“The authentication provider ‘Windows’ is not supported”

The error "The authentication provider 'Windows' is not supported" occurs when Power Query attempts to connect to a cloud service, modern database, or secure web endpoint using on-premises NTLM or Kerberos Windows authentication. Modern endpoints, such as Azure SQL Database, Microsoft Fabric, SharePoint Online, and external REST APIs, reject local Windows credentials because they require modern identity protocols like Microsoft Entra ID (OAuth 2.0) or database-specific logins.

Fast Fix

Go to Data > Get Data > Data Source Settings, choose Global permissions, select the affected connection, and click Clear Permissions. Relaunch the query or click Refresh. When prompted to authenticate, do not select Windows. Choose Organizational account (to sign in with Microsoft 365) or Database (for SQL authentication) based on your target service.

---

Diagnostic Snapshot

Property	Details
Error Message	DataSource.Error: The authentication provider 'Windows' is not supported.
Trigger Mechanism	Passing local Windows user tokens (NTLM/Kerberos) to a cloud endpoint
Common Data Sources	Azure SQL, Azure Synapse, Microsoft Fabric, SharePoint Lists, Snowflake, OData
Resolution Focus	Clearing cached credentials and switching to Entra ID (OAuth) or Native Auth

---

Why the Authentication Fails

When connecting to a local SQL server, selecting “Windows Authentication” passes your current Windows login token seamlessly to the target database.

However, cloud-hosted platforms cannot evaluate local Windows machine tokens:

[Local Excel Client] ───(Sends Windows NTLM/Kerberos Token)───► [Azure SQL / Fabric]
                                                                        │
                                                                   REJECTED:
                                                    "Provider 'Windows' Not Supported"

Cloud endpoints require one of the following:

• Entra ID (Azure AD) Tokens: Handled via the Organizational account option in Power Query.
• Service-Specific Credentials: Managed database users (such as standard SQL users) entered via the Database tab.
• API Keys / Anonymous Access: Managed via Web API or Anonymous options for web feeds.

If you previously clicked through connection prompts quickly, Excel may have cached “Windows” as the default provider for that root domain. Power Query will then reuse that invalid method on every subsequent refresh, failing before it ever checks for new data.

---

Step-by-Step Resolution

Step 1: Clear Cached Connection Permissions

To stop Excel from sending the unsupported Windows token, purge the stored credential profile:

1. Open Excel and navigate to the Data tab.
2. Click Get Data > Data Source Settings.
3. Select Global permissions at the top of the window.
4. Locate the domain or server string causing the error (e.g., yourserver.database.windows.net or company.sharepoint.com).
5. Click Clear Permissions (or Delete).
6. Click Close.

[Data Source Settings]
  └── (o) Global permissions
        └── Select: target-server.database.windows.net
              └── [Clear Permissions]

---

Step 2: Reconnect Using Supported Authentication

After clearing permissions, trigger a fresh evaluation by clicking Data > Refresh All (or open the query in the Power Query Editor). When the authentication modal appears, choose the appropriate option:

Scenario A: Azure SQL Database / Microsoft Fabric / Power BI Datamarts

1. In the left navigation pane of the authentication window, select Microsoft account or Organizational account.
2. Click Sign in.
3. Complete the Entra ID authentication prompt, including your organization’s Multi-Factor Authentication (MFA).
4. Once verified, set the security level dropdown to the root domain or catalog level.
5. Click Connect.

Scenario B: Standard SQL Database User

If connecting to Azure SQL using a database username and password created by a DBA:

1. Select Database in the left navigation pane.
2. Enter the dedicated User name and Password.
3. Click Connect.

Scenario C: SharePoint Online / Teams Lists

1. Select Organizational account.
2. Never select Windows or Default/Anonymous for Microsoft 365 cloud resources.
3. Sign in with your corporate email and click Connect.

If your connection fails with permission errors after you enter the correct credentials, refer to How to Resolve Power Query “Access to the resource is forbidden” (403 Error). For troubleshooting SharePoint connections, see Troubleshooting SharePoint Folder Connection Failures in Power Query.

---

Step 3: Handle Hybrid Environments (On-Premises via Cloud)

If you are querying an on-premises SQL Server using an organization-wide data gateway or cloud service:

• Local Windows authentication is supported on-premises, but only when routed through an On-premises Data Gateway.
• If the gateway is not installed or configured to handle Windows Kerberos delegation, you must update the gateway connection settings to use explicit basic database credentials (SQL Server Authentication) instead.

If you continue to get authentication errors across multiple queries, review How to Resolve “Credential persistence” Errors in M365 Excel. If your organization recently moved to passwordless authentication, check How to Resolve Modern Authentication (ADAL/MSAL) Failures in 2025.