Using Power BI in a Hybrid

Environment
Summary: Many organizations are taking advantage of the benefits of cloud computing such as
lower capital expenditures and increased agility, while still maintaining data in on-premises data
stores. This paper describes best practices for security, networking, and component architecture
for building a hybrid business intelligence (BI) environment by using a combination of Microsoft
Office 365, Microsoft Azure, and on-premises data sources.

Writers: Joseph D'Antoni, Stacia Misner

Technical Reviewers: Ed Price, Carla Sabotta, Cindy Gross, Olivier Matrat, Kay Unkroth,
Derrick VanArnam, Adam Saxton, David Torres, Greg Low, Ross LoForte
Published: August, 2014
Applies to: SQL Server, Microsoft Power BI, Microsoft Azure

Copyright
This document is provided as-is. Information and views expressed in this
document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it.
Some examples depicted herein are provided for illustration only and are fictitious.
No real association or connection is intended or should be inferred.
This document does not provide you with any legal rights to any intellectual
property in any Microsoft product. You may copy and use this document for your
internal, reference purposes.
2014 Microsoft. All rights reserved.

Table of Contents
Introduction................................................................................................................... 4
Cloud Computing Definitions........................................................................................ 4
Cloud-Only Model....................................................................................................... 5
Azure..................................................................................................................... 6
Office 365............................................................................................................... 6
Hybrid Cloud Model.................................................................................................... 7
Hybrid Architecture....................................................................................................... 10
Hybrid Environment with PaaS................................................................................... 10
Hybrid Environment with IaaS..................................................................................... 10
Azure Virtual Network............................................................................................ 10
Azure VMs........................................................................................................... 12
Security...................................................................................................................... 14
Office 365 Security................................................................................................... 14
Azure Security......................................................................................................... 15
Active Directory Integration........................................................................................ 15
Active Directory and Office 365................................................................................ 15
Active Directory and Azure IaaS.............................................................................. 17
Office 365 and Azure Security Compliance...................................................................17
Power BI.................................................................................................................... 18
Power BI Features.................................................................................................... 18
Power BI in Excel.................................................................................................. 18
Power BI for Office 365.......................................................................................... 19
Power BI Data Refresh.............................................................................................. 20
OData Feeds for Non-Refreshable Data Sources.......................................................21
Power BI Cloud Data Sources................................................................................. 21
Azure VM Running SQL Server as a Data Source......................................................24
Data Management Gateway....................................................................................... 24
Data Source Registration........................................................................................ 25
OData Feeds from Power BI Data Sources...............................................................28
Power Query Data Refresh for On-Premises Data......................................................31
Conclusion.................................................................................................................. 31
Author Bios................................................................................................................. 32

Introduction
This document details the tasks necessary to implement Microsoft Power BI for Office 365 in a
hybrid environment. It describes best practices for security, networking, and component
architecture for building a hybrid business intelligence (BI) environment by using a combination
of Microsoft Office 365, Microsoft Azure, and on-premises data sources.
In addition, we describe options and best practices for each service you might include in a
hybrid environment. This document also provides guidance for integrating security and identity
management in a hybrid environment, as well as how to configure Power BI to refresh data from
supported sources within this environment.
Note Because Azure services can change frequently, please refer to the Microsoft Azure website for the offerings
and range of features currently available.

The goal of this document is to help you understand how to design an architecture in which
these services can securely interact not only with each other, but also with your on-premises
environment.
The target audience for this document is system and network administrators as well as business
intelligence (BI) solution architects and developers who want to implement Power BI for Office
365 in a hybrid environment. To get the most out of this document, you should have a basic
understanding of virtual private network (VPN) connections and cloud computing. To learn more
about cloud computing, see Microsoft Azure, the Microsoft Azure Infographic (all Azure
Infographics), and Get Started with Office 365. To learn more about VPNs, see Connect an onpremises network to a Microsoft Azure virtual network.

Cloud Computing Definitions

There are a few terms that are unique to cloud computing. In this document, the following
definitions apply:
Cloud Computing The National Institute for Standards and Technology defines cloud
computing as a model for enabling ubiquitous, convenient, on-demand network access to a
shared pool of computing resources (e.g. networks, servers, storage, applications, and services)
that can be rapidly provisioned and released with minimal management effort or service
provider interaction.
Infrastructure as a Service (IaaS) The capability to provision storage, archive, network, and
server resources in a shared environment. Typically, server resources are deployed as virtual
machines (VMs). The management of the server operating systems and other resources within
this environment is performed by the customer, but the management of the underlying hardware
and hypervisor is performed by the provider. Azure Virtual Machines and Azure Virtual Networks
are key components of IaaS available in Azure.
Hybrid Cloud An infrastructure that bridges on-premises computing resources and a public
cloud. A hybrid cloud environment may be used for functionality such as cloud bursting (i.e.
sending a workload to the cloud when on-premises resources have been exhausted) or disaster
recovery.
Platform as a Service (PaaS) The capability for the customer to deploy application tiers, such
as a database or a web service, to a container managed by the provider. The customer does not
manage operating systems or infrastructure in this model, but has control over their application,
4

