Request Firewall Changes for the Fabric Data Gateway

Description

We are implementing a Microsoft Fabric Data Gateway to securely enable connectivity between cloud-based Fabric services and on-premises data sources.

To support this integration, we require firewall rule updates to allow outbound connectivity from the on-premises network to required Microsoft endpoints, as well as inbound allowances (if applicable) for gateway communication.

This change is critical to enable data ingestion, refresh operations, and real-time connectivity between Fabric and internal systems.

Business Use Case

Enable secure and reliable data movement between on-premises data sources (e.g., SQL Server, file systems, APIs) and Microsoft Fabric workloads (Data Factory, Power BI, Lakehouse, etc.), supporting analytics, reporting, and operational data pipelines.

Scope of Change
Environment(s): DEV / TEST / PROD (specify as needed)
Gateway Type: Microsoft Fabric On-Premises Data Gateway
Source Systems: On-prem SQL Server, file shares, internal APIs (expand as needed)
Required Firewall Changes
Outbound (Required)

Allow outbound HTTPS (TCP 443) traffic from the gateway host(s) to the following Microsoft endpoints:

*.servicebus.windows.net (Azure Service Bus)
*.analysis.windows.net (Power BI / Fabric services)
*.powerbi.com
*.fabric.microsoft.com
login.microsoftonline.com (Azure AD authentication)
*.msftncsi.com (network connectivity checks)

Note: Wildcards may need to be translated into explicit FQDN rules depending on firewall capabilities.

Inbound (If Applicable)
No inbound ports required for standard gateway operation (outbound-only model)
If using custom routing or hybrid setups, validate with networking team
Ports Required
TCP 443 (HTTPS) – Primary communication channel
TCP 5671 / 5672