Forum Discussion
Updating the On-Premises Data Gateway
There is a new preview feature that allows updating the on-premises data gateway from the UI. A user performed this update without notifying me (the admin) that he was going to do it. Thankfully, it was just a dev environment, but that still should have gone through change management. He only has Connection Creator rights on the data gateway, so I'm surprised he was able to update through the UI.
What permissions does a user need to be able to update the data gateway through the UI? Is there a way to prevent non-admin users from performing the updates this way?
Thank you, djurecic, GilbertQ and tayloramy for your responses.
Hi techresa,
We appreciate your inquiry on the Microsoft Fabric Community Forum.
Based on our understanding, the behavior you observed is related to the new on-premises data gateway update experience, which is currently available as a preview feature. During this preview phase, role-based access control (RBAC) may not be fully enforced. While Microsoft documentation states that only Gateway Administrators should manage and update gateways, preview capabilities may temporarily allow broader roles such as Connection Creators to trigger updates.
At present, there is no tenant level or gateway level setting to restrict the gateway update user interface exclusively to administrators. As a best practice, you should enforce the principle of least privilege by reviewing and limiting gateway roles. You should also use separate gateways for DEV, TEST, and PROD environments to reduce risk, and monitor gateway related activities using audit logs.
Additionally, please refer to the links below:
Update an on-premises data gateway | Microsoft Learn
View and manage on-premises data gateways - Power Platform | Microsoft Learn
Manage security roles | Microsoft Learn
On-premises data gateway December 2025 release | Microsoft Fabric Blog | Microsoft FabricWe hope the information provided will help resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.
Thank you.
12 Replies
- djurecic
Super User
This is a good question- I've looked at the documentation and it does not specify. I will try to find out more, or maybe someone else will post the answer and link to docs here.
Thanks for reviewing the documentation. It confirms that I didn't overlook something. Fingers crossed the GA version will address this concern.
- GilbertQ
Hi techresa
Unfortunately what sometimes happens with these newer products is that the permissioning is a bit too high, meaning the user with the creator access can then update it through the UI. My recommended path would be is to do some training and understanding of what the implications are for doing an unscheduled gateway update and hopefully then in future the user will then understand this and come to you before simply updating the gateway.
Thank you for the reply. I understand that user training is important. I can lead a horse to drink (or not drink), but... I am keeping my fingers crossed that Microsoft will resolve the issue before the feature goes GA.
Hi and thank you for responding. Since Microsoft doesn't support preview features, I'm not able to open a ticket with them right now. Once it goes GA, I will check for permission controls and then take the necessary steps.
v-pnaroju-msftCommunity Support
Thank you, djurecic, GilbertQ and tayloramy for your responses.
Hi techresa,
We appreciate your inquiry on the Microsoft Fabric Community Forum.
Based on our understanding, the behavior you observed is related to the new on-premises data gateway update experience, which is currently available as a preview feature. During this preview phase, role-based access control (RBAC) may not be fully enforced. While Microsoft documentation states that only Gateway Administrators should manage and update gateways, preview capabilities may temporarily allow broader roles such as Connection Creators to trigger updates.
At present, there is no tenant level or gateway level setting to restrict the gateway update user interface exclusively to administrators. As a best practice, you should enforce the principle of least privilege by reviewing and limiting gateway roles. You should also use separate gateways for DEV, TEST, and PROD environments to reduce risk, and monitor gateway related activities using audit logs.
Additionally, please refer to the links below:
Update an on-premises data gateway | Microsoft Learn
View and manage on-premises data gateways - Power Platform | Microsoft Learn
Manage security roles | Microsoft Learn
On-premises data gateway December 2025 release | Microsoft Fabric Blog | Microsoft FabricWe hope the information provided will help resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.
Thank you.
v-pnaroju-msft tayloramy GilbertQ djurecic
Has anyone tried disabling the "On-premises Data Gateway Updater Service" on the Data Gateway server?
Thanks to everyone who responded! I have shared my concerns with a friend who is an MVP in the Data and AI arena. Since MVPs have access to the Product Group, I'm confident my concerns will be brought to the PG's attention.
- v-pnaroju-msft
Hi techresa,
Thank you for the update. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.
Thank you.
- v-pnaroju-msft
Hi techresa,
Based on our understanding, disabling the OnPremises Data Gateway Updater Service might not be a recommended approach as a control mechanism to restrict updates. Although it may technically prevent both UI triggered and automatic updates, it could leave the gateway in an unsupported or unhealthy state. This may hinder the application of critical security patches and could result in compatibility or refresh issues.
Thank you.Thanks for weighing in. I'm going to test it today in a Dev environment that isn't being used yet. I'll report back with my findings. (I might not get far since the data gateway is already running the March update.)