data, and possibly some configuration settings. Azure SQL Database or HDInsight are examples
of PaaS in Azure.
Power BI The combined Microsoft self-service business intelligence solution. Power BI is a
separate service for Office 365 and includes several features in Excel 2013 (Power Pivot, Power
View, Power Query, and Power Map). For the differences between Power BI in Excel 2013 and
Power BI for Office 365, see the Power BI section below.
Public Cloud Cloud resources are available for use by the general public and exist in the data
centers of the cloud provider.
Private Cloud A virtualization infrastructure provisioned for use by a single organization or
department within that organization. It may exist on or off the organizations premises.
Software as a Service (SaaS) The capability for the customer to use the providers
applications running on the providers cloud infrastructure. The applications are broadly
accessible from an Internet browser. Although the customer does not manage any of the
underlying infrastructure, the customer manages content and possibly some limited
configuration settings. Office 365 is an example of an SaaS offering.

Cloud-Only Model
Microsoft offers a variety of services that you can use independently or in combination with one
another to architect a business intelligence solution in the cloud. A portion of this type of solution
relies on IaaS or PaaS services available through Azure, while the remainder of the solution
relies on Office 365, as shown in Figure 1. Although these services are all cloud-based, its
important to understand that Azure and Office 365 operate in separate containers, including the
network and authentication layers.

Figure 1: Office 365 and Azure services support business intelligence in the cloud in separate containers

Azure
Azure services include both IaaS and PaaS offerings. You can run SQL Server in a VM that you
manage internally and then use a Virtual Network to securely and reliably access it from other
VMs in Azure or from resources in your on-premises network. As an alternative, you can use
SQL Database as a cloud-based relational database platform that requires minimal
management. To work with big data in the cloud, you can use HDInsight, Microsofts Hadoopbased service.

Office 365
Office 365 is an SaaS offering that includes the entire Microsoft Office suite. With Office 365,
your organization no longer needs to manage infrastructure for Microsoft SharePoint and
Microsoft Exchange, and can still deliver a rich, interactive business intelligence experience by
providing users with Power BI. This experience begins when users create workbooks containing
data models, reports, business formulas, KPIs, and visualizations by using one or more of the
following self-service BI tools in Excel 2013: Power Query, Power Pivot, Power View, and
Power Map. Users can then share, explore, and manage these workbooks online by using the
following Power BI for Office 365 features: Power BI sites, Power BI Q&A, Query and Data
Management, and the Power BI app. The data models stored in the workbooks can use a single
data source or combine multiple disparate data sources obtained from web sites or Azure
resources in a cloud-only model.

Hybrid Cloud Model

Most organizations are not moving their entire infrastructure to the cloud. While this option might
be viable for startup companies, larger established firms having an existing investment in
infrastructure are motivated by the savings and agility they gain when transitioning to cloud
offerings. The most common cloud-based infrastructure scenarios at the time of this writing are
a mix of IaaS and SaaS. PaaS offerings have had slower adoption rates. Both IaaS and SaaS
are often better candidates for new development work. In particular, IaaS is easier to use with
existing applications. On the other hand, many organizations are considering PaaS for
developing future applications.
Meanwhile, a hybrid cloud infrastructure is a good model for organizations new to cloud
computing, whether they want to start simply with a disaster recovery solution for an onpremises SQL Server or implement full-fledged BI solutions that rely on Power BI. There are
four different architectural scenarios (variants) from which you can choose when implementing
Power BI in a hybrid environment:

SaaS, IaaS, PaaS, and On-Premises With this architecture (shown in Figure 2), you
use Power BI and Office 365 to create, share, and manage content based on data
sources that are available in VMs, SQL Database, HDInsight, blob or table storage, and
on-premises assets. Your VMs and on-premises assets can host SQL Server relational
databases, Analysis Services multidimensional and tabular models, among other data
source types. You can also use Power BI to access blob storage for various file types or
table storage for structured data. Some or all of the assets in Figure 2 can be combined.

Figure 2: SaaS, IaaS, PaaS, and On-Premises hybrid cloud model

Saas, IaaS, and On-Premises In this model, you eliminate the PaaS components to
create a hybrid environment that relies on Power BI and Office 365 for content creation,
sharing, and management and uses data sources from VMs in Azure or from onpremises assets, as shown in Figure 3 (this is a version of Figure 2 without the PaaS
components).

Figure 3: SaaS, IaaS, and On-Premises hybrid cloud model

SaaS, PaaS, and On-Premises This cloud model includes Power BI and Office 365 for
creating, sharing, and managing workbooks built from data sources maintained in SQL
Database, HDInsight, blob or table storage, and on-premises assets, as shown in Figure
4 (like Figure 2, without the IaaS components).

Figure 4: SaaS, PaaS, and On-Premises hybrid cloud model

SaaS and On-Premises Figure 5 illustrates the simplest hybrid cloud model consisting
only of Power BI and Office 365 using on-premises data sources only (version of Figure
2 without IaaS or PaaS).

