More information on encryption methods used by the Enterprise Gateway

[mjfulke]

Hello,  

I need to provide more detailed information on how the enterprise gateway securely transmits data over servicebus.  Before the security team will approve use of the Enterprise Gateway we need more about the methods and protocols used on the non-standard ports

Information provided at https://powerbi.microsoft.com/en-us/documentation/powerbi-gateway-enterprise/#ports is good but they need to know specifically what is being used to encrypt communication over 9350-9354 and more details about AMQP over 5671-5672 (is it using Kerberos and SSL). The more detail the better...   Thank you

[Greg_Deckler]

Oh, one other thing, and I believe it is on port 9350 but may have that specific port wrong, but if you see data going to Brazil over that port, that is likely telemetry data and you can turn that off when you configure the gateway.

[mjfulke]

Thanks for your reply.

[Greg_Deckler]

Here are a few things to consider looking at:

1. Reference link to the trust center article. It is a listing of ISO, HIPAA and other security/privacy certifications of Power BI by independent auditors: https://powerbi.microsoft.com/en-us/blog/power-bi-added-to-microsoft-trust-center/
2. Power BI Security article with the link to whitepaper: https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-power-bi-security/
3. Local Enterprise Gateway service communicates with Power BI Service via secure connection to a designated range of IP addresses.  The Gateway creates outbound connection to Azure Service Bus and there are no inbound ports.  You can find more details here: https://powerbi.microsoft.com/en-us/documentation/powerbi-gateway-enterprise/#Ports
4. I know that the Power BI team is available for deep dives on the Enterprise Gateway, you might try contacting Sergei Gundorov, sergeig@microsoft.com, and ask if you could set one up. 

[Greg_Deckler]

One other tidbit of information, and this is specific to iOS but perhaps similar encryption methods are used by the gateway, for the iOS app,

• Local cache of security tokens are encrypted by ADAL and OS (Keychain in particular).
• Local cache of other stuff is encrypted as long as Intune enforces overall drive encryption.