Contents
- 23 Oct 2026
Power BI Gateway Requirements: 4 GB Is Disk, Not RAM
The Power BI on-premises data gateway needs .NET Framework 4.8 and a supported Windows machine (Windows 10 or 11, or Windows Server 2019, 2022, or 2025) with 4 GB of disk space for performance logs. Microsoft recommends an 8-core CPU, 8 GB of memory, a 64-bit Windows Server, and SSD storage for spooling. The gateway makes only outbound connections, so it needs no inbound ports, but by default it uses several outbound ports (TCP 80, 443, 1433, 5671-5672, and 9350-9354), and enabling HTTPS mode restricts it to port 443. A third option, the VNet data gateway, is Microsoft-managed and requires a Fabric or Power BI Premium capacity.
A Power BI gateway securely bridges the Power BI service in the cloud to data sources inside your network. Most installs stall on the same few details: the wrong machine, blocked outbound ports, or the wrong gateway type for the job. A common mistake is reading “4 GB” as the minimum RAM. Microsoft’s documentation refers to disk space for performance monitoring logs, and the minimum list doesn't include a RAM figure. This page lays out the requirements as Microsoft currently documents them, plus the VNet gateway option many guides leave out. If you are connecting several on-premises systems at once, our ETL Solutions team can help plan the data source layer.
- Share Post:
-
-
Key Takeaways
- “4 GB” is disk space, not RAM. Microsoft’s minimum list covers the operating system, .NET Framework 4.8, and 4 GB of disk for performance logs; memory appears only in the recommended list.
- Recommended for production: an 8-core CPU, 8 GB of memory, a 64-bit Windows Server, and SSD storage for spooling.
- No inbound ports, but several outbound ones. HTTPS mode narrows the gateway to outbound port 443.
- Credentials are encrypted in the cloud and decrypted only on the gateway machine. They are not simply stored locally.
- The host must always be available. Avoid laptops, wireless-only connections, domain controllers, Server Core, and Windows containers.
- Three gateway types exist. Standard mode (recommended), personal mode (Power BI only), and the Microsoft-managed VNet data gateway.
- Private link changes the answer. The on-premises gateway doesn't support private link, so Microsoft recommends the VNet data gateway in that case.
What a Power BI Gateway Does and How It Stays Secure
A Power BI gateway lets the Power BI service refresh reports on a schedule, or query data live through DirectQuery and live connections, without moving the data or opening inbound firewall ports.
- Outbound only. The gateway initiates every connection and communicates through Azure Service Bus and Azure Relay, so nothing from the internet reaches your network.
- Credentials stay protected. When you add a data source, the service encrypts the credentials so they cannot be decrypted in the cloud. It sends them to the gateway machine, which decrypts them only when it accesses the data source.
- Least privilege. Connect with a data source account that has only the permissions your reports need.
Search summaries sometimes say credentials are stored locally on the gateway machine. Microsoft’s documentation says they are stored encrypted in the cloud and decrypted only on the gateway, which is a meaningful difference for security reviews.
Power BI Gateway System Requirements
| Category | Minimum (Microsoft) | Recommended (Microsoft) |
|---|---|---|
| Operating system | Windows 10, Windows 11, or Windows Server 2019, 2022, or 2025 | A 64-bit Windows Server 2019, 2022, or 2025 |
| CPU | No minimum listed | 8-core CPU |
| Memory | No minimum listed | 8 GB |
| Storage | 4 GB of disk space for performance monitoring logs (default configuration) | SSD storage for spooling |
| Framework | .NET Framework 4.8 | .NET Framework 4.8 |
| Screen resolution | 1280 x 800 | 1280 x 800 |
| Machine | Always on, never asleep or disconnected | Wired network, with other applications kept to a minimum |
These specs cover the on-premises gateway. Microsoft’s recommended column is a sensible starting point for production, and heavy refresh schedules or many concurrent data sources may need more, so monitor the gateway and size up when refreshes slow or fail. Virtualization can also make performance inconsistent, and other applications on the same machine can compete for resources. Some data sources also need their own drivers or client software on the gateway machine, so check the connector documentation for your source.