Figure 5: SaaS and On-Premises hybrid cloud model

Here are a few important considerations for implementing a hybrid cloud architecture:

Security and identity management

9

Networking
Data flows and configurations

Hybrid Architecture
As illustrated earlier in this document, a hybrid architecture to support Power BI can take many
forms. At minimum, it includes Office 365 as the SaaS component and on-premises assets. It
can optionally include either an IaaS or PaaS component, or both, to provide additional data
sources to include in Power BI data models. In this section, you will learn important aspects of
the hybrid architecture to bear in mind as you design your BI solution.

Hybrid Environment with PaaS

Using PaaS components such as Microsoft Azure SQL Database or HDInsight eliminates some
challenges, like the need to patch, deploy, and maintain the software. Although these services
are exposed to the internet, security is controlled by limiting the range of inbound IP addresses.
You can easily connect directly to the database or service. No special configuration is required.
For general security information, see Security Considerations for Platform as a Service (PaaS).

Hybrid Environment with IaaS

A hybrid environment with IaaS requires you to implement two types of componentsVirtual
Network and VMs. The network manages access to cloud storage and VM assets in Azure. With
Virtual Network in place, users experience no differences in namespaces or the method of
connectivity when working with an on-premises machine and an Azure VM (however, the
performance of the connectivity could be different). For general security information, see
Security Considerations for Infrastructure as a Service (IaaS).

Azure Virtual Network

Because Office 365 had been designed for secure access through the web, there is no
requirement to use a VPN or manage Internet Protocol (IP) addresses when the architecture is
limited to SaaS and on-premises assets. However, when the environment includes Azure IaaS
resources, such as a VM running SQL Server, Analysis Services, or Reporting Services, you
must create a virtual network to properly address the IaaS resources from your on-premises
network. In forthcoming updates to Azure networking, a virtual network will be able to span
Azure data centers, (and not just a single region). After you create a virtual network and
configure a VPN, client connections can transparently access assets within Azure IaaS or your
on-premises network.
Affinity Groups
The first step when creating a new virtual network is to assign it to an existing affinity group or to
create a new affinity group. Affinity groups allow you to group dependent Azure services to
reduce latency and optimize performance of these services by locating the resources for these
services in the same data center. As an example, if a dependency exists between a SQL Server
and an IIS server, you should assign them and their dependent resources to the same affinity
group.
DNS Servers
When creating a virtual network, you can optionally configure DNS servers to support name
resolution across the virtual and on-premises networks. To do this, you provide a name and IP
address for an on-premises DNS server or a public DNS server. Otherwise, the Azure default
10

DNS service provides name resolution for your Azure VMs and other resources in your virtual
network.
Azure VPNs
There are two models for connecting your network to Azure: point-to-site VPN and point-to-point
VPN. See the two options in Figure 6.

Figure 6: DNS Servers and VPN Connectivity

Point-to-Site VPN
Because a point-to-site VPN is designed for administrative and demonstration use, it is an easy
way to get started using Azure in your organization. This type of VPN uses a certificate to
secure a connection between an on-premises machine to any resource in the virtual network.
For full details on configuring a point-to-site VPN in Azure, see Configure a Point-to-Site VPN in
the Management Portal. To complete the configuration tutorial, you must generate certificates by
using the Certificate Creation Tool (makecert.exe) available for download as part of Visual
Studio Express (makecert is included in the full version of Visual Studio).
Point-to-Point VPN
Point-to-point networking in Azure is the preferred network model for organizations that want to
use an Azure infrastructure, as shown in Figure 7. This model for networking can be configured
in several ways:

An Internet-facing Windows Server running Routing and Remote Access Services

An approved VPN device running on-premises in your network
11

A direct connection through your Internet Service Provider (ISP) using ExpressRoute

Figure 7: Hybrid network model

While the first two options provide secure, reliable connections to Azure, they both depend on
traffic going over the public internet and can have unpredictable latency. To learn more about
these options, see Configuring a Point-to-Point Network in the Management Portal.
ExpressRoute is an Azure service offering that enables private connections between Azure data
centers and your infrastructure, whether in your on-premises data center or a colocation
environment. Whereas site-to-site VPN connections use the public internet and are subject to
variations in latency due to other traffic, ExpressRoute provides a dedicated connection with
higher security and low, predictable latency. You can use ExpressRoute to connect to Azure
compute servicesvirtual networks, virtual machines, and cloud servicesand Azure storage.
To use ExpressRoute, you purchase a private connection from a network service provider or
exchange provider with defined bandwidth, routing management, and high availability
requirements.

Azure VMs
Azure VMs offer the options for any on-premises scenario in a secure, fully-redundant virtual
infrastructure managed by Microsoft. Using Azure VMs provides a high level of flexibility and
cost savings over on-premises solutions. For example, you can scale up a VM as your workload
12

increases or you can shut down your VMs during non-business hours during the development
phase of a BI project. This way you only pay for resources you actually use instead of guessing
ahead of time at how much hardware to purchase for the entire lifecycle of a system.
Static IP Addressing
Within the Windows operating system of the VM, the network properties continue to show a
dynamic address. If you choose to impose static IPs, the static IP reservation takes place
instead in Azure. When the VM is rebooted, it receives the same IP address assignment it
received previously.
Data Warehousing with SQL Server in Azure VMs
When building a new VM in Azure, you can choose to load your own image from which to build
the VM or use one of the predefined images provided by Microsoft, as shown in Figure 8 below.
The predefined VM images are configured for Data Warehouses (DW) up to 1 TB in size in SQL
Server 2014 or up to 500 GB in SQL Server 2012. To understand how to optimize the
performance of your workloads, see Performance Guide for SQL Server in Azure Virtual
Machines. Refer to SQL Server Data Warehousing in Azure Virtual Machines and Finish Setup
for SQL Server Data Warehouse in Azure Virtual Machines to learn best practices for using
Azure DW VMs. Of particular importance is the recommendation to spread input/output (I/O)
over multiple filegroups and data files to improve performance. For more information about this,
see Scaling out SQL Server Disks and Data Files on Azure Virtual Machines.

