Forum Discussion
On-Premises Gateway Administrator
There's a difference between the Administrator (who is responsible for setting up Data Sources within the Gateway) and "named users" who are simply allowed to set up refresh in reports using the Gateway.
You want to use a Service Account for the credentials in almost any Data Source you set up in the Gateway. However, that Service Account does not need to be an Administrator of the Gateway, OR a named user on a particular Gateway data source. In fact, you really SHOULDN'T put the service account on there in either capacity.
The Administrator of the Gateway should be a "real person" with a real Windows account, who has admin rights on the machine on which the Gateway is installed. That person then has rights to set up Gateway Data Sources within the Gateway.
The Administrator would use the Service Account's credentials when they establish a connection to a particular data source (i.e. a particular database). In other words, the Service Account is for the actual data source. You want to use a Service Account for this for a number of reasons: for security purposes (since that user typically needs pretty wide-ranging access to objects within the data source), to avoid password expiration issues, etc.
So then, in order to allow users to set up Scheduled Refresh, etc, on a given dataset in the Power BI Service, those users must be specifically added to the Gateway Data Source. This gives them effective permissions to set up a Refresh Schedule for that dataset using the Gateway.
No question that this is all a little convoluted, and not necessarily well-explained in the docs....
There's a difference between the Administrator (who is responsible for setting up Data Sources within the Gateway) and "named users" who are simply allowed to set up refresh in reports using the Gateway.
You want to use a Service Account for the credentials in almost any Data Source you set up in the Gateway. However, that Service Account does not need to be an Administrator of the Gateway, OR a named user on a particular Gateway data source. In fact, you really SHOULDN'T put the service account on there in either capacity.
The Administrator of the Gateway should be a "real person" with a real Windows account, who has admin rights on the machine on which the Gateway is installed. That person then has rights to set up Gateway Data Sources within the Gateway.
The Administrator would use the Service Account's credentials when they establish a connection to a particular data source (i.e. a particular database). In other words, the Service Account is for the actual data source. You want to use a Service Account for this for a number of reasons: for security purposes (since that user typically needs pretty wide-ranging access to objects within the data source), to avoid password expiration issues, etc.
So then, in order to allow users to set up Scheduled Refresh, etc, on a given dataset in the Power BI Service, those users must be specifically added to the Gateway Data Source. This gives them effective permissions to set up a Refresh Schedule for that dataset using the Gateway.
No question that this is all a little convoluted, and not necessarily well-explained in the docs....