What the Gateway Does Not Support
| Not Supported | Why It Matters |
|---|---|
| Domain controllers | The gateway cannot be installed on one |
| Server Core installations | Use a full Windows Server installation instead |
| Windows containers | The gateway cannot run in a container |
| Laptops that sleep or disconnect | The gateway cannot run when the machine is off, asleep, or offline |
| Private link scenarios (on-premises gateway) | Microsoft recommends the VNet data gateway when private link is enabled |
| Some Fabric home regions (for example, West India) | Fabric pipelines and Copy Job cannot use the on-premises gateway there, so Microsoft points to the VNet data gateway |
Ports and Network Prerequisites
The gateway initiates every connection itself, so it needs no inbound ports. Microsoft’s current documentation lists these outbound ports:
| Outbound Port | Used For |
|---|---|
| TCP 443 | HTTPS to Microsoft cloud services, and the only port needed in HTTPS mode |
| TCP 5671-5672 | AMQP to the Azure Service Bus domains (*.servicebus.windows.net) |
| TCP 9350-9354 | Azure Relay over direct TCP, alongside 443 |
| TCP 80 and 1433 | Also listed in Microsoft’s required-ports list |
| Inbound | None required |
If your firewall allows only port 443, open the gateway app, choose Network, and turn on HTTPS mode so the gateway talks to Azure Relay over HTTPS. Firewall teams should also allow the Azure Service Bus domains, and Microsoft’s communication-settings article carries the current domain list by cloud, so check it before you finalize rules. Network placement also matters for security, and our guide to improving data security compliance covers it.
Accounts and Permissions
- The installer must be a local administrator. For the standard gateway, the user installing it must be the admin of the machine. Personal mode is designed to run for users who are not administrators.
- The service account. By default, the gateway service runs as NT SERVICE\PBIEgwService, which logs on as a service. If your organization restricts logon rights through group policy, confirm that the service account can still log on as a service.
- Sign-in account. Register the gateway with a work or school account, then associate it with that account.
- Windows authentication. Install the gateway on a computer in the same Microsoft Entra environment as your data sources.
- Remote domains. To reach a data source in another domain, use a domain-joined machine with a trust relationship to that domain.
- Recovery key. You set a recovery key during registration, and Microsoft cannot retrieve it, so store it safely.
Access control inside the data model is a separate layer, covered in our guide to migrating row-level security.
Types of Power BI Gateways
| Gateway Type | Who It Is For | Key Facts |
|---|---|---|
| Standard mode (on-premises) | Shared, multi-user production use | Recommended by Microsoft; serves multiple users with access control per data source; supports scheduled refresh, DirectQuery, and live connections; works with Power BI, Power Apps, Power Automate, Azure Analysis Services, Logic Apps, and dataflows; supports clusters |
| Personal mode | One person refreshing their own data | Works with Power BI only; supports import and scheduled refresh; no shared access for colleagues |
| VNet data gateway | Data sources on a private Azure network | Microsoft-managed; runs in a delegated subnet; needs a Fabric or Power BI Premium capacity |
You can install both a standard and a personal gateway on one computer, but not two gateways of the same mode. For a broader view of the platform, see our Power BI platform overview. Personal mode suits a solo analyst; it doesn't suit collaborative environments, which standard mode and the VNet gateway are for. The standard setup is the one our BI reports and dashboard development team builds on once the gateway is in place.
On-Premises or VNet Gateway: How to Choose
| Situation | Better Fit |
|---|---|
| Data sources inside your own network, and you can maintain a Windows server | On-premises gateway (standard mode) |
| Data sources on a private Azure network, and you want no server to patch | VNet data gateway |
| You need tight control over the gateway host and its network route | On-premises gateway, because you control the machine and its outbound rules |
| You want the least maintenance after setup | VNet data gateway, because Microsoft manages the infrastructure |
| Private link is enabled on your tenant | VNet data gateway, because the on-premises gateway does not support private link |
| Only a Pro or Premium Per User license, with no Premium or Fabric capacity | On-premises gateway, because the VNet gateway needs a capacity |
| Fabric items such as semantic models, paginated reports, or Dataflow Gen2 on private data | VNet data gateway is worth evaluating |
The VNet data gateway requires a Power BI Premium capacity (A4 or higher, or any P SKU) or any Fabric capacity. It is infrastructure you configure, not software you install: you delegate a dedicated subnet to Microsoft Power Platform and create the gateway from the admin portal. It also consumes capacity while it runs, at 4 capacity units per gateway member, so include that in your capacity planning. Microsoft is retiring the Premium per-capacity P SKUs in favor of Fabric capacities, so new purchases should look at Fabric. Our Microsoft Fabric migration services and Power BI consulting services pages cover the capacity side.
How to Set Up and Find Your Gateway
- Prepare the machine. Use an always-on, wired Windows machine that meets the requirements and can reach your data sources.