Figure 8: SQL Server Data Warehouse in Azure VMs

Scaling Out Read Workloads

To get more throughput from your data warehouse, you can implement scale-out reads by using
AlwaysOn Availability Groups. SQL Server 2014 allows you to scale out to a maximum of 8
13

replicas. Then by using virtual load balancing in Azure or by configuring read-only routing in
SQL Server, you can scale out read workloads. Given the low frequency of updates in a data
warehouse environment, use of asynchronous replication mode in the availability group is
recommended to improve overall performance.
SQL Server Business Intelligence in Azure IaaS
Just as you can use the SQL Server database engine in Azure IaaS, you can also install SQL
Server Integration Services (SSIS), Analysis Services (SSAS), and Reporting Services (SSRS)
on an Azure VM and then access these resources through a virtual network. The approach to
building and sizing a BI VM containing any of these components is the same approach you use
for an on-premises machine.
When you implement these BI components in conjunction with an Azure data warehouse, your
environment benefits from lower latency for reporting and analytics and the ability to quickly
scale out SSRS by deploying new VMs as needed. Another benefit is the reduction in
downstream network traffic if your analytics and data are in the same data center. In this
scenario, you should use a virtual network and an affinity group to ensure that your DW and
analytic VMs move together within Azure during system maintenance.

Security
As cloud computing has become more pervasive, many organizations have developed stricter
security and data privacy policies. To support these policies, organizations require a robust set
of security and identity management features that can be adjusted to meet their specific needs.
Microsoft understands these concerns and has designed security and isolation into the Azure
and Office 365 platforms. The data centers housing these platforms have full 24-hour monitored
physical security with any physical access to them fully logged and documented.
As mentioned previously in this document, Office 365 and Azure operate in separate containers.
Consequently, security is managed separately as well. Before examining options for integrating
your Azure cloud services with your on-premises authentication and identity management
infrastructure, we review the security features of Office 365 and Azure individually.

Office 365 Security

Office 365 uses a multi-tenant server environment in which data from different customers
resides on the same hardware resources and thereby provides the scalability and flexibility of
cloud computing. Behind the scenes, Microsoft uses internal Active Directory (AD) controls to
isolate customer data into silos, preventing access to data by other tenants in the environment.
Networks are also segmented to separate back-end servers from public access within Office
365. All client connections use Secure Sockets Layer (SSL) and are encrypted end-to-end by
default. In the event that a data transmission is intercepted by unauthorized parties, the
transmission is unreadable. Data stored in Office 365 SharePoint Online and other services,
such as Outlook, is fully encrypted at rest and in transit across the network. Antivirus signatures
are kept up to date and all security measures are applied in accordance with the Microsoft
Trustworthy Computing Initiative. Beginning in July 2014, every file stored in SharePoint Online
and OneDrive for business, is encrypted with its own encryption key, providing a high level of
security for content storage.

14

Managing user security in Office 365 is similar to managing security in your on-premises
SharePoint environment. If your organization has federated its AD to Office 365 (as described
later in this document), users use their corporate logins to gain access. AD federation supports
Single Sign On (SSO) and the ability to manage access by using your predefined on-premises
AD users and groups. You can also configure security to require multi-factor authentication for
users when you want to add an additional layer of security. For further information about
security, see the Office 365 Trust Center.

Azure Security
Azure shares many security features of Office 365s security measures specific to multi-tenant
environments. However, some components of Azure are IaaS services, such as storage, VMs,
and virtual networks. For these components, your information technology (IT) staff can manage
specific elements of security, such as VPN connections, DNS servers, and internet connectivity.
For more information about security, see the Microsoft Azure Trust Center.

Active Directory Integration

Your users expect to have the same authentication experience whether they connect to an
Azure or on-premises resource. Azure includes several options that allow you to create a
common authentication experience across your hybrid platform.

Active Directory and Office 365

Azure Active Directory (AD) and Active Directory Federation Services (ADFS) support
authentication in a seamless and secure fashion by synchronizing users and groups between
your on-premises AD and Azure AD. For instructions on how to implement this configuration,
see Checklist: Use ADFS to implement and manage single sign-on.
Azure Active Directory Premium
Azure Active Directory Premium offers several features to personalize and better secure your
Office 365 implementation:

Company branding You can add your company logo and color scheme to your
companys Sign In and Access Panel, as shown in Figure 9. You can also add localized
versions of those pages in different languages and locales.

