Power Query blocks a finance merge: check the privacy boundary

A finance workbook refreshes correctly until someone combines a confidential source with a second connection. Power Query then reports a privacy or Formula.Firewall error. Before changing settings, identify what the combined query is trying to do. The useful question is which values could pass from one source to another, and whether that transfer is appropriate for the information involved.

Microsoft explains that the Data Privacy Firewall helps prevent unintended transfers between sources. Query folding can move processing into a source system; in some combinations, that can involve passing values from one source into a request to another. A join that looks like local spreadsheet work may therefore have a wider data path. That possibility deserves review even when both connections use valid credentials.

Preserve the failing query and its error message in the approved project record. Note the application, connection types, recent change and last successful refresh. Work on a controlled copy while investigating, so a troubleshooting change cannot quietly become the next published finance report.

List each source, its owner, the information retrieved and the destination allowed to receive it. Describe fields specifically: supplier name, outstanding balance, currency, bank details or employee compensation. A broad label such as finance data makes it difficult to decide whether a proposed combination exposes unnecessary information. Include parameters and lookup values used in requests, as well as the resulting tables.

Consider a hypothetical supplier-balance workbook that needs exchange rates for a management report. The rate source needs a defined currency and date request under its service terms; it does not need the supplier names, unpaid balances or bank details. The report designer should identify a route that retrieves the approved rate information and combines it with the balances inside an appropriate environment.

Check intermediate queries too. A final report might display only totals while an earlier step retrieves detailed records or uses them in a filter sent elsewhere. Removing a sensitive column from the last output does not explain what earlier steps did. Have the technical owner inspect the actual query path when the destination or transformation is unclear.

Power Query assigns privacy classifications to sources and separately provides options controlling whether those classifications are enforced during combination. Microsoft describes Private, Organizational and Public boundaries, along with a None option. Private data has tighter restrictions on folding into other sources; Organizational data is not intended to fold into Public sources. Check the classifications against the real sensitivity and permitted recipients.

Changing every source to the same level just to make a refresh succeed can erase a meaningful distinction. A database used by the whole company is not automatically an appropriate destination for a small payroll workbook. Ask the data owner to approve the classification using the actual content and access arrangement. A successful connection proves that an account can authenticate, not that every possible transfer is permitted.

Inspect the enforcement options as well as the source labels. Microsoft warns that ignoring privacy levels, also called Fast Combine, can expose confidential information. A source marked Private provides little reassurance if the relevant process is configured to ignore that boundary. Record the effective application and file settings, rather than retaining only a screenshot of one source label.

Ask the query owner to explain the specific error before choosing a repair. Privacy errors can involve the way queries are composed as well as the classifications of their sources. Product behavior also varies across Power Query hosts and changes over time. Use the documentation for the environment running the refresh; avoid copying a workaround from a different product without testing what it changes.

A suitable repair might separate retrieval from combination, move the work into an approved environment, or remove an unnecessary source altogether. Any intermediate copy still needs an owner, permissions, freshness checks and an agreed retention approach. Staging confidential records in another folder does not make their sensitivity disappear. The redesigned path should make the allowed transfer understandable, not merely move it out of sight.

If the proposed repair changes a source classification, have the owner state why the new classification is correct. If the business requires a transfer that the current arrangement cannot support safely, resolve the architecture or permission boundary with the responsible technical and information owners. Treat performance as a requirement to meet within that approved design.

Use synthetic records that preserve the relevant field structure while reproducing the combination. The technical reviewer should establish which system receives each request and which fields it contains, using appropriate diagnostics without exposing credentials or live personal records. A green refresh indicator alone shows that processing finished; it does not explain the information transferred between sources.

Then verify the finance output against the previous approved method. Compare the source period, row population, unmatched currencies, rate dates and resulting balances. A privacy repair that changes when a reference table is refreshed can change financial results even when the query returns no error. Keep any intended change separate from an accidental difference introduced during restructuring.

Test where the recurring process will actually run. A desktop author, scheduled service and gateway can involve different identities, connection settings and capabilities. Confirm the supported privacy behavior in that environment rather than assuming the author’s successful local refresh settles the production arrangement. Record the approved owner and the evidence needed to investigate a future failure.

Leave a short operating note identifying the source classifications, permitted data path, refresh environment and person responsible for changes. Explain why the combination was designed that way. A later analyst trying to improve performance should be able to recognize that a seemingly inconvenient step protects a confidential population.

Review the boundary when a source gains sensitive columns, a connection moves to another provider or the refresh is transferred to a different host. Retain the approved query version and comparison results. The finished repair should let the finance team refresh a reliable report while the information owners can explain where its underlying records go.