Power BI Gateway Explained: Setup, Configuration & Best Practices

A Power BI gateway, officially the on-premises data gateway, is a free Windows service you install on a server inside your network so the Power BI service can refresh and query data that lives on-premises, such as SQL Server, Oracle, SAP, Excel files on a share or a local PostgreSQL. It only opens outbound connections to Azure Relay, so you never open inbound ports. Install it in standard mode on an always-on Windows Server, register it with your work account, then add each data source under Settings > Manage connections and gateways in the Power BI service.

Quick answer: set up a Power BI gateway in 6 steps

1. Pick an always-on, wired Windows Server 2019/2022/2025 machine (not a laptop and not a domain controller).
2. Download the standard mode gateway from Microsoft and run the installer as a local administrator.
3. Sign in with your work or school (Microsoft Entra ID) account.
4. Choose Register a new gateway on this computer, give it a unique name and save the recovery key somewhere safe.
5. In the gateway app, go to Diagnostics > Network ports test and make sure it reports Completed (Succeeded).
6. In the Power BI service, open Settings > Manage connections and gateways > New, add the on-premises connection, then point your semantic model's scheduled refresh at it.

The rest of this guide covers each step in detail, the three gateway types, the exact firewall rules and the errors people hit most often.

What is the Power BI gateway and how does it work?

The gateway is a bridge between your local data sources and Microsoft's cloud. When a report refreshes, the Power BI service puts the query on Azure Relay (Service Bus); the gateway, which keeps an outbound connection open, picks it up, runs it against your database using credentials it decrypts locally, and sends the results back over the same outbound channel. Credentials are encrypted in the cloud and only decrypted on the gateway machine.

One gateway can serve several Microsoft services at once:

• Power BI semantic models, dataflows and paginated reports
• Microsoft Fabric (Dataflow Gen2, data pipelines, Copy Job)
• Power Apps, Power Automate and Azure Logic Apps
• Azure Analysis Services and Azure Data Factory

You need a gateway whenever a published report refreshes from or runs DirectQuery against something the cloud cannot reach directly. Cloud sources such as SharePoint Online or an Azure SQL database with a public endpoint usually refresh without one.

Standard vs personal mode vs VNet data gateway

Microsoft's own recommendation is standard mode, ideally in a cluster. You can install one standard and one personal gateway on the same computer, but not two of the same mode. If Private Link is enabled on your tenant, use the VNet data gateway: the on-premises gateway is not supported with Private Link.

Requirements before you install

From the Microsoft Learn install guide:

Things that catch people out:

• Not on a domain controller, not on Server Core and not in a Windows container.
• Not on a laptop or any machine that sleeps or goes offline; refreshes fail when it does.
• Use a wired connection; wireless and busy shared VMs slow refreshes down.
• For Windows authentication to a remote domain, the gateway machine must be domain-joined with a trust to that domain.
• Put the gateway close to the data (same site or same Azure region) to cut latency.

A VM is fine, but Microsoft warns that a virtualisation layer can make performance inconsistent. On a Proxmox host like the ones in my lab, give the gateway its own Windows Server VM with dedicated vCPUs and RAM rather than squeezing it onto the database server.

Firewall and proxy: the ports the gateway needs

The gateway needs no inbound ports. It makes outbound connections on TCP 80, 443, 5671, 5672 and 9350 to 9354. The main endpoints from the communication settings page are:

If you run Fabric Dataflow Gen2 or pipelines through the gateway, also allow *.dfs.fabric.microsoft.com (443), *.datawarehouse.fabric.microsoft.com (1433) and *.frontend.clouddatahub.net (443).

Only 80 and 443 allowed? Open the gateway app, go to Network and switch on HTTPS mode. New installs default to HTTPS, but upgraded older installs may still use TCP. If your proxy needs authentication, change the gateway service account from the default service SID (NT SERVICE\PBIEgwService) to a domain account.

On a pfSense firewall, scope the rule to the gateway machine only rather than the whole server VLAN. pfSense host aliases cannot hold wildcards like *.servicebus.windows.net, so for firewalls like that Microsoft publishes the Azure IP ranges and service tags (PowerBI, ServiceBus, AzureActiveDirectory, AzureCloud) as a weekly JSON file.