15

Figure 9: Customized Contoso Office 365 logon screen

Group-based application access You can grant permission to on-premises domain

security groups to provision access to Office 365 applications.
Self-service password reset You can reduce help desk calls by giving all AD users the
ability to reset their login password by using an interface consistent with Office 365.
Self-service group management Azure AD Premium simplifies day-to-day
administration of groups by allowing users to create new groups, request access to other
groups, and delegate group ownership. This capability allows power users and team
leads to control access to data themselves and thereby reduces your administrative
burden.
Advanced security features Multi-factor authentication allows you to require an
authentication code via text or phone as an increased security measure for user logins to
Office 365. Advanced security reports showing detailed logs and inconsistent access
patterns are also available to AD Premium customers. AD Premium also includes the
option to grant rights to use a Forefront Identity Management (FIM) server in your onpremises environment to support many different permutations of hybrid identity
solutions.

Azure AD Premium is currently available through Microsofts volume licensing plan, and is
also included in the Enterprise Mobility suite. For further details on working with its features,
see Azure Active Directory Premium.
Active Directory DirSync for Office 365
At the time of this writing, you use the Azure Active Directory Sync tool, also known as DirSync,
to synchronize passwords, users, and groups between your on-premises AD and the Azure AD

16

supporting your Office 365 installation, as shown in Figure 10. You install this tool on any server
joined to your domain, whether on-premises or an Azure VM.

Figure 10: Office 365 DirSync connection to on-premises AD

In the future, a new version of Azure Active Directory Sync (AAD Sync) will be released to better
support self-service password resets and provide new support for multi-forest ADs. The new
AAD Sync will also support combinations of directories, such as AD, LDAP, SQL, and others. In
addition, it will allow administrators to limit the number of AD attributes to synchronize with
Azure AD to reduce network traffic and increase security.

Active Directory and Azure IaaS

When you want to provide authentication services to your Azure VMs, you can bridge your onpremises Active Directory to a domain controller (DC) in Azure. By creating a hybrid
infrastructure model that includes a DC in an Azure VM, your Azure-based resources can
continue to authenticate successfully in the event of a break in connectivity with your onpremises DC. This scenario requires VPN connectivity to Azure. See Guidelines for Deploying
Windows Server Active Directory on Azure Virtual Machines.
Another option available is similar to Office 365 AD federation. This option allows you to
federate your on-premises or hybrid AD with Azure AD. By federating ADs, your infrastructure
can support single sign-on for services such as SQL Database, the Azure Management Portal,
and applications running on the Azure platform.
For a complete summary of Azure and Active Directory, you can download a series of
whitepapers at Active Directory from on-premises to the cloud Windows Azure AD
whitepapers.

Office 365 and Azure Security Compliance

Microsoft has certified both Office 365 and Azure against a large number of privacy and security
standards such as ISO/IEC 27001:2005 and others. These regulatory certifications are regularly
updated and maintained. You can check on the latest certifications that may be applicable to
your organization at Trust Center for Office 365 and Microsoft Azure Trust Center.

17

Power BI
Power BI is a collection of services and features that enable your organization to share,
visualize, and analyze data in a collaborative self-service fashion. Power BI can connect to a
mix of on-premises and Azure data sources, which can be automatically refreshed on a fixed
schedule. You can also use Power BI to showcase your existing on-premises reports and data
models. In this section, we distinguish between features available in Excel and in Office 365,
and then review the steps necessary to access and refresh data once Power BI workbooks are
published in the cloud.

Power BI Features
Power BI has a number of unique features, some that are built into the standalone and Office
365 versions of Excel 2013, and others that are exclusive to Power BI for Office 365. For the
latest information, see Power BI for Office 365 Overview and Learning.

Power BI in Excel
To get started with Power BI, you should build data models and reports by using the relevant
features in Excel 2013. (It is also possible to work with the PowerPivot add-in for Excel 2010,
but the most recent version of Excel is preferred, because it offers the richest feature set.) The
following Power BI features are included within Excel 2013:

Power Query Connect, filter, and shape a variety of on-premises and external data
sources into a query that can be reused and optionally shared or loaded into an Excel
table or data model.
Power Pivot Create a data model from disparate and heterogeneous data sources,
define relationships between imported data tables, and enhance the data with
calculations and KPIs to support advanced analysis using the highly compressed inmemory technology built into Excel.
Power View Develop reports and analytical views with interactive data visualizations
and maps by using data from an Excel data model.
Power Map Explore geospatial data from an Excel data model in a 3D interactive map
that can also display changes in data across a specified time series.

