Virtual network (virtual network) data gateway FAQs

We support GCC L4 (Texas and Virginia) and L5 (DoD East). This feature is currently not supported in GCC L2.

Customers should not remove the subscription level RP assignment until at least three hours after deleting a gateway because we still need to clean up resources.

When using OAuth2 credentials in Dataflows Gen1, the gateway doesn't support refreshing tokens automatically when access tokens expire. Tokens typically expire 1 hour after the refresh starts, but can expire in less than 1 hour, depending on the data source and the tenant policies. Dataflows Gen2, Semantic models, Data pipelines are able to refresh tokens mid-stream and should not be impacted due to this.

We support air gapped clouds in US Nat East/West and US Sec East/West.

Use Private links to secure this connectivity. More information: Power BI Private Links documentation

The virtual network data gateway is physically in the same region as your Azure virtual network. However, the metadata (name, details, data sources, encrypted credentials, and so on) for all your virtual network data gateways are stored in your tenant’s default region. You can manage all virtual network data gateways when you select your tenant’s home region in Power platform admin center.

Yes. You can use a virtual network data gateway and your conditional access policies still applies.

A complete list of supported data services:

• For Power BI is available in Supported Azure data services
• For Power Platform dataflows is available in Supported data sources

Virtual network data gateways are a premium-only feature and are available only in Fabric (any SKU) and Power BI Premium capacities (A4 SKU or higher or any P SKU).

Yes

Review Azure virtual network documentation for restrictions (for example, region related) on VNets, endpoints, and associated Azure resources.

Review the corresponding Azure data service product documentation to check if private endpoints are supported and on how to enable them.

If you're getting errors such as Authorization failed for Public API route or DM_GWPipeline_Client_OAuthTokenLoginFailedError when trying to create a virtual network Data Gateway connection with OAuth authentication towards an Azure resource with a firewall blocking public internet access and configured with private endpoints, this means that you need to explicitly create a service endpoint for private authentication by calling the Microsoft Entra ID service. To resolve this situation, go to the virtual network subnet used for the virtual network Data Gateway, and enable the service endpoint Microsoft.AzureActiveDirectory as depicted below.

Yes, there's no dependency on the Power BI home region for this feature. If this feature is enabled in the region where the virtual network exists, you are able to create a new virtual network data gateway.

No. The virtual network data gateway is physically in the same region as your Azure virtual network. Currently, you also can't choose where the metadata (name, details, data sources, encrypted credentials, and so on) for all your virtual network data gateways are stored. That data is stored in your tenant's default region.

No. The virtual network data gateway must be created in the same tenant as the Power BI tenant.

No, virtual network gateways are currently available only in your tenant’s home region.

Few areas to check:

• Make sure your data source is up and running.
• Make sure that the data source can be accessed from within the virtual network—specifically from the subnet delegated while creating the virtual network data gateway. For instance, you could deploy a VM in the subnet and check if you can connect to the data source.
• The following Azure Network Security Groups (NSGs) could be required depending on your scenario:
  • Allow outbound traffic to the Microsoft Entra ID endpoint while using OAuth or Service Principal authentication to connect to a data source.
  • Allow outbound traffic to CA (Certificate Authority) while using HTTPS to connect to a data source.

The connectivity between the new virtual network service and your virtual network is via HTTPS and TLS 1.2.

For SQL serverless with auto-pause, the first request might fail if SQL is in a paused state, but the next ones will succeed.

When used for the first time, the virtual network gateway takes about 2 minutes to get setup. Similarly, if the virtual network data gateway isn't used for 30 minutes, you could experience a delay of about a minute the next time you use it.

No, only commercial clouds are supported for the public preview release.

No. The VNET data gateway provides fully managed compute. You can choose to scale the number of nodes in each cluster.

Yes

Check if there are other gateways using the same virtual network and subnet. To be able to delete, it would take up to 48 to 72 hours after the last gateway using this virtual network and subnet was removed.

Beyond the five reserved IPs, our recommendation is to have approximately 5-7 more IPs so you can add more virtual network gateways to the same virtual network and Subnet.

Make sure you're explicitly in a role with the Microsoft.Network/virtualNetworks/subnets/join/action permission on the virtual network like the Azure Network Contributor role. This permission is required for creating a virtual network data gateway.

How does security compare to the on-premises data gateway? Yes, all the data going through a virtual network data gateway remains on the Azure backbone. We use an internal Microsoft tunnel that doesn't reach the public internet between the virtual network and Power BI service. On the other hand, the on-premises data gateway opens a connection to use Azure Relay to connect to the Power BI service.

Considering the various resources: subscription, Microsoft.PowerPlatform resource provider, virtual network, subnet, and Power BI Service's home tenant. If you're using a service endpoint, the virtual network and subnet should be in the same region as the data to which you're connecting. If you're using a private endpoint, they can be in different regions. The data gateway configuration lives in the Power BI home tenant region.

A virtual network gateway can generally reach sources that are reachable within that same virtual network. If there's another virtual network that is isolated from the first, then another virtual network gateway is necessary.

• The virtual network's subnet's IP range can't overlap with 10.0.1.x.
• You can't delegate a subnet called gatewaysubnet to the Power Platform admin center. This restriction is because it's a reserved word for the Azure Gateway Subnet feature.
• You can't change the region, subscription, or resource group for the virtual network on which the virtual network data gateway was created. This scenario isn't currently supported.
• If an OAuth refresh that takes longer that one hour is canceled with the error "Invalid Connection Credentials" or timeout, the issue is likely that the credential expired.

Users are limited to 1,000 data sources on each VNET gateway. If you reach the maximum number of data sources limit, verify that the number of data sources for each VNET gateway isn't over the limit of 1000. To resolve any related issues, you can manually remove the data sources from the admin center or, alternatively, use the following PowerShell script to bulk-delete all data sources using a specified VNET gateway that exceeds that limit. You'd need to replace the text "GatewayClusterID" with the specific VNET gateway ID for this script to work.

## https://learn.microsoft.com/powershell/module/datagateway/?view=datagateway-ps
## PowerShell version of '7.0.0' to run
## required module "DataGateway" Install-Module -Name DataGateway and sign in the same user who exceeded the 1000 limit
Connect-DataGatewayServiceAccount
 
## get the gateway information per the sign in person
$datasources = Get-DataGatewayClusterDatasource -GatewayClusterId <GatewayClusterId>;
foreach ($datasource in $datasources)
{
  $datasource
  "datasource id={2}, datasourceType={3}, datasource connection details={4}" -f $datasource.Id, $datasource.DatasourceType, $datasource.ConnectionDetails
 
  ## conditional logic to determine if name matches set
  ## Remove-DataGatewayClusterDatasource -GatewayClusterId $gw.Id -GatewayClusterDatasourceId $datasource.Id
}