- The Power BI service and Microsoft Fabric read data on your network through the on-premises data gateway, a Windows app you install on a machine in your own network.
- The gateway makes only outbound connections, through Azure Relay, and needs no inbound firewall ports.
- Power BI Report Server runs entirely on your own server, with no gateway and no Power BI service, a smaller feature set and its own version of Power BI Desktop.
Contents 7 sections
- 01How Power BI gets to your server
- 02Where should you install the gateway?
- 03Standard or personal mode
- 04How often is the data refreshed?
- 05What IT and security ask
- 06When data can't go to the cloud
- 07FAQ
How Power BI gets to your server
Power BI Desktop on your computer reads SQL Server on your company network directly. Once published, the semantic model lives in the Power BI service, in Microsoft's cloud. To refresh from your network it then needs the on-premises data gateway, a Windows app that connects cloud services to data sources on your network (what the gateway is).
The gateway connects out on its own, and no inbound connection reaches it from the cloud. The cloud service prepares the query and encrypted credentials, and the gateway picks them up through Azure Relay. The gateway decrypts the credentials, runs the query against your source and sends the result back the same way. Large refresh results are first spooled to its own disk and sent to the cloud only once complete (gateway architecture).
How often the gateway works depends on the model's mode. In Import mode, data is loaded into the model in Power BI during refresh, and visuals then read the stored copy. In DirectQuery mode, data isn't imported and every visual sends queries to the source, so a visual's speed depends on the performance of the source and the gateway (DirectQuery in Power BI).
Microsoft Fabric uses the same gateway. Dataflow Gen2, pipelines and Copy job read data from your network through it (on-premises data in Fabric). SQL Server Mirroring needs the gateway too, details are in the SQL Server to Fabric guide.
Where should you install the gateway?
The gateway needs a machine that's always on, connected to the internet and able to reach the data source. The minimum is .NET Framework 4.8 and Windows 10, Windows 11 or Windows Server 2019 or later. Microsoft recommends eight cores, 8 GB of memory, 64-bit Windows Server and an SSD for spooling results (installing the gateway).
You can't install the gateway on a domain controller, on Server Core or in a Windows container. On a laptop that goes to sleep or drops off the internet, the gateway doesn't work. According to Microsoft, a wireless network and a virtualization layer can reduce gateway performance.
The gateway can run directly on the database server or on a separate machine. The closer the gateway runs to the data source, the lower the network latency, and it's lowest when installed right on the source (gateway FAQ). Other apps on the same machine can reduce gateway performance, though, and Microsoft then recommends monitoring the machine for resource contention.
Microsoft releases a new gateway version every month and supports only the last six versions (supported versions). During installation you enter a recovery key. Without the key you can't restore the gateway or move it to another machine, and Microsoft can't retrieve it for you.
Two or more gateways can be joined into a cluster of up to ten members. Requests go to the primary gateway, and when it's offline, another cluster member takes them over. All members should run the same version (gateway clusters). You can then install an update one machine at a time, without taking the whole cluster down (gateway planning).
Files on a drive in your company network are also refreshed by Power BI through the gateway, and the machine holding the files must be running during the refresh. Files on OneDrive for work or school and on SharePoint are read by Power BI directly from the cloud, without a gateway (Power BI service data sources).
Standard or personal mode
The gateway is installed in one of two modes. Standard mode is shared by several people and serves all supported services. Personal mode belongs to one user, serves only Power BI and can't be shared (gateway types).
Two gateway modes
| Aspect | Standard mode | Personal mode |
|---|---|---|
| Who uses it | several people, shared connections | only the person who installed it |
| Services | Power BI, Microsoft Fabric, Power Apps, Power Automate and more | Power BI only |
| Model modes | Import, DirectQuery, live connection to Analysis Services | Import only, with scheduled or manual refresh |
| How it runs | Windows service | interactive app |
| Management | central, with gateway admins and users per connection | no central management |
| High-availability cluster | yes | no |
Microsoft intends personal mode for an individual author who refreshes a few models in Import mode and doesn't share connections. Each user can have only one gateway in personal mode, and installing it on another computer replaces the previous installation (personal mode).
How often is the data refreshed?
In Import mode, data is refreshed as often as you schedule the refresh. With a Pro license you can schedule up to eight refreshes a day, with a Premium Per User license or on a Premium or Fabric capacity up to 48 (scheduled refresh).
A manual refresh in the interface doesn't count toward the limit of eight. A refresh on shared capacity must finish within two hours, on a Premium capacity within five hours, and the five-hour limit can be bypassed through the XMLA endpoint (refresh in Power BI).