Power Query and Power Pivot both rely on data connections to access all types of data
sources. If a data source is hosted in an Azure VM (to which you have a VPN connection) you
can connect to the data as if it were an on-premises data source. Note that if youre using
Analysis Services, import your data into an Excel data model, and then use that data model in
your Power View report or in Power Map.
For the current list of data sources and detailed instructions, see Power Query Data Sources,
Import data in Power Query from external data sources, and Power Pivot supported data
sources.
Table 1 shows the data sources supported at the time of this writing for each of these features
(click a Yes link for instructions).
Data Source
SQL Server
SQL Database (Azure)

Power Query
Yes
Yes
18

Power Pivot
Yes
Yes

Data Source
SQL Server Parallel Data Warehouse
(PDW/APS)
Access
Oracle
Teradata
Sybase
Informix
DB2 (IBM)
MySQL
PostgreSQL
OLE DB/ODBC
OData Feed
Analysis Services Tabular
Analysis Services MD
Reporting Services Report
SharePoint list
Dynamics CRM
Azure Marketplace
Hadoop Distributed File System (HDFS)
HDInsight (Azure)
Azure Blob Storage
Azure Table Storage
Active Directory
Exchange Server
Facebook
Excel
Text file
XML file
Web page
Folder metadata
SAP BusinessObjects BI Universe

Power Query
Yes

Power Pivot
Yes

Yes
Yes
Yes
Yes

Yes
Yes
Yes
Yes
Yes
Yes

Yes
Yes
Yes
Yes

Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes

Yes
Yes
Yes
Yes
Yes

Yes

Yes
Yes

Table 1: Supported data sources for Power BI features in Excel

Power BI for Office 365

Among the benefits of using Power BI for Office 365 is the ability to share not only workbooks
containing visualizations and analytical content, but also queries that retrieve and shape data for
use in other workbooks. Users in your organization can open these shared workbooks and
interact with the contents to develop new insights, or can ask questions of the data to
automatically generate a new visualization derived from a shared workbooks data model. The
features that are available only in Power BI for Office 365 are:

Power BI sites Allow users to share, view and interact with reports in SharePoint
Online.
19

Power BI Q&A Use natural language queries to explore and create reports from data
contained in workbooks deployed to a Power BI site.
Query and Data Management Share and manage queries and data sources, as well
as monitor query usage.
Power BI Windows Store App Access reports from a Power BI site by using a
Windows 8.1 device or Windows RT tablet. For the full list of supported Power BI app
platforms visit the Power BI app page.

When working with data sources in a hybrid environment, you must take extra steps to configure
your environment for secure data access and scheduled refresh from Office 365 as described in
the next two sections of this document. The supported databases and types can be found here.

Power BI Data Refresh

Each Excel workbook deployed to a Power BI site can have a single data refresh schedule that
you configure. However, Power BI supports automatic data refresh for the following data
sources only:

On-premises SQL Server (2005 and later)

On-premises Oracle (10g and later)
Azure SQL Database
OData feed
Azure VM running SQL Server

If your workbook includes data sources for which automatic data refresh is supported and data
sources for which automatic data refresh is not supported, you can still schedule a data refresh.
You just select the data connections for the supported data sources on the settings tab of the
Scheduled Refresh page. For more information, see Schedule data refresh for workbooks in
Power BI for Office 365.
For more information and the current list of data sources, see Data sources you can refresh
automatically.
Remember that if you have a VPN connection to Azure IaaS and accessing data sources within
that virtual network, the Power BI data connection and scheduled refresh options are the same
as those for on-premises data sources. In both cases, you must define a data source by
creating a Data Management Gateway as described in the next section of this document. Table
2 shows which data sources support scheduled refresh and which require a gateway.
DATA SOURCE
SQL Azure Database
Azure VM running SQL Server
SQL Server
Oracle
OData feed

LOCATION

AUTO-REFRESH

Azure
Azure
On-Premises
On-Premises
Web/On-Premises/Azure

Yes
Yes
Yes
Yes
Yes

GATEWAY
REQUIRED
No
No1
Yes
Yes
No

1 A VM running SQL Server can be reached by using its public IP address. However,
if you have configured this VM inside a virtual network, you should connect by using
its private IP address, just as if it were an on-premises VM.
20

DATA SOURCE
HDInsight
Analysis Services
Reporting Services
Power Query2

LOCATION

AUTO-REFRESH

Azure
On-Premises/Azure
On-Premises/Azure
On-Premises/Azure

Not Directly
Not Directly
Not Directly
Yes

GATEWAY
REQUIRED
N/A
N/A
N/A
Yes

Table 2: Supported connections for Power BI data refresh

OData Feeds for Non-Refreshable Data Sources

OData is a data access protocol initially defined by Microsoft and is now recommended by the
Open Government data initiative. It is also the data application programmatic interface (API) for
Azure. OData uses the representational state transfer (REST) API.
A number of data sources are accessible to Power BI through an OData feed. An alternative
approach for some data sources, such as an Analysis Services or HDInsight, is to build an
OData feed. At the time of this writing Analysis Services Multidimensional and Tabular models
cannot be used for data refresh in Power BI directly. The workaround to this is to use the SSIS
Data Streaming Destination that is part of the Data Feed Publishing components. Then you
could query as an OData feed exposed as a SQL Linked Server and do a scheduled refresh
through a SQL Data Source for Power BI. For more information, see Publish SSIS Packages as
OData Feed Sources and Access OData Feeds from Power Query.

Power BI Cloud Data Sources

For workbooks having Azure SQL Database or OData feed connections, you can configure the
data refresh based on the embedded connection string or the feeds URL specified when
importing data into the workbook. You use the Power Pivot import functionality or the From
Other Sources button on the Data tab of the Excel ribbon, as shown in Figure 11. At the time of
this writing, you cannot schedule a data refresh for a supported data source if you load the data
model from Power Query.
Note The automatic data refresh in Power BI for Office 365 requires your workbook to contain both a supported data
source and a data model.

