The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A Formula.Firewall error means Power Query has blocked a data combination that does not fit its privacy rules or its query-partition design. The safe fix is to read the complete diagnostic, classify every source according to its real sensitivity, and then either correct the privacy settings or rebuild the query so source access and referenced queries follow the firewall model. Disabling privacy checks should be a last-resort security decision, not the first troubleshooting step.
Microsoft documents two messages that point to different causes: one concerns incompatible privacy levels, while the other concerns a query that both references another query and directly accesses a source. The distinction determines where to work.
As an Amazon Associate I earn from qualifying purchases.
What the Power Query Formula.Firewall error is protecting
Power Query’s Data Privacy Firewall controls how data can move between sources while a query is evaluated. It is designed to reduce unintended disclosure, including disclosure that can occur when query folding pushes transformations or filters back to a source. Folding can improve performance by translating Power Query steps into a native source query, but it can also create a path for information from one source to influence another. Privacy levels and query partitions provide the boundaries for that flow. See Microsoft’s explanation of the firewall architecture at Behind the scenes of the Data Privacy Firewall.
The firewall does not judge whether your merge is logically useful. It checks whether the sources and the way your M queries are partitioned satisfy the documented privacy model. Consequently, a merge that worked in another workbook, on another computer, or before a source was reclassified can fail after credentials, privacy settings, or query structure change.
#1 Best Overall
Identify which Formula.Firewall message you have
Open the error pane and record the reason, message, and detail, including the query and step names. Microsoft recommends capturing all three because the short banner alone may not reveal whether the problem is source compatibility or query structure. The two common messages are materially different.
| Exact message pattern | What it usually indicates | First place to investigate |
|---|---|---|
|
“Formula.Firewall: Query ‘Query1’ (step ‘Source’) is accessing data sources that have privacy levels which cannot be used together. Please rebuild this data combination.” |
Sources directly accessed in the same partition have privacy classifications that the firewall cannot combine under its rules. | Review every source involved in the merge or combination, its assigned privacy level, and whether those sources are being opened together in one partition. |
|
“Formula.Firewall: Query ‘Query1’ (step ‘Source’) references other queries or steps, so it may not directly access a data source. Please rebuild this data combination.” What’s actually slowing this PC down? Pick the symptom - the matching free tool is one click away. Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
|
The failing partition both references another query or partition and directly accesses a source. The firewall cannot establish the required boundary for that arrangement. | Inspect the dependency chain and move source retrieval and subsequent operations into a partition design that the firewall can control. |
Those quotations and their punctuation come from Microsoft’s Power Query error guidance and the Data Privacy Firewall documentation. A workbook can encounter both conditions, so do not change a privacy level merely because the query also has a reference-chain problem.
How privacy levels work
Assign a level based on the data’s actual sensitivity and trust boundary, not on which setting makes an error disappear. Microsoft’s privacy-level documentation describes three classifications.
Rank #2
| Level | Use it for | Important behavior and boundary |
|---|---|---|
| Public | Information that is broadly available, such as genuinely public internet or web data. | Public/Public sources are the documented case in which bidirectional sharing is allowed. Do not label private business information Public for convenience. |
| Organizational | Data available within a trusted organization or group boundary. | Microsoft documents that Organizational data can fold into Private and other Organizational sources, but not into Public sources. Organizational/Organizational is also listed as a combination that permits bidirectional sharing in the documented partition case. |
| Private | Sensitive or confidential information that should be isolated. | Private data cannot fold into other sources in the documented model. Treat customer, personnel, financial, credentialed, or otherwise confidential data as Private when that reflects your governance requirements. |
These are classifications of sources, not labels for how trustworthy a query feels. A public website can still be subject to access credentials or contractual restrictions, while an internal source may contain data that must remain isolated. If the classification is inaccurate, correcting it is preferable to weakening the firewall.
A safe troubleshooting sequence
-
Capture the full diagnostic
In the Power Query error pane, note the named query, step, reason, message, and detail. If the step is called
Source, check the preceding query design rather than assuming that the connector itself is broken. Preserve the exact wording so you can distinguish an incompatible-level message from a references-other-queries message.Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Inventory every source in the combination
List each file, database, web endpoint, dataflow, or other connector used by the failing merge and by any referenced queries in its dependency chain. Include sources that are several query layers away. For each one, identify the account or connection and the privacy level currently assigned. A merge can fail because a referenced query brings in a source that is not obvious from the final query’s first step.
-
Reclassify sources according to real sensitivity
Set Public, Organizational, or Private only after deciding who is permitted to see the data and whether it can be allowed to influence another source. Highly sensitive or confidential data belongs in Private under Microsoft’s guidance. Do not change a source to Public simply to force a refresh; that misrepresents the data boundary and can permit an unintended flow.
-
Match the error text to the design
For the “privacy levels which cannot be used together” message, look for incompatible levels being accessed directly within one partition. For the “references other queries or steps” message, map which query references another query and where the direct connector call occurs. A partition can generally access compatible sources or reference other partitions, but it cannot generally do both; incompatible sources in one partition can also trigger the firewall.
