Power BI authentication error for on premise data sources

[Anonymous]

Hello,

I'm unable to use a Power BI enterprise gateway which is installed on an Azure VM to access an on premise data source (file) due to "invalid connect credentials", error code: -2147467259.

However, the same gateway successfully connects to other Azure VM data sources.  The server on which the gateway is installed doesn't recognize the domain credentials for the on premise domain or 0365 tenant, which are in snyc.  Otherwise, I would try to change the credentials for the PBIEgwService to a domain account.  The actual stored credential for the data source isn't an issue since it works with an enterprise gateway installed on an on premise server.

I have also tried changing the following setting value to "https" to no avail:

C:\Program Files\On-premises data gateway\Microsoft.PowerBI.DataMovement.Pipeline.GatewayCore.dll.config

     <setting name="ServiceBusSystemConnectivityModeString" serializeAs="String">

        <value>AutoDetect</value>

Is it possible to configure the gateway on an Azure VM to access data sources on an on premise domain if the service cannot use a domain credential?

Thank you! 

[v-qiuyu-msft]

Hi @Anonymous,

It seems that you the on premise data source (file) exists on the on-premise server domain instead of Azure VM, right?

In your scenario, you need to make sure Azure VM network can communicates with on-premise server domain network. You need to configure VPN firstly. For more information, see:

Step-by-Step: Extending On-Premise Active Directory to the Cloud with Windows Azure – 31 Days of Servers in the Cloud – Part 20 of 31

Connect an on-premises network to a Microsoft Azure virtual network

Best Regards,
Qiuyun Yu

[Anonymous]

Thank you, Qiuyun!   That makes sense since our network currently supports connectivity from the on premise domain to the Azure VMs but not vice versa.  If we were to allow a VPN between the Azure VMs and an on premise server, would it still require an Active Directory sync, or is there a way to impersonate a domain account so that the gateway can connect to the on premise servers?