Step-by-step: install and register the gateway

Here is the full walkthrough on our YouTube channel:

1. Download the standard gateway

Download it from Microsoft: the standard mode installer (or the personal mode installer if you only need it for yourself). Microsoft ships a new gateway release every month and supports only the last six, so always start with the current one.

2. Run the installer

Run it as a local administrator, keep the default installation path, accept the terms and select Install.

3. Sign in

Enter your work or school email address (a Microsoft Entra ID organisation account, for example name@contoso.onmicrosoft.com) and select Sign in. Personal Microsoft accounts are not accepted.

4. Register the gateway

Select Register a new gateway on this computer > Next. Enter a name that is unique in your tenant and a recovery key. Store the recovery key in your password manager: Microsoft cannot retrieve it, and you need it to restore, move or add cluster members. Leave the region as your tenant's default region if you use it for Power BI. Select Configure.

5. Check the status and the network test

The final screen should show the gateway as online and ready for Power BI, Power Apps and Power Automate. Then open Diagnostics > Network ports test > Start new test. You want Completed (Succeeded). If it fails, open the last results file: any line marked Closed is a port your firewall is blocking.

6. Add gateway admins

In the Power BI service or the Power Platform admin center, add at least one other administrator to the gateway so it is not tied to a single person who might leave.

Add a data source and schedule refresh in the Power BI service

1. In the Power BI service, select the Settings (gear) icon > Manage connections and gateways.
2. Select New, choose On-premises, pick your Gateway cluster name, enter a Connection name and the Data Source Type (for example SQL Server).
3. Enter the server and database. They must match exactly what you used in Power BI Desktop: if Desktop uses SQL01\SALES, do not enter an IP address here.
4. Choose the authentication method (Windows, Basic or OAuth2), enter credentials, set the privacy level and select Create.
5. Under Manage users, give the report authors User access to that connection (not admin access to the whole gateway).
6. Open your semantic model's Settings, expand Gateway and cloud connections, map each data source to the connection, then set Scheduled refresh.

If the model uses several sources, every one of them must be mapped to a connection or the gateway option stays greyed out. Shared capacity (Pro) allows up to 8 scheduled refreshes a day; Premium Per User and Fabric/Premium capacity allow up to 48.

Gateway clusters for high availability

A single gateway is a single point of failure. A cluster lets you add more gateways on other machines: if the primary goes offline, queries route to the next member, and load can be spread across members.

1. Install the gateway on a second server.
2. When registering, tick Add to an existing gateway cluster, select the primary gateway and enter its recovery key.
3. Keep all members on the same gateway version, and remove or disable members that are permanently offline; offline members hurt performance.

Each gateway has a concurrency limit of 30 refreshes. If you see "There are too many refreshes occurring concurrently", add members to the cluster or split heavy models onto a second cluster.

Common Power BI gateway errors and fixes

The fastest way to debug a single data source is to install Power BI Desktop on the gateway machine and refresh the report there. If it fails in Desktop on that machine, the gateway will fail too, usually because of a missing driver (Oracle, MySQL ODBC, SAP) or file-share permissions for the service account. For logs, use Diagnostics > Export logs in the gateway app (saved as a zip in an ODGLogs folder on the desktop) or Event Viewer under Applications and Services Logs > On-premises data gateway service.

Best practices

• Update monthly. Only the last six releases are supported; upgrade one cluster member at a time.
• Use a cluster for anything production, even if the second member is a small VM.
• Least privilege. Share individual connections with users, keep gateway admin to a small group, and use a service account with read-only database rights.
• Monitor it. Turn on gateway performance monitoring and the diagnostics template to see query duration and concurrency.
• Keep it close to the data and on its own machine, not on the database server.
• Document the recovery key and the gateway name in your IT runbook.

Related guides

• Power BI vs Tableau: choosing the right tool
• Cloud computing vs big data: key differences
• Top cloud service providers compared

Official references: What is an on-premises data gateway?, Install a gateway, Communication settings and Troubleshoot the gateway.