On-premise Gateway - Data Encryption from Oracle

[XhevahirMehalla]

Hello -

I have a hybrid solution:

1. Data Source Oracle OCI 
2. Using azure synapse analytics to extract data from Oracle and save them to Data Lake - will migrate at some point
3. Using azure SQL db as DWH
4. using a VM in azure to install Self-hosted IR and installed an oracle certificate to help with data encryption on Oracle port 2484. This works fine.
5. Using PBI service and desktop to produce reports (some real time reports - hence using another azure VM to install on-premise Gateway on that machine). 
6.  We want to make sure that data is encrypted while using on-premise gateway VM. How can I implement something similar with as step 4 (Self-hosted IR VM). How do I make sure that Data extracted from Oracle OCI db using Pbi direct access make sure that data is protected on-transit?

Please can you help!

Thanks

[v-pgoloju]

Hi @XhevahirMehalla,

Just following up to see if the Response provided by community members were helpful in addressing the issue. if the issue still persists Feel free to reach out if you need any further clarification or assistance.

Best regards,
Prasanna Kumar

[v-pgoloju]

Hi @XhevahirMehalla,

Thank you for reaching out to the Microsoft Fabric Forum Community, and special thanks to @Jaywant-Thorat and @SavioFerraz  for prompt and helpful responses.

Just following up to see if the Response provided by community members were helpful in addressing the issue. if the issue still persists Feel free to reach out if you need any further clarification or assistance.

Best regards,
Prasanna Kumar

[SavioFerraz · Accepted solution]

Hi @XhevahirMehalla,

This concern arises because Power BI Gateway encryption works differently from Azure Data Factory or Self-hosted Integration Runtime. In ADF/Synapse, you explicitly control Oracle network encryption using TCPS (port 2484) and Oracle Wallets. With Power BI, the gateway itself does not terminate or manage database-level encryption; it relies on the data source connection configuration to ensure data is encrypted in transit.

From a technical perspective, to protect Oracle data accessed through the On-premises Data Gateway, you must enforce Oracle native network encryption (TCPS) end to end. This means configuring the Oracle client on the gateway VM to use TCPS with Oracle Wallet, ensuring Power BI connects via the encrypted Oracle protocol. Power BI Desktop → Power BI Service → Gateway traffic is already encrypted using Azure Service Bus over TLS, so the remaining responsibility is securing the Oracle-to-Gateway leg.

Key point:
Power BI Gateway traffic is always encrypted to the Power BI Service, but Oracle-to-Gateway encryption must be enforced at the Oracle client and listener level using TCPS (SSL/TLS).

Helpful sources:

Power BI Gateway security

https://learn.microsoft.com/power-bi/connect-data/service-gateway-onprem

https://learn.microsoft.com/power-bi/enterprise/service-admin-gateway

Oracle network encryption (TCPS / SSL)

https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/configuring-secure-sockets-layer...

Power BI + Oracle connectivity

https://learn.microsoft.com/power-bi/connect-data/desktop-connect-oracle-database

Microsoft Learn (recommended):

https://learn.microsoft.com/training/modules/power-bi-security-model/

Savio Ferraz | Microsoft Ambassador Edurocks and MinecraftEdu | Microsoft Learning Consulting | Google Certified Trainer and GEG Community Manager Diadema

Did my answer help? Mark my post as a solution or like it if you found it useful.

[Jaywant-Thorat]

How to ensure Oracle >> Power BI data is encrypted via On-prem Gateway?

1. Oracle → Gateway VM (YOU configure this)

• Use TCPS (SSL) on port 2484

• Oracle Wallet + certificate installed on Gateway VM

• Oracle client configured with:

  • ENCRYPTION_CLIENT = REQUIRED

  • AES256

• Power BI connects using TCPS connection string

Result: Data is encrypted in transit from Oracle to Gateway

2. Gateway VM → Power BI Service (AUTO)

• Always encrypted by Microsoft

• Uses TLS 1.2+

• Outbound-only connection

• No configuration needed

Result: Data is encrypted in transit to Power BI

3.  DirectQuery or Import

• Import → encrypted once, stored securely

• DirectQuery → encrypted on every query (TCPS is mandatory)

---

Final Answer : If Oracle uses TCPS (2484) and Power BI uses the On-prem Gateway, then data is fully encrypted in transit end-to-end.

You already have the right setup — just document TCPS for audits.

=================================================================
Did I answer your question? Mark my post as a solution! This will help others on the forum!

Appreciate your Kudos!!

Jaywant Thorat | MCT | Data Analytics Coach
LinkedIn: https://www.linkedin.com/in/jaywantthorat/
Join #MissionPowerBIBharat = https://shorturl.at/5ViW9
#MissionPowerBIBharat
LIVE with Jaywant Thorat from 10 Jan 2026
8 Days | 8 Sessions | 1 hr daily | 100% Free

[XhevahirMehalla]

Hi Jay,

Please can you help me what I need to for this.

I need the steps which are required to setup this.

I have DBAs which can help me and I have access to Power BI service (admin) role.

Please can you let me know the steps what each need to do?

 Each of the steps below I need more information.

Pls can you help me!

• Use TCPS (SSL) on port 2484

• Oracle Wallet + certificate installed on Gateway VM

• Oracle client configured with:

  • ENCRYPTION_CLIENT = REQUIRED

  • AES256

• Power BI connects using TCPS connection string