Power BI reports in DirectQuery mode - AzureVPN?

[sba_ur]

Hi,

I have a setup in my Power BI tenant such that a semantic model inside a workspace is connecting to SQL Server in Azure with a VNet gateway. The storage mode of the model is DirectQuery.

I have the following questions that I'd really appreciate if someone could help me with:

• Does a user need to connect to AzureVPN (which connects to the SQL Server as well) on their local machine to be able to load a report in Power BI service that based on the semantic model mentioned above?
• If the AzureVPN connection is required, the worspace admin flagged to me that their reports no longer require the AzureVPN connection to load - it loads anyway. They are unsure if the connection was required in the first place (the set up was done by a user who is no longer at the organization and there is no way to contact them). What can I do to help with this?
  
  

I will appreciate any insights. Thanks in advance!

[v-hashadapu]

Hi @sba_ur , hope you are doing great. May we know if your issue is solved or if you are still experiencing difficulties. Please share the details as it will help the community, especially others with similar issues.

[GrowthNatives · Accepted solution]

Hi @sba_ur 
Based on the setup you’ve described, users do not need to connect to Azure VPN on their local machine to view reports in the Power BI Service when the semantic model is configured with DirectQuery through a VNet gateway.

Here’s why:

• Once the dataset/semantic model is published to the Power BI Service and connected via a VNet gateway, all queries to Azure SQL are handled in the cloud by the gateway.

• Report consumers interact only with the Power BI Service in their browser, not directly with the SQL Server.

• A VPN connection is only required when using Power BI Desktop to connect directly to the database, because Desktop runs locally and needs network-level access.

The reason it may have seemed like VPN was required earlier is likely because initial development and testing were done in Power BI Desktop. After publishing and configuring the dataset with the VNet gateway, the VPN was no longer necessary, but that change wasn’t clearly documented.

To confirm your current setup:

1. In the Power BI Service, go to Workspace → Semantic model → Settings → Data source credentials and check which gateway is being used. If you see the VNet gateway selected, then VPN is not required.

2. Try accessing the report in the Service with the VPN disconnected — if it loads, that proves connectivity is handled through the gateway.

3. In Azure SQL Server settings, verify that firewall rules and VNet configurations are restricted to the gateway subnet, ensuring traffic is properly routed through the gateway.
   
   
   ⭐Hope this solution helps you make the most of Power BI! If it did, click 'Mark as Solution' to help others find the right answers.
   💡Found it helpful? Show some love with kudos 👍 as your support keeps our community thriving!
   🚀Let’s keep building smarter, data-driven solutions together! 🚀 [Explore More]