2 At the time of this writing, Power Query supports scheduled refresh of relational
data in Oracle and SQL Server databases.
21

Figure 61: Import Data into Excel from OData or Azure SQL Database

After building your data model in an Excel workbook, you upload the workbook to a Power BI
site. To enable automatic refresh, click the ellipsis next to the workbooks thumbnail image, as
shown in Figure 12, and then click Schedule Data Refresh.
Note Office 365 imposes sizes limitations that affect not only the size of the workbook that you can upload, but also
whether the workbook can be rendered online. You can view the latest information related to these limits at Power BI
for Office 365 - Service Description.

22

Figure 72: Power BI Schedule Data Refresh option in a Power BI site

Next, you configure the scheduled data refresh settings, as shown in Figure 13. Specifically, you
must enable data refresh, choose which data sources refresh, and then set a single schedule
for the selected data sources within the workbook. If you choose to refresh Azure-based data
sources in your workbook, bear in mind that each refresh increases your downstream data
charge.

Figure 83: Data Refresh Settings page

23

Azure VM Running SQL Server as a Data Source

The process to refresh data from an Azure VM running SQL Server is very similar to the process
you use to refresh Azure SQL Database. The key difference is a requirement to create an
endpoint for port 1433 for SQL Server on the Azure VM, as shown in Figure 14 below. You then
connect to the instance by using its public virtual IP address by using the Power Pivot import
functionality or the Data tab in the Excel ribbon. Following the upload of the workbook to a
Power BI site, you configure the settings for the refresh process (as described earlier in this
document) for Azure SQL Database and OData.
The default instance of the SQL Server Database Engine listens on TCP port 1433, but the
named instances of the Database Engine can select an available port when the SQL Server
service is started. When you are connecting to a named instance of Database Engine in an
Azure environment, we recommend that you configure a static port for SQL Server Database
Engine. For more information, see Connectivity Considerations for SQL Server in Azure Virtual
Machines.
Note When using an Azure VM in a virtual network, you should configure a Data Management Gateway to route
network traffic securely through your private connection to Azure and your virtual network gateway.

Figure 94: Endpoint configuration for an Azure VM

Data Management Gateway

To refresh data from on-premises SQL Server or Oracle databases or from Azure VMs in a
virtual network, you must create a Data Management Gateway in the Power BI for Office 365
Admin Center and then download and install the client gateway on one or more on-premises
computers. As an example, you can create a single gateway for each department, download it
and install the client on each data source host, and then assign data sources used by that
department to its dedicated gateway.
Before creating a gateway, take note of the following requirements:

The gateway may not be installed on a domain controller.

If you configure OData feed for HTTPS access, you must have an SSL certificate.

To troubleshoot an issue with a gateway, open the Windows Event Viewer on the computer
hosting the gateway and expand Applications and Services Logs, as shown in Figure 15.
Then click Data Management Gateway to view the log of all warnings and errors.

24

Figure 105: Windows Event Viewer for Data Management Gateway

One configuration option for your gateway is to use the cloud credential store to store
credentials for your data sources. This option eliminates the need to enter credentials again if
you later have to restore a gateway onto a new computer. To use this option, you must specify a
certificate for connection string encryption as described at Business Continuity for a Data
Management Gateway.

Data Source Registration

After creating a gateway and installing it on your on-premises computer, your next step is to
register data sources as described at Create a Data Source and Enable OData Feed in Power
BI Admin Center. You start by specifying whether to enable cloud access, as shown in Figure
16, which permits Office 365 to refresh the data source. You also have the option is to enable
the data source as an OData feed, which makes it available to Power Query users across your
organization, as described in the next section of this document.

Figure 116: Data Source Usage configuration during data source registration in Power BI Admin Center

Then you configure the connection information for your data source, as shown in Figure 17.
Here you specify a name for the data source and assign it to a gateway. (Be aware that the
database name is case-sensitive if your SQL Servers collation is case-sensitive, and the
connection strings in Excel must match the portal strings.) You then have the option to use the
25

Connection Properties dialog box to generate a connection string or to enter a connection string
directly. Next, click Credentials and type in the user name and password required to access the
data source. You must disable pop-up blockers to view the Data Source Manager dialog box in
which you provide these credentials.

26

Figure 127: Configuring connection information for a Power BI data source

27

The final setting to configure on this page is Privacy Level. This setting is also available in the
Data Refresh dialog box. You must select one of the following three privacy levels to configure
the data source appropriately for Power Query:

Private data source Use this setting for data containing personal or sensitive
information. Private data sources are completely isolated from all others.
Organizational data source This setting restricts the visibility of the data source to a
defined group of people. It is isolated from all public data sources, but visible to viewers
of other organizational data sources.
Public data source Everyone has visibility to this type of data source, which can be set
only for files, Internet sources, or workbook data. It is more commonly used for data from
Azure Marketplace or from a web site.

The third page of the data source registration process allows you to grant permissions to the
users and groups who can access the newly created data source. If you have federated your AD
with Office 365, you can grant permissions to on-premises users and groups.
After registering the data source, you can schedule data refresh for the workbook, as described
earlier in this document and shown in Figure 13. Where applicable, be sure to provide a server
name for a data source in the workbook, rather than localhost, to ensure the workbook can
refresh as scheduled.

