Moving to PowerBI (Azure SaaS)

Hi,

We are running PowerBI on-prem and are beginning the move to PowerBI SaaS within Azure. I have a few high-level questions I was hoping someone would be able to answer for me. Thanks!!!!

1. With PowerBi (default) Pro / Premium, I understand data is encrypted at rest. Are a lot of people utilizing the Tenant-level storage for Azure Data Lake Gen2 for landing their Dataflows?

2. When going to PowerBi Premium (Per-User / Capacity), is there a large performance boost when landing the Workspaces on dedicated Containers? Are there any websites / blogs showing comparision metrics to review?

3. I'm assuming with PowerBi SaaS ... it's just like Office 365 Exchange Online. You don't place "Firewalls / WAFs / Filtering" in front- of it for any DDoS, IPS, ACL style filterting or protecting as you're leaving this to Microsoft. But like in Exchange Online MX Records, you can use different products above to filter out bad traffic. Are there any tools, products or services out there which do that?

4. How does PowerBi work with Expressroute? We currently leverage Expressroute via Private Registration so does this mean in order to fully utilize it, we would need a Premium account w/ the Microsoft Private Endpoint? Once established ... PowerBi -> Endpoint -> vNet -> Expressroute ... we could further encapsulate and manage the traffic to our on-prem SQL resources (connected too via On-prem Data Gateway) right?

5. Are able to change the DNS FQDN to PowerBI associated with our tenant (aside from placing a CNAME in Public DNS)? Can we install our own SSL Certificate into PowerBI?