Forum Discussion
On Premise Data Gateway - Better Admin Support
Thank you for mentioning
C:\Program Files\On-premises data gateway\FabricIntegrationRuntime\5.0\Shared\FabricPipelineWorker.exe.config
One more file to keep track of for proxy settings, sigh.
If this is important to you please consider voting for an existing idea or raising a new one at https://ideas.fabric.microsoft.com
Hi Maderthaner
Thank you for reaching out to the Microsoft Fabric Community Forum.
We understand your concern regarding the challenges with the On-Premises Data Gateway (OPDG) administration, particularly the outdated documentation for configuring proxy settings, which mentions incorrect file names, and the complex Kerberos configuration process requiring domain admin intervention, SPN creation, and delegation setup across your 10+ OPDG servers.
Proxy Settings Solution
Since a GUI for proxy configuration is not yet available in the OPDG, we recommend manually editing the following configuration files on each OPDG server to include proxy settings, as suggested by lbendlin .
Use the updated file name FabricPipelineWorker.exe.config for Fabric workloads:
C:\Program Files\On-premises data gateway\FabricPipelineWorker.exe.config (for Fabric)
C:\Program Files\On-premises data gateway\Microsoft.PowerBI.EnterpriseGateway.exe.config
Kerberos Readiness Solution
Although a fully automated Kerberos setup or removal of NTLM as the default is not currently available, we can simplify the configuration process:
Centralize Configuration with a Domain Account: Use a single domain account (e.g., CONTOSO\GatewaySvc) for all OPDG servers. Configure this account via the On-Premises Data Gateway app under Service Settings > Change Service Account, enter the credentials, and restart the gateway service. This requires domain admin rights only once per account.
Configure SPN and Delegation: As a domain administrator, create a single SPN using:
setspn -S gateway/OPDG01 CONTOSO\GatewaySvc
Replace OPDG01 with one server name (reusable across servers). In Active Directory Users and Computers (ADUC), navigate to the CONTOSO\GatewaySvc account, go to the Delegation tab, select Trust this user for delegation to specified services only > Use Kerberos only, and add the relevant service types (e.g., MSSQLSvc) and server names for your data sources. Apply this configuration once.
If this response resolves your query, kindly mark it as an Accepted Solution to assist other community members. A Kudos is also appreciated if you found the response helpful.
Thank You!
Hi,
thanks for the hints - that I am aware of - but the request was to get help in automatic administration of these apps. I don't want to do these steps every time I update my gateway accounts.
I dont want to add every data source & server & service & account in the delegation tab to be Kerberos ready. And I don't think its best practice to use a single domain account for all different data gateways, but that's maybe just me.
also the location is wrong:
C:\Program Files\On-premises data gateway\FabricIntegrationRuntime\5.0\Shared\FabricPipelineWorker.exe.config
Hi Maderthaner
We apologize for the inconvenience. Since the auto-update for OPDG is currently unavailable, you can submit the idea in the forum (which you have already done), gather as many likes as possible (as they may prioritize the most requested features), and wait for Microsoft to roll it out as a feature. We hope your issue gets resolved soon.
Thank you.