"We built a beautiful Power BI report — then spent the next two weeks begging people to actually open it." — Enterprise BI lead, 3,000-seat Microsoft 365 deployment
Building a great report is only half the job. The other half is getting it in front of the right people at the right moment. If your report lives only at app.powerbi.com, you are creating a habit-change problem — every viewer must remember to go somewhere new. Embedding in Microsoft Teams and SharePoint flips that equation: the data comes to where decisions already happen.
This post explains the business case for embedding, how the on-premises data gateway makes it possible for organisations with internal SQL Server or Oracle data, and the most common mistakes enterprises make when setting this up.
Imagine your company’s key metrics are posted on a noticeboard in one corner of the office. The data is accurate, the charts are well-designed — but most people never walk past that corner. Embedding Power BI in Teams is like replacing every person’s daily stand-up wall with a live version of that noticeboard. You haven’t changed the data. You’ve changed the location to where the team already gathers.
Why Embed in Teams and SharePoint?
In most organisations, Microsoft Teams or SharePoint is where daily work actually happens — meetings, project channels, document libraries, intranet pages. Power BI embedding brings analytics into that flow instead of requiring a separate application switch.
| Business Benefit | What This Means in Practice |
|---|---|
| Contextual insights | A sales team can review their pipeline report inside their Teams channel while discussing Q3 targets — no tab switching, no separate login required |
| Intranet integration | SharePoint pages serve as KPI dashboards for department heads — finance, operations, HR each have their own embedded view on their team site |
| Faster decisions | Real-time or near-real-time data is visible during the meeting itself — not retrieved afterwards when the discussion is over |
| Existing access control | Microsoft 365 permissions apply — users only see reports they already have Power BI access to; RLS is still enforced; no separate permission layer to manage |
| No software install | End users need no Power BI Desktop or special software — they interact with the embedded report inside the browser or Teams app they already use |
The On-Premises Data Gateway — What It Is and Why You Need It
Power BI Service is a cloud application running on Microsoft Azure. Many enterprise organisations store critical data on-premises — SQL Server, Oracle, SAP systems, or file servers on the internal network. These sources are not directly accessible from the internet. The On-Premises Data Gateway solves this by acting as a secure bridge. Here is how the four-step flow works:
Gateway Architecture: End-to-End Flow
| Layer | Component | Role |
|---|---|---|
| User layer | Browser / Microsoft Teams App | End user opens report embedded in Teams channel or SharePoint page |
| Cloud layer | Power BI Service (Azure) | Serves the report, sends data refresh queries via Azure Service Bus |
| Bridge layer | On-Premises Data Gateway | Receives encrypted queries, executes them against internal sources, returns encrypted results |
| Data layer | On-Premises SQL Server / Oracle / Files | Authoritative data source — never directly accessible from the internet |
3 Common Mistakes in Gateway + Embedding Setups
- Installing the gateway on a laptop or desktop: The gateway must run 24/7 for scheduled refreshes to work. If installed on a workstation that gets switched off at 5pm, all overnight refreshes fail. Install it on a dedicated server or VM that stays online.
- Using a personal Microsoft account for the gateway service: The gateway must be registered to a work or school account (Azure AD). Personal Microsoft accounts cannot administer gateway clusters in Power BI Service, causing the data source to appear unavailable to other workspace members.
- Forgetting that Power BI Pro is still required per viewer: Embedding a report in Teams does not bypass the Power BI licensing requirement. Each user who views the embedded report must have a Power BI Pro licence or the workspace must be on Premium/Fabric capacity. Without this, viewers see a licence error even though the Teams tab is correctly configured.
Quick Knowledge Check
Q1. Your organisation stores sales data in an on-premises SQL Server. Users want to see a refreshed Power BI report every morning inside their Teams channel. What component is required to make this work?
Show Answer
On-Premises Data Gateway. Power BI Service (cloud) cannot directly query on-premises SQL Server. The gateway installed on a server within your network acts as the secure bridge, receiving encrypted refresh requests from Power BI and returning query results via Azure Service Bus.
Q2. Which of the following is TRUE about the On-Premises Data Gateway’s security model?
- A) You must open inbound TCP port 1433 on your firewall to allow Power BI to query SQL Server
- B) The gateway uses outbound connections through Azure Service Bus — no inbound firewall ports needed
- C) Data transferred between the gateway and Power BI Service is unencrypted for performance reasons
- D) The gateway requires a public IP address on the host server
Show Answer
B. The gateway uses outbound HTTPS connections through Azure Service Bus. No inbound ports are required, no public IP is needed on the gateway server, and all data in transit is encrypted. Options A, C, and D are all incorrect.
Q3. A viewer opens a Power BI report embedded in a Teams channel and sees a licensing error. The gateway is configured correctly and the report refreshes on schedule. What is the most likely cause?
Show Answer
Missing Power BI Pro licence (or no Premium/Fabric capacity). Embedding a report in Teams does not bypass Power BI’s licensing model. Each viewer must have a Power BI Pro licence, or the workspace must be backed by Premium or Fabric capacity. The gateway configuration is irrelevant to this specific error.
- Embedding brings data to the team — instead of asking every user to navigate to app.powerbi.com, embed the report where daily work already happens in Teams or SharePoint.
- The gateway is a bridge, not a firewall hole — it uses outbound Azure Service Bus connections. No inbound ports, no public IP, all traffic encrypted.
- Install the gateway on a server, not a workstation — it must run 24/7 for scheduled refreshes to complete overnight and on weekends.
- Power BI Pro licensing still applies — embedding in Teams does not bypass the per-viewer licence requirement.
- RLS is preserved — row-level security configured in Power BI Desktop still applies to embedded reports. Each viewer only sees data their role permits.