After four failed refreshes in a row, Power BI turns the schedule off. It also pauses the schedule for a model whose reports nobody has looked at for two months, and emails the model owner about the pause (scheduled refresh).
Up to 8 scheduled refreshes a day with a Pro license, up to 48 with a Premium Per User license or on a Premium or Fabric capacity. Every refresh sends queries to your server.
Every refresh through the gateway runs queries against your database, the same one your ERP runs on. Incremental refresh splits a table into partitions and refreshes only the newest ones. According to Microsoft, that means less data to refresh and lower use of memory and other resources in both Power BI and the source system (incremental refresh).
In DirectQuery mode you don't schedule a data refresh, because the data isn't imported. Visuals query the source every time they're displayed and every time a filter changes. In DirectQuery, a source response going through the gateway can hold at most 16 MB of uncompressed data (gateway limitations).
What IT and security ask
The questions IT and security ask when you connect your own server to the cloud, with answers from Microsoft's documentation:
- Do we open ports in the firewall? No inbound ones. The gateway connects out to Azure Relay, and the outbound ports and domains your firewall should allow are listed in gateway communication settings. New installations communicate with Azure Relay over HTTPS.
- Where are the database passwords stored? The cloud service stores the source credentials encrypted, and only the gateway on your network decrypts them when it connects to the source (gateway credentials).
- Which account reads the database? The account stored in the connection, whoever opens the report, with exceptions for DirectQuery and live connections to Analysis Services. Microsoft recommends a service account with only the permissions the connection needs.
- Who can use the gateway? The gateway is managed by its admins, and each connection has its own list of users. The list decides who may publish reports with data from the connection, and a user not on the list doesn't see the connection in Power BI (connection users).
- Does data leave our network? In Import mode, yes, a copy of the data sits in Power BI. Power BI stores data in the Azure geography it assigns to your tenant at first sign-in, unless you use Multi-Geo (Power BI security). DirectQuery limits persistent copies, but the visual cache can hold limited aggregated data (DirectQuery in Power BI).
When data can't go to the cloud
Power BI Report Server runs on your own server or on a virtual machine in Azure and needs neither the Power BI service nor a gateway (Report Server and the Power BI service). Compared with the Power BI service, it differs in both licensing and features:
- Licensing. You license Report Server through a reserved Fabric capacity from F64, or through SQL Server. With SQL Server 2025, Standard or Enterprise edition is enough; with SQL Server 2022 and earlier, only Enterprise with active Software Assurance (Report Server licensing). Anyone who publishes Power BI reports to Report Server needs a Pro license, reading reports doesn't need one.
- Its own version of Desktop. Reports are built in Power BI Desktop for Report Server. Report Server is released three times a year, in January, May and September, and new features reach the Power BI service first.
- A smaller feature set. There are no dashboards, apps, composite models, report authoring in the browser, email subscriptions for Power BI reports or data alerts. Reports with R or Python scripts or visuals can't be saved to Report Server.
- Operations. Microsoft runs the Power BI service, while you install and update Report Server yourself. The catalog database is hosted on SQL Server Standard or Enterprise edition (editions and Report Server).
Report Server also handles paginated reports and their email subscriptions. From SQL Server 2025 on, Microsoft consolidates on-premises reporting under Power BI Report Server and releases no new versions of Reporting Services. Reporting Services 2022 gets security updates until January 11, 2033 (Reporting Services consolidation).
FAQ
Do we have to open firewall ports for the gateway?
You don't have to open inbound ports. The gateway makes only outbound connections, and in the firewall it's enough to allow outbound traffic to the ports and domains Microsoft lists for the gateway. The network ports test right in the gateway app checks that they're all reachable.
Do we need a gateway for files on SharePoint?
Power BI reads files on OneDrive for work or school and on SharePoint directly from the cloud, without a gateway. You need a gateway for files on a drive in your company network.
What happens when the gateway server goes down?
A refresh that goes through the gateway fails, and after four failed attempts in a row Power BI turns the schedule off. A cluster protects you against one machine going down, because another member takes over the requests.
Where is our data stored in Power BI?
In the Azure geography Power BI assigns to your tenant at first sign-in. You'll find the region in the About dialog, next to "Your data is stored in" (home region).
Can you run Power BI entirely without the cloud?
You can, with Power BI Report Server, which runs entirely on your own server. Expect its own version of Power BI Desktop, a smaller feature set than the Power BI service, and server administration on your IT's side.
Where do you stand?
Data Probe
€840excl. VAT
One day at your company, with no access to your systems. We map where your data lives and who puts the numbers together from it, and within three working days you get one page with the recommended next step.