- Download and install. Run the standard gateway installer with the default path and accept the terms.
- Sign in and register. Sign in with your work or school account, register a new gateway, give it a name that is unique in the tenant, and set a recovery key.
- Add data sources. In the Power BI service, select Settings, then Manage connections and gateways, create an on-premises connection, and enter the credentials. The server and database names must match the ones used in Power BI Desktop.
- Add users and map models. Give the right people access to each connection and point your semantic models at the gateway.
- Schedule refreshes. Set refresh schedules to keep on-premises data current.
For an Azure-native setup, the VNet gateway replaces step 1 and the installer by using subnet delegation and creating the gateway in the admin portal.
To find an existing gateway, open Settings, then Manage connections and gateways, in the Power BI service to see your gateways, clusters, and connections. On the host machine, open the on-premises data gateway app to check its status and network settings.
Best Practices for Reliable Refreshes
- Cluster for availability. Add gateways to a cluster so a single machine is not a point of failure. Each extra member must be on a different computer.
- Keep cluster members identical. Members should run the same gateway version, and offline members hurt performance, so remove or disable them.
- Stay current. Microsoft actively supports only the last six gateway releases, and an out-of-date gateway can cause dataflow refreshes to fail, so plan regular updates.
- Monitor performance. Check refresh schedules and gateway load, because an undersized gateway shows up first as slow or failed refreshes.
- Match the type to the use case. Do not run shared reporting in personal mode.
- Plan the layer behind the gateway. Large data volumes may require architecture work beyond the gateway, such as our data lake, data migration from legacy systems, and ETL automation.
Gateway Not Working? Check These First
| Symptom | Check First |
|---|---|
| Scheduled refresh fails overnight | Whether the host machine was off, asleep, or disconnected, since the gateway cannot run in any of those states |
| The gateway signs in but never connects | Whether outbound ports to the Azure Service Bus domains are blocked, and if so, turn on HTTPS mode |
| Registration fails with a NullReferenceException | Whether Azure Private Link is enabled on the tenant; disable it temporarily in the admin portal, or use the VNet data gateway |
| Slow or unpredictable refreshes in a cluster | Whether members run different versions or some members are offline |
| Dataflow refresh fails | Whether the gateway is out of date, because Microsoft supports only the last six releases |
| A report works in Power BI Desktop but not through the gateway | Whether the server and database names match exactly between Desktop and the gateway data source |
Is the Power BI Gateway Free?
Microsoft provides the on-premises data gateway software at no charge, with no separate gateway license. Your costs come from elsewhere: the Power BI licenses your users need, the server you run the gateway on, and, for the VNet data gateway, the Fabric or Premium capacity it consumes. Licensing and pricing change, so confirm current terms directly with Microsoft.
Planning Gateways During a BI Migration
Teams moving to Power BI from legacy platforms usually need gateway design and report conversion at the same time. Our report conversion service preserves report logic from tools such as Crystal Reports and BusinessObjects, and the platform-specific paths are covered in our articles on MicroStrategy to Power BI and Power BI dashboard migration. If you are still comparing platforms, see Jaspersoft vs Power BI, MicroStrategy vs Power BI vs Tableau, Power BI vs Tableau, and Power BI vs IBM Cognos Analytics, plus the business case for why teams adopt Power BI. Our key checklist for BI modernization ties these decisions into one plan, and BI automation shortens the report conversion itself.
Frequently Asked Questions
Get Your Gateway Right with DataTerrain
Most gateway problems first appear as failed overnight refreshes, so the cheapest fix is getting sizing, ports, and permissions right at install. DataTerrain brings 17+ years of BI and data modernization experience and 400+ clients to Power BI gateway planning, report conversion, and the data layer behind it, with flexible engagement models and no long-term contracts. Start with our Power BI consulting services or our wider report conversion work.
Related Reading
Power BI vs Tableau | Power BI vs IBM Cognos Analytics | Power BI vs Cognos 2026 | Jaspersoft vs Power BI | Power BI vs SAP Crystal Reports | Power BI Consulting Services | Power BI Dashboard Migration | Power BI Analytics and BI Platforms | Why Adopt Microsoft Power BI | MicroStrategy to Power BI | Microsoft Fabric Migration Services | Reports Conversion Services | BI Reports and Dashboard Development | Key Checklist for Successful BI Modernization | How to Improve Data Security Compliance | Migrating Row-Level Security | Data Lake | ETL Solutions