IT usually inherits a gateway that already refreshes three pilot datasets. Before the finance warehouse is bound, freeze go-live until these six answers exist in writing.
Identity and blast radius
- Which Entra security group is Gateway Admin, and which is allowed to create data sources — not “whoever installed it”?
- Are SQL credentials a dedicated service account (password rotation ≥ 90 days) or a named user’s mailbox still in the data source?
- Where is the gateway recovery key stored (vault name + secret path), and has a second admin retrieved it in a drill?
Capacity numbers, not feelings
Ask for peak concurrent refreshes after month-end (count of datasets overlapping 05:00–07:00). One 4-vCPU VM often queues behind long SQL pulls and surfaces as “The gateway is unreachable or offline for the data source.” Prefer two nodes sized to SQL throughput; document RAM (Microsoft guidance often starts far above a 4 GB demo box) and watch Windows Performance Monitor for persistent high Working Set during refresh storms.
Network proof
From the gateway subnet, prove TCP reachability to the SQL listener (often 1433 or a named-instance dynamic port) and outbound 443 to Power BI / Azure Relay. Private Link or private endpoints that Desktop reaches via VPN can fail on the gateway if the VM has no route. Capture a successful “Test connection” screenshot in Manage gateways after each firewall change.
Refuse go-live until a documented failover (stop the Windows service on node A) still yields Status = Completed on a nominated production dataset.