-
Correct settings or rebuild the partition arrangement
After fixing an inaccurate classification, refresh and see whether the original combination is now allowed. If the structure is the problem, redesign the dependency chain so the firewall can see a coherent boundary. Microsoft’s documented pattern for the reference case is to restructure the M query so the referenced data retrieval and the subsequent web request occur in a single query, provided the sources have compatible privacy levels. Apply that pattern only when it matches your intended data boundary; moving operations together does not make a genuinely incompatible source combination safe.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSpecial offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Test with the same host and credentials
Refresh the affected query in the application where it failed, using the same connection identities and file or project settings. A setting in Power BI Desktop, Excel, or Power Query Online may not apply to another host. Confirm that the merge returns the expected rows and that no source has been silently reclassified.
Where to change privacy levels
Power Query Desktop and the current file
Open Data source settings, select the relevant connection, choose Edit Permissions, and set Privacy Levels. The current file’s data-source settings are available from that same area. Power BI Desktop also exposes global and current-file privacy options; check which scope you are editing so a change intended for one workbook does not unexpectedly affect others.
Rank #4
Power Query Online
In Power Query Online, privacy is configured through connection settings or the project’s managed connections, depending on the host and connector. Project options also include a setting that allows combining data from multiple sources. Microsoft warns that enabling such combining can expose sensitive or confidential data, so review the project’s connections and governance before changing it. Navigation and labels can vary by connection type and service experience; use the connection or project settings associated with the failing query.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Fixing the two major causes in practice
When source privacy levels are incompatible
Suppose a query directly combines two sources and the first message names incompatible privacy levels. Verify that each source’s classification reflects reality, then determine whether the combination should be allowed at all. Public and Organizational sources do not become interchangeable merely because both are non-Private. Microsoft’s model specifically limits how Organizational data can fold toward Public, and Private data is intended to remain isolated.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIf one source was accidentally marked Private even though it is an approved internal dataset, changing it to Organizational may resolve the conflict while preserving an appropriate boundary. Conversely, changing a confidential source to Organizational or Public just to make a merge run is not a safe fix. If policy requires the source to remain Private, redesign the data preparation so the sensitive data is not folded or shared across that boundary, or perform an approved consolidation upstream where access controls are explicit.
When a query references another query and a source
The second message concerns partition shape. In the documented model, the firewall partitions evaluation into units that either access compatible sources or reference other partitions. A partition that does both can leave the firewall unable to control what enters it. Trace the chain from the failing step: identify the referenced query, identify the connector call in the outer query, and decide where the combined retrieval should occur.
Best Value
One documented approach is to place the retrieval represented by the referenced query and the later web request in one query, with source privacy levels that are compatible. This is a structural change, not a blanket instruction to duplicate every step. Preserve reusable staging queries where they do not create the prohibited combination, and validate the resulting data flow before publishing.
Should you ignore privacy levels?
Power Query provides options in some desktop and service hosts to ignore privacy-level checks or allow broader source combinations. Microsoft cautions that bypassing the checks may improve performance or functionality but means Power Query may not ensure the privacy of merged data. Treat the choice as a security exception: document the sources, the people who can access the output, the reason the exception is necessary, and how it will be reviewed.
The scope is also limited. Microsoft’s documented Desktop setting does not work for semantic models and does not become a universal privacy override for reports published to the Power BI service. A setting that removes a block in a local workbook therefore does not prove that a published refresh will behave the same way. Check the host, model type, connection configuration, and service governance before relying on any bypass.
Common pitfalls that prolong the error
- Changing every source to Public: This hides the symptom by falsifying sensitivity and can permit data exposure.
- Changing only the visible query: A referenced staging query may introduce the incompatible source. Review the complete dependency chain.
- Assuming a successful preview proves safety: Preview evaluation, full refresh, scheduled refresh, and service execution can use different credentials or scopes.
- Confusing credentials with privacy: Authentication answers who can connect; the privacy level governs how data may flow between sources.
- Expecting one global switch everywhere: Desktop, current-file, project, connection, semantic-model, and service settings have different scopes.
- Ignoring the detail text: The named step and message often identify whether to correct classifications or restructure partitions.
Validation checklist before you publish or schedule refresh
- Every source has a privacy level that matches its actual sensitivity and trust boundary.
- The final query and all referenced queries have been included in the source inventory.
- No partition both references another partition and directly accesses a source in a way prohibited by the firewall model.
- Sources accessed together have compatible classifications for the intended data flow.
- The merge or combination has been tested with the credentials and host that will perform the real refresh.
- Any decision to ignore privacy levels has an explicit security owner, documented reason, and review plan.
- The refresh output has been checked for unexpected rows, filters, or source-side folding changes after restructuring.
Key takeaway
Formula.Firewall is a diagnostic about data boundaries, not merely a nuisance in the merge editor. Start with the exact message, classify sources honestly, and then align the query’s partitions with the firewall’s rule that a partition should either access compatible sources or reference other partitions. Only after those checks should you consider a host-specific privacy bypass, and never assume that a local setting protects a semantic model or a report in the Power BI service.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