OData Feeds from Power BI Data Sources

One option you have when creating a data source is to make it available as an OData feed,
which is a useful way to expose subsets of data sources to different groups of users.
Note The user credentials for the OData feed must have access to the underlying data source in order to gain
access to the feed.

To do this, you select the Enable OData Feed checkbox (see Figure 16). Your next step is to
choose the table and views to expose in the OData feed, as shown in Figure 18.

28

Figure 138: Table and view selection for an OData feed

The security context for access to these tables and views is the user credentials supplied for the
data source. Therefore, when the resulting OData feed exposes any sensitive data, take care to
restrict access to the users and groups who are allowed to see this data, as shown in Figure 19.
For more information, see Create a Data Source and Enable OData Feed in Power BI Admin
Center.

Figure 149: Set permissions for an OData feed

29

You can locate the URL for the OData feed by navigating back to the Data Sources page in the
Power BI for Office 365 Admin Center and then clicking the ellipsis next to the feed name. The
URL then displays, as shown in Figure 20.

Figure 2015: Review of the OData Feed URL

To access the feed, paste its URL into the Power Query OData source. If you are successfully
logged in to Office 365, you see the feeds tables in the Navigator pane, as shown in Figure 21.
For more information, see Power Query: Connect to an OData feed.
Note Be sure to log in with your organization account having access to Power BI to access the OData feed.

Figure 161: Power Query access to an OData Feed

30

Power Query Data Refresh for On-Premises Data

At the time of this writing, Power Query data refresh is limited to on-premises Oracle and SQL
Server data sources. Before you can enable data refresh, you must establish a Data
Management Gateway. Next, capture the Power Query connection string from your workbook.
You can do this by navigating to the Data tab of the ribbon, clicking Connections > Properties
> Definitions, and then copying the connection string from the text box. Last, use this
connection string when you register the data source in the Power BI for Office 365 Admin
Center using the same process described in the Data Source Registration section earlier in
this document. For details related to configuration and troubleshooting, see Scheduled Data
Refresh for Power Query.
Note All data sources for Power Query must be hosted on the same gateway.

Conclusion
Power BI for Office 365 offers your organization access to the latest business intelligence
features without requiring your users to wait for extensive upgrade processes internally. Azure
IaaS and PaaS give you the flexibility to extend a portion of your data platform to the cloud while
maintaining secure and low latency connections. By combining your internal data infrastructure
with Office 365 and Azure, you can more easily and cost effectively implement business
intelligence solutions that can adapt quickly to changing business requirements and scale up or
down to meet fluctuating analytical demands.

Did this paper help you? Please give us your feedback. Tell us on a scale of 1 (poor) to 5
(excellent), how would you rate this paper and why have you given it this rating? For example:

Are you rating it high due to having good examples, excellent screen shots, clear writing,
or another reason?
Are you rating it low due to poor examples, fuzzy screen shots, or unclear writing?

This feedback will help us improve the quality of white papers we release.
Send feedback.

31

Author Bios
Joseph D'Antoni is a Senior Architect with over a decade of experience working in both
Fortune 500 and smaller firms. He is currently Solutions Architect for SQL Server and Big Data
for Anexinet in Blue Bell, PA. He is frequent speaker at major tech events, a Microsoft SQL
Server MVP, and blogger about all topics technology. He is the co-president of the Philadelphia
SQL Server Users Group. He holds a BS in Computer Information Systems from Louisiana
Tech University and an MBA from North Carolina State University.

Stacia Misner is a consultant, educator, mentor, author, and SQL Server MVP, specializing in
business intelligence solutions since 1999. During that time, she has authored or coauthored
multiple books about BI. Her latest books include Microsoft SQL Server Reporting Services
2012 (Microsoft Press, 2013) and Business Intelligence in Microsoft SharePoint 2013 (Microsoft
Press, 2013). Stacia provides consulting and custom education services through her company,
Data Inspirations; speaks frequently at conferences serving the SQL Server community; and
serves as the chapter leader of her local PASS user group, SQL Server Society of Las Vegas.
She is also a contributing editor for SQL Server Pro magazine. Stacia writes about her
experiences with BI at blog.datainspirations.com and tweets as @StaciaMisner.

Technical Reviewers:

Ed Price, Customer Program Manager, Power BI and SQL Server BI, Microsoft
Carla Sabotta, Senior Content Developer, SQL Server BI and Power BI, Microsoft
Cindy Gross, Senior Program Manager, Azure Customer Advisory Team, Microsoft
Olivier Matrat, Principal PM Lead, Azure Analytics Customer Advisory Team, Microsoft
Kay Unkroth, Senior Program Manager, Power Pivot and Analysis Services, Microsoft
Derrick VanArnam, Content Publisher, Power BI, Microsoft
Adam Saxton, Senior Escalation Engineer, Business Intelligence, Microsoft
David Torres, Senior Director, Global Data & Analytics, Avanade
Greg Low, SQL Server MVP and Principal Mentor, SQL Down Under
Ross LoForte, Tech Solutions Professional, Business Intelligence, Microsoft

32