Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Microsoft is giving away 50,000 FREE Microsoft Certification exam vouchers. Get Fabric certified for FREE! Learn more

Reply
Maderthaner
Frequent Visitor

On Premise Data Gateway - Better Admin Support

Hey guys,

 

we really love using Fabric and are rolling it out big in our company.

 

We are still largely running on on-premise data sources, which requires us to use multiple On Premise Data Gateway servers.

 

The app works reasonly well, although I really ask for your support on making the administration on two things much better: 1) proxy settings, and 2) Kerberos-readiness

 

1) Proxies

The information in the documentation is outdated: Configure proxy settings for the on-premises data gateway (Konfigurieren von Proxyeinstellungen für ...

The fourth file is now called FabricPipelineWorker.exe.config - but really, we would love it if we could just enter the proxy in the GUI as it works for the Synapse On Premise Integration Runtimes so that the administration becomes easier!

 

2) Kerberos-readiness

Our company started turning off NTLM more and more and we need to switch to a Kerberos ready On Premise Data Gateway (OPDG) service. The information provided here: Configure Kerberos-based SSO from Power BI service to on-premises data sources - Power BI | Microsof... is daunting. If I need to do all of this on all my 10+ OPDG servers, every month or so there is an update (as updates often eat the settings, for example with the proxy), I almost feel like I need to hire a working student to go through this exercise every few months or so. Can you make this simpler for us? for example, configure once and ensure a proper takeover from update to update of the OPDG, better documentation, best practices or just start rooting out the NTML "default" in the first place.

 

Let me know your thoughts or hints - maybe we are doing it wrong - but the corporate guidelines on proxy and NTLM seem untouchable.

5 REPLIES 5
v-karpurapud
Community Support
Community Support

Hi @Maderthaner 

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

v-karpurapud
Community Support
Community Support

Hi @Maderthaner 


Thank you for reaching out to the Microsoft Fabric Community Forum.

 

We understand your concern regarding  the challenges with the On-Premises Data Gateway (OPDG) administration, particularly the outdated documentation for configuring proxy settings, which mentions incorrect file names, and the complex Kerberos configuration process requiring domain admin intervention, SPN creation, and delegation setup across your 10+ OPDG servers.

 

Proxy Settings Solution

Since a GUI for proxy configuration is not yet available in the OPDG, we recommend manually editing the following configuration files on each OPDG server to include proxy settings, as suggested by @lbendlin .

Use the updated file name FabricPipelineWorker.exe.config for Fabric workloads:

        C:\Program Files\On-premises data gateway\FabricPipelineWorker.exe.config (for Fabric)

        C:\Program Files\On-premises data gateway\Microsoft.PowerBI.EnterpriseGateway.exe.config

 

Kerberos Readiness Solution

 

Although a fully automated Kerberos setup or removal of NTLM as the default is not currently available, we can simplify the configuration process:
 

Centralize Configuration with a Domain Account: Use a single domain account (e.g., CONTOSO\GatewaySvc) for all OPDG servers. Configure this account via the On-Premises Data Gateway app under Service Settings > Change Service Account, enter the credentials, and restart the gateway service. This requires domain admin rights only once per account.

Configure SPN and Delegation: As a domain administrator, create a single SPN using:

 

setspn -S gateway/OPDG01 CONTOSO\GatewaySvc

 

Replace OPDG01 with one server name (reusable across servers). In Active Directory Users and Computers (ADUC), navigate to the CONTOSO\GatewaySvc account, go to the Delegation tab, select Trust this user for delegation to specified services only > Use Kerberos only, and add the relevant service types (e.g., MSSQLSvc) and server names for your data sources. Apply this configuration once.

 

If this response resolves your query, kindly mark it as an Accepted Solution to assist other community members. A Kudos is also appreciated if you found the response helpful.
 

Thank You!

Hi,

 

thanks for the hints - that I am aware of - but the request was to get help in automatic administration of these apps. I don't want to do these steps every time I update my gateway accounts.

I dont want to add every data source & server & service & account in the delegation tab to be Kerberos ready. And I don't think its best practice to use a single domain account for all different data gateways, but that's maybe just me.

lbendlin
Super User
Super User

Thank you for mentioning

 

C:\Program Files\On-premises data gateway\FabricIntegrationRuntime\5.0\Shared\FabricPipelineWorker.exe.config

 

One more file to keep track of for proxy settings, sigh.

 

If this is important to you please consider voting for an existing idea or raising a new one at https://ideas.fabric.microsoft.com

Yeah, I raised the OPDG auto update idea like many months ago. Not sure where that is 😕

Helpful resources

Announcements
MarchFBCvideo - carousel

Fabric Monthly Update - March 2025

Check out the March 2025 Fabric update to learn about new features.

