Level 7 · Scheduled refresh, gateways and outside guests

An Import model is a copy of the data taken at the last refresh. Once the report is in the Service, something has to take a fresh copy on a schedule, and someone has to decide who outside the company may look at it.

What you are working in

This is a quiz: refresh, gateways and guest access live in the Service and in your company’s Microsoft Entra ID, which need a work account.

Scheduled refresh

In the Service, open the workspace, hover the semantic model and select More options (…) → Settings. Under Data source credentials, sign in to each source. Under Refresh, switch on Configure a refresh schedule, choose daily or weekly, add times and a time zone, and tick the box that emails you when a refresh fails. With Pro, a model can refresh up to 8 times a day; with Premium Per User or on Premium/Fabric capacity, up to 48. Power BI pauses a schedule after several refreshes fail in a row, and on a model nobody has opened for two months. You can also select Refresh now at any time.

DirectQuery and live connections don’t copy the data, so they don’t need a data refresh; visuals query the source when someone opens them.

When you need a gateway

The Service runs in Microsoft’s cloud. It can reach cloud sources directly: SharePoint Online, OneDrive, Azure SQL Database, Dataverse, most web APIs. It can’t reach a server or a file share inside your office network. An on-premises data gateway is a small Windows service installed on a machine in that network; it receives the refresh request, queries the local source and sends the result back over an outbound connection.

There are two kinds. The standard mode gateway is shared by many people and models and is managed under Settings → Manage connections and gateways, where each source gets a connection the model is mapped to. Personal mode serves one person’s models only. Firewall settings stay closed: the gateway only connects outwards.

Sharing with people outside the company

• Guest users (Microsoft Entra B2B). Share the report or app with the outside person’s email, or have IT invite them. They sign in with their own account, need a Pro licence (from either company) unless the content is on Premium or F64+ capacity, and RLS applies to them. Your tenant admin decides whether guests are allowed.
• Publish to web. File → Embed report → Publish to web creates a public link and embed code. Anyone with the link can see it, no sign-in, no RLS, and search engines may find it. It is meant for public data only, and many companies switch it off.

Common mistakes

• A gateway for cloud files. SharePoint Online and OneDrive don’t need one.
• The gateway on someone’s laptop. It refreshes only while that laptop is on.
• Publish to web for confidential data. It is a public web page.