1. Keeping Data Secure In Azure
While Automatically Refreshing Power BI Datasets
Cornell A. Emile
Solution Architect

2. Presenter Information
Bahamian, father, serial entrepreneur, and passionate about data making a positive difference in people's lives
+20 years working with Data, Information
Economist
Statistician
Database Administrator/Developer
Enterprise Data Architect
BI Consultant
Full-Stack Solution Architect

3. Our Agenda Common Data Security Requirement Azure Networking
Power BI Data Gateway
Solution Overview
Live Demo
Wrap-up
Q&A

4. Common Security Requirement
Design a solution that supports the development and automatic refreshing of Power BI dashboards/reports without directly exposing our data within SQL Server databases to the internet.
How best to restrict the internet access to the data sources?
How to maintain a list of whitelisted IPs?
Can the solution work for SQL VM, SQL Managed Instance, SQL Database, Data Warehouse, and Azure Analysis Services data sources?

5. Azure Networking Main Network Components:
Virtual Networks (VNets) – private network in Azure
Subnets – one or more segments of a VNet
Service Endpoints – supports the access of platform services over private network
Azure Firewalls – configure, manage and monitor traffic into and out of VNet
Network Security Groups – similar to Azure Firewalls but lacks advanced functionality
Azure Data Center IP Ranges – IPs used by Azure services

6. Power BI Data Gateways
Used to connect the Power BI Service to various types of on-premise data sources
Two types of data gateways:
On-premises data gateway (Personal Mode)
Supports:
Data imports and scheduled refreshes
On-premises data gateway (formerly Enterprise Mode)
Multiple admins/users
Power Platform
Gateway clusters
DirectQuery
Live Connections to Analysis Services

7. On-Premises Data Gateway
How it works
Query requests are sent to Azure Service Bus by the Gateway Cloud Service.
Data Gateway regularly checks the Azure Service Bus for query requests.
When query request is found, gateway uses stored credentials to connect and execute the query.
Query results payload is sent to data gateway and then handed back to Azure Bus Service.
Gateway Cloud Service retrieves the payload from the Azure Service Bus.
A query is created by the cloud service with the encrypted credentials for the on-premises data source. It's then sent to a queue for the gateway to process.
The gateway cloud service analyzes the query and pushes the request to the Azure Service Bus.
The on-premises data gateway polls the Azure Service Bus for pending requests.
The gateway gets the query, decrypts the credentials, and connects to the data sources with those credentials.
The gateway sends the query to the data source for execution.
The results are sent from the data source, back to the gateway, and then onto the cloud service and your server.

8. Solution Overview: SQL VM
Create VNet and subnet.
Use Azure Firewall and/or Network Security Group (NSG) to:
Allow outbound traffic to endpoints needed by Power BI Data Gateway
Deny outbound traffic
Add a VM (“Gateway VM”) to the subnet
Install Power BI Gateway, SSMS, and Power BI Desktop
Add SQL VM to the subnet
Use VPN Gateway to access the VNet and subnet
Site-to-Site VPN
Point-to-Site VPN
Vnet-to-VNet

9. Solution Overview: SQL VM

10. Solution Overview: SQL VM
Goal: Allow outbound network traffic to endpoints needed by Power BI Data Gateway
Whitelist IP ranges for the region that contains the Power BI account
Several methods available:
Allow all outbound internet traffic
Manually add the list of whitelisted IP ranges and deny all outbound internet traffic
Use fully qualified domain names
Not supported by NSG
Use service tags
Use NSG to deny all internet traffic (inbound and outbound ) to the subnet and then…
Create NSG rules to allow Azure IP ranges needed with service tags.
Manually whitelist other IP destinations as needed.

11. Network Security Group – Default Rules
Add outbound rules for Region that contains the Power BI account.
Add outbound rules for any other Azure endpoints needed.

12. Demo Walkthrough the solution in the Azure Portal
Perform data refresh within Power BI portal
View and Update NSG rules

13. Azure SQL Database / SQL Data Warehouse / Managed SQL Instance
Disable “Allow access to Azure services”
Not applicable for Managed SQL Instance
Associate the database server to virtual network
Limit the database server access to the subnet within the virtual network
Set up VNet Service EndPoint for SQL
Add a VM (“Gateway VM”) to the subnet
Install and configure the data gateway on the “Gateway VM”
Use Azure Firewall and/or Network Security group to restrict traffic into and out of subnet
Use VPN Gateway to access the VNet and subnet
Site-to-Site VPN
Point-to-Site VPN
Vnet-to-VNet

14. Solution Overview

15. Wrap-up: Azure Analysis Services

16. Wrap-up: Troubleshooting Issues
Tools:
Power BI portal
Netmon
Power BI Data Gateway Diagnostic Logging
Windows Event Viewer
Steps:
Start with viewing error within the Power BI portal
Turn on the Power BI Data Gateway Diagnostic Logging
Review Diagnostic Logs
Monitor the Power BI Data Gateway traffic

17. Q & A