The architecture of Power BI Gateway provides hybrid data sources within the boundary of security for data transfer and report generation. Below are described a few of the major components, workflows, and security considerations involved in the process.
Key Components
Power BI Gateway: Gateway software is installed on an on-premises server and acts as a bridge between the Power BI Service in the cloud and on-premises data sources.
Power BI Service: This cloud-based platform hosts reports, dashboards, and datasets and interacts with the gateway to retrieve data from on-premises sources.
On-Premises Data Sources: These may include databases like SQL Server and Oracle, or they could also be Excel or CSV files stored within the organization's network.
Azure Service Bus: This allows a secure, cloud-based messaging service to communicate between the gateway and Power BI Service.
Workflows
Configuration:
The gateway is installed on a server that has access to the on-premises data sources.
The gateway is registered with a Power BI tenant and linked to the cloud service.
Data Query:
A report or dataset in Power BI Service sends a query to the gateway.
The gateway authenticates the request and forwards it to the on-premises data source.
Data Retrieval:
The data source executes the query and sends the results back to the gateway.
The gateway relays the results to the Power BI Service, which updates the report or dashboard.
Scheduled Refresh or Live Query:
For scheduled refreshes, the gateway periodically queries the on-premises data sources.
For live queries, the gateway keeps a near-real-time query processing.
Security Considerations:
Authentication:
The gateway uses Azure Active Directory (AAD) for secure authentication and supports Single Sign-On (SSO) for certain data sources.
Encryption:
All data transferred between the gateway and Power BI Service is encrypted with HTTPS. The communication between the gateway and on-premises data sources can also be encrypted.
Data Privacy:
The gateway does not store data but acts as a conduit. The admin can set data privacy levels to determine how data can interact across sources.
Network Security:
Outbound connections from the gateway to Azure Service Bus are established using secure ports (default: 443).
There are no open inbound ports, thus reducing exposure. Power BI Gateway combines these components and workflows to offer secure, efficient, and scalable solutions for hybrid data connections.