Notebook Gallery Carousel1

NEW! Community Notebooks Gallery

Explore and share Fabric Notebooks to boost Power BI insights in the new community notebooks gallery.

April2025 Carousel

Fabric Community Update - April 2025

Find out what's new and trending in the Fabric community.

"); $(".slidesjs-pagination" ).prependTo(".pagination_sec"); $(".slidesjs-pagination" ).append("
"); $(".slidesjs-play.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-stop.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-pagination" ).append(""); $(".slidesjs-pagination" ).append(""); } catch(e){ } /* End: This code is added by iTalent as part of iTrack COMPL-455 */ $(".slidesjs-previous.slidesjs-navigation").attr('tabindex', '0'); $(".slidesjs-next.slidesjs-navigation").attr('tabindex', '0'); /* start: This code is added by iTalent as part of iTrack 1859082 */ $('.slidesjs-play.slidesjs-navigation').attr('id','playtitle'); $('.slidesjs-stop.slidesjs-navigation').attr('id','stoptitle'); $('.slidesjs-play.slidesjs-navigation').attr('role','tab'); $('.slidesjs-stop.slidesjs-navigation').attr('role','tab'); $('.slidesjs-play.slidesjs-navigation').attr('aria-describedby','tip1'); $('.slidesjs-stop.slidesjs-navigation').attr('aria-describedby','tip2'); /* End: This code is added by iTalent as part of iTrack 1859082 */ }); $(document).ready(function() { if($("#slides .item").length < 2 ) { /* Fixing Single Slide click issue (commented following code)*/ // $(".item").css("left","0px"); $(".item.slidesjs-slide").attr('style', 'left:0px !important'); $(".slidesjs-stop.slidesjs-navigation").trigger('click'); $(".slidesjs-previous").css("display", "none"); $(".slidesjs-next").css("display", "none"); } var items_length = $(".item.slidesjs-slide").length; $(".slidesjs-pagination-item > button").attr("aria-setsize",items_length); $(".slidesjs-next, .slidesjs-pagination-item button").attr("tabindex","-1"); $(".slidesjs-pagination-item button").attr("role", "tab"); $(".slidesjs-previous").attr("tabindex","-1"); $(".slidesjs-next").attr("aria-hidden","true"); $(".slidesjs-previous").attr("aria-hidden","true"); $(".slidesjs-next").attr("aria-label","Next"); $(".slidesjs-previous").attr("aria-label","Previous"); //$(".slidesjs-stop.slidesjs-navigation").attr("role","button"); //$(".slidesjs-play.slidesjs-navigation").attr("role","button"); $(".slidesjs-pagination").attr("role","tablist").attr("aria-busy","true"); $("li.slidesjs-pagination-item").attr("role","list"); $(".item.slidesjs-slide").attr("tabindex","-1"); $(".item.slidesjs-slide").attr("aria-label","item"); /*$(".slidesjs-stop.slidesjs-navigation").on('click', function() { var itemNumber = parseInt($('.slidesjs-pagination-item > a.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); });*/ $(".slidesjs-stop.slidesjs-navigation, .slidesjs-pagination-item > button").on('click keydown', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); var itemNumber = parseInt($('.slidesjs-pagination-item > button.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); }); $(".slidesjs-play.slidesjs-navigation").on('click', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); }); $(".slidesjs-pagination-item button").keyup(function(e){ var keyCode = e.keyCode || e.which; if (keyCode == 9) { e.preventDefault(); $(".slidesjs-stop.slidesjs-navigation").trigger('click').blur(); $("button.active").focus(); } }); $(".slidesjs-play").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-stop").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-play")) { $(".slidesjs-stop").focus(); } } }); $(".slidesjs-stop").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-play").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-stop")) { $(".slidesjs-play").focus(); } } }); $(".slidesjs-pagination-item").keydown(function(e){ switch (e.which){ case 37: //left arrow key $(".slidesjs-previous.slidesjs-navigation").trigger('click'); e.preventDefault(); break; case 39: //right arrow key $(".slidesjs-next.slidesjs-navigation").trigger('click'); e.preventDefault(); break; default: return; } $(".slidesjs-pagination-item button.active").focus(); }); }); // Start This code is added by iTalent as part of iTrack 1859082 $(document).ready(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); $("#tip2").attr("aria-hidden","true").addClass("hidden"); $(".slidesjs-stop.slidesjs-navigation, .slidesjs-play.slidesjs-navigation").attr('title', ''); $("a#playtitle").focus(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").mouseover(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").blur(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#playtitle").mouseleave(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#play").keydown(function(ev){ if (ev.which ==27) { $("#tip1").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); $("a#stoptitle").focus(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").mouseover(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").blur(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").mouseleave(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").keydown(function(ev){ if (ev.which ==27) { $("#tip2").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); }); // End This code is added by iTalent as part of iTrack 1859082