Forum Discussion
Post PatronFabric - Mirroring SQLServer MI - Gateway
Hi fabricpribeiro ,
P1. It depends on the level of security you want to apply to data movement. The main difference, and the reason it is typically used, is related to network security. It also provides additional control over data movement security, auditing, and connectivity isolation.
More: https://learn.microsoft.com/en-us/data-integration/vnet/overview
P2. I have reviewed the documentation, and the first part of the paragraph is missing in this section:
"If your Azure SQL Managed Instance is not publicly accessible, create a virtual network data gateway or on-premises data gateway to mirror the data. Make sure the Azure Virtual Network or gateway server's network can connect to the Azure SQL Managed Instance via a private endpoint."
The documentation states that if the Azure SQL Managed Instance is not publicly accessible, you must create either a Virtual Network data gateway or an on-premises data gateway to replicate the data. Additionally, the gateway network must be able to connect to the SQL Managed Instance through a Private Endpoint.
Therefore, the Private Endpoint mentioned in the requirement refers to the Azure SQL Managed Instance Private Endpoint (source side), not the Fabric SQL Analytics Endpoint.
If my comment helped solve your question, it would be great if you could like the comment and mark it as the accepted solution. It helps others with the same issue and also motivates me to keep contributing.
Thanks a lot, I really appreciate it.
Hi fabricpribeiro ,
1. The Virtual Network Data Gateway is an Azure resource created in the Azure portal. It is designed specifically for Fabric/Power BI connectivity, not as a VPN gateway. Once deployed, you link it to your Fabric workspace and set it up to connect to your SQL Managed Instance using its private endpoint.2. For identity, it’s best to use a Service Principal rather than a workspace identity. This prevents the gateway from being tied to a personal account and allows for better management.
In SQL MI, grant the Service Principal connect permission and roles such as db_datareader and db_datawriter, based on your mirroring requirements.
In Fabric, assign Contributor or Admin rights so it can manage the connection through the gateway.
Traffic between Fabric and SQL MI is encrypted in transit using TLS, and SQL MI uses Transparent Data Encryption for data at rest. The VNet gateway keeps traffic within Azure’s backbone network, offering improved security and lower latency compared to an on premises gateway.
Helpful documentsCreate virtual network (VNet) data gateways | Microsoft Learn
What is a virtual network (VNet) data gateway | Microsoft Learn
Hope this helps please let us know if you need any additional details.
Super UserHi fabricpribeiro ,
P1. It depends on the level of security you want to apply to data movement. The main difference, and the reason it is typically used, is related to network security. It also provides additional control over data movement security, auditing, and connectivity isolation.
More: https://learn.microsoft.com/en-us/data-integration/vnet/overview
P2. I have reviewed the documentation, and the first part of the paragraph is missing in this section:
"If your Azure SQL Managed Instance is not publicly accessible, create a virtual network data gateway or on-premises data gateway to mirror the data. Make sure the Azure Virtual Network or gateway server's network can connect to the Azure SQL Managed Instance via a private endpoint."
The documentation states that if the Azure SQL Managed Instance is not publicly accessible, you must create either a Virtual Network data gateway or an on-premises data gateway to replicate the data. Additionally, the gateway network must be able to connect to the SQL Managed Instance through a Private Endpoint.
Therefore, the Private Endpoint mentioned in the requirement refers to the Azure SQL Managed Instance Private Endpoint (source side), not the Fabric SQL Analytics Endpoint.
If my comment helped solve your question, it would be great if you could like the comment and mark it as the accepted solution. It helps others with the same issue and also motivates me to keep contributing.
Thanks a lot, I really appreciate it.