The Administration page exposes account-wide settings. Today it controls the personal access Access token expiry — whether tokens get an automatic expiry date when they’re created, and how many days they last.
Who can access this page
Only users with the admin role on the connector see the Administration item in the left navigation. Regular users won’t notice the page exists.
The Access token expiry panel #
Open Administration. The Access token expiry panel has two controls:
- Automatic expiry — a switch. When On, every access token in the tenant has its expiry capped at the maximum lifetime. When Off, tokens are No expiry and only stop working when explicitly revoked.
- Lifetime (days) — the number of days for the automatic expiry. Only shown when the switch is On.
Save changes #
Change either control and the Apply button enables. Select it to commit the new policy.
Turning the policy on affects every access token in the tenant, not just future ones. When you enable it (or lower an existing lifetime), the connector reconciles all existing tokens against the new maximum:
- Tokens with no expiry, or an expiry farther in the future than the new lifetime, are updated to expire at (today + lifetime days).
- Tokens with a shorter existing expiry keep their existing expiry — they were already going to expire sooner than the new maximum, so nothing needs to change.
Turning the policy Off does not revert existing tokens to no-expiry. Tokens keep whatever expiry they currently have; only tokens created afterward get no expiry.
Plan ahead: communicate the change to data-source owners before turning it on, so they can rotate tokens in time if needed — see Manage Access Tokens.
Choosing a policy #
- A short lifetime (30-90 days) is safer if tokens might leak — but everyone has to rotate the credentials in Power BI before each expiry.
- A long lifetime (365+ days) reduces rotation friction but increases the blast radius of a leaked token. Pair it with disciplined use of token labels and prompt revocation when a laptop changes hands.
- Off (no expiry) is appropriate only for tightly controlled environments where the connector users are a small, audited set.
Related #
- Manage access tokens
- View activity history — every token issuance and revocation is logged.
