and run an on-demand refresh. A model that refreshed in Desktop and fails immediately in the service is almost always missing this step.

```text
credentials are not configured
```

## Use this when
- A freshly published semantic model fails its first scheduled refresh with a credentials message.
- Refresh history shows the failure occurs before any query runs.
- A source was added or its sign-in method changed and refreshes stopped the same day.

## Not for this skill when
- The refresh runs queries and then fails on data. That is a source or query problem after credentials passed.
- The dataset has no refresh option because it is a live connection model. Configure it at the source instead.

## Steps
1. Open the dataset settings page in the Power BI service and expand the data source credentials section. Verify: at least one source is listed as not configured or with an edit credentials prompt
2. For each source, choose the sign-in method the source expects and complete the sign-in or enter the stored account details. Verify: the source saves without an error and no longer shows as unconfigured
3. If any source is on premises, confirm the gateway mapping is applied so the entered credentials are used through the gateway. Verify: every source shows a mapped gateway or a cloud connection state
4. Check the privacy level settings for sources that are combined in one query, since a mismatch can block refresh after credentials pass. Verify: combined sources share a compatible privacy level
5. Run an on-demand refresh and watch the history move past the credential stage into query execution. Verify: the refresh completes and updates the refreshed timestamp
6. Set or confirm the scheduled refresh now that credentials exist, using an owner account that will not be disabled. Verify: the schedule is active and lists the correct times

## Why it happens
Credential separation is deliberate. Desktop credentials live in the analyst profile, while the service needs its own stored copy that survives the owner signing out. Ownership changes, source changes and sign-in method changes all invalidate that stored copy. Teams that document which account owns each dataset refresh avoid the recurring version of this failure when staff change.

The Power BI service stores credentials per dataset and per source, separately from Desktop. On first publish those entries are empty, so the refresh engine stops before running any query and reports that credentials are not configured. Sources added later, or a source whose authentication method changed, such as a move to OAuth sign-in, return the dataset to the same state until the credentials are entered again.

Field notes for Power BI specifically. The refresh history on each dataset, the gateway cluster view in the admin portal, and the workspace activity log together answer most incident questions without opening Desktop. The service and Desktop also diverge in behaviour often enough that a Desktop pass should never close a service incident. Test as a viewer in the browser, in the workspace the audience actually uses, because premium capacity, workspace version, and app publication state all change what the audience experiences compared with the author view.

Power BI estates benefit from an ownership rule that survives staff changes, datasets owned by a team alias or a service account pattern the tenant supports, with a named human deputy. A large share of refresh and security incidents trace back to content owned by someone who left, changed role, or lost a licence. Auditing dataset owners quarterly, and moving orphaned production content before it breaks, prevents the class of failure where the fix is trivial but nobody left on the team has the rights to apply it.
## Variants and edge cases
### Power BI credentials are not configured for this dataset refresh
The near-verbatim phrasing from the service message.
### Power BI semantic model first refresh fails credentials
The first-publish variant of the same gap.
### Power BI dataset credentials expired OAuth re-enter fix
The variant where a sign-in method change invalidated stored credentials.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_7eZM9-fdhm_hKsd2UZw9VQ