On-Premises Data Gateway: The Silent Single Point of Failure Behind Power Automate

A Power Automate flow has reliably pulled order data from the SQL Server in the server room for months. Then the machine running the on-premises data gateway gets reinstalled, and overnight every flow that needs local data grinds to a halt. The gateway is the least visible dependency in the entire chain: you don't see it in the flow designer, yet nothing works without it.

What is the on-premises data gateway and when do you need it?

The on-premises data gateway is software that you install on a Windows machine inside your own network, acting as a bridge between Microsoft cloud services and your local data. Power Automate needs it whenever a flow accesses a system that is not in the cloud. Microsoft Learn lists 14 connection types for Power Automate via the gateway, including SQL Server, file system, Oracle Database, MySQL, PostgreSQL, DB2, SAP ERP, on-premises SharePoint, and custom-built connectors.

Technically, the gateway only ever opens outbound connections. According to Microsoft Learn it communicates over the outbound ports TCP 80, 443, 433, 5671, 5672, and 9350 through 9354, and does not require a single inbound port. So you don't need to open any firewall from outside. You can find your existing gateways in Power Automate under Data > Gateways.

Standard mode or personal mode: for Power Automate there is only one answer

Only standard mode is an option for Power Automate. According to Microsoft Learn, personal mode works only with Power BI, cannot be shared, and supports neither clustering nor high availability. The Power Automate documentation explicitly requires installation in standard mode.

The gateway is no minor licensing detail. Microsoft lists on-premises gateways under premium features in the licensing FAQ, and Office 365 licenses explicitly do not include gateway access. Anyone accessing SQL Server or a local ERP system through the gateway therefore needs Power Automate Premium per user or Power Automate Process per process. For the details of how this adds up, see our article on premium connector costs. If you want a clean breakdown of your licensing situation, our Power Automate licensing consulting is the right place to start.

Why a single gateway is a single point of failure

A single gateway makes every local data connection only as available as the machine it runs on. If that machine fails or goes to sleep, every dependent flow stops at the same time. Microsoft explicitly warns in the installation prerequisites against installing the gateway on a device such as a laptop that could be turned off or put to sleep.

The answer is a cluster. A gateway cluster combines up to 10 members. The cloud service always uses the primary gateway and only switches to the next member once the primary is unreachable. Since only one standard gateway can run per machine, every additional cluster member must sit on a different machine. Redundancy therefore doesn't come from a second installation, but from a second machine. In Power Automate you can additionally enable the option Distribute requests across all active gateways in this cluster so the load doesn't permanently sit on the primary member alone.

Two further causes of failure have nothing to do with hardware. The first is the recovery key: it is assigned by the administrator during installation and is required to move the gateway, restore it, or change the service account. Microsoft makes clear that it has no access to this key and cannot recover it. The second is the Windows service account. By default the service runs under the local account NT SERVICE\PBIEgwService. If a regular domain account is used instead and its password expires, the service stops. Microsoft recommends a group managed service account (gMSA) here, because its password does not need to be maintained manually.

How often does the on-premises data gateway need to be updated?

Microsoft releases a new gateway version every month and actively supports only the last six releases. Updates are not automatic. A gateway nobody has touched for half a year has therefore effectively fallen out of support.

There is currently a hard deadline for this. Microsoft is changing how the identity platform signs in and, by its own statement, is enforcing this by August 31, 2026 across all tenants. On older builds, interactive sign-in when installing, restoring, or managing a gateway can fail. Affected are all versions before May 2026, as well as the January through April releases below these corrected builds:

• January 2026: Build 3000.302.7
• February 2026: Build 3000.306.5
• March 2026: Build 3000.310.3
• April 2026: Build 3000.314.6
• May 2026 and later: all releases include the fix

An update requires gateway administrator rights and at least 10 GB of free disk space. In a cluster, members are updated one at a time: disable, wait around 30 minutes until running jobs finish, update, re-enable, then move to the next. All members should run the same version, because mismatched versions lead to sporadic errors where the same query succeeds on one member and fails on another.

What should a mid-sized company specifically secure?

Six measures cover the vast majority of real-world gateway failures and can be implemented in a single morning.

• A dedicated server instead of a workstation: Microsoft recommends an 8-core CPU, 8 GB of RAM, Windows Server 2019 or newer, and SSD storage. Domain controllers, Server Core installations, and Windows containers are ruled out, and a wired connection beats Wi-Fi.
• A cluster from the first business-critical flow onward: Two members on two machines are enough. A cluster you only build after an outage doesn't help during that outage.
• Recovery key in a password vault: Not in the administrator's head, not in an email. Without it, a gateway can be neither moved nor restored.
• Service account without password expiry: A gMSA prevents the classic scenario where a routine password change silently takes down half of your automation. The change is made in the gateway app under service settings and requires the recovery key.
• An update window on the calendar: A fixed monthly date keeps you within the six supported releases.
• Network shares documented and tested: The network port test in the gateway app under diagnostics checks whether all required outbound connections are open. Run it once after every firewall change.

In our Power Automate projects, the most common finding is not a broken server, but a gateway that someone quickly installed on a workstation years ago. As long as that machine keeps running, nobody notices. Once it's replaced, the recovery key is missing. This question belongs in the architecture, not in incident analysis. That is exactly where our Power Automate consulting comes in.

Frequently asked questions about the on-premises data gateway

Does every Power Automate flow need a gateway?

No. A gateway is only needed if a flow accesses data on your own network, such as a SQL Server, a file share, or a local ERP system. Flows that work exclusively with cloud services such as Outlook, SharePoint Online, or Teams do not need a gateway.

Does the on-premises data gateway cost extra?

The gateway software itself is free. However, using it counts as a premium feature in Power Automate, and Office 365 licenses do not include it, according to Microsoft's licensing FAQ. Flows with gateway access therefore require Power Automate Premium per user or Power Automate Process per process.

How many gateways belong in a cluster?

A cluster supports up to 10 members. For mid-sized companies, two to three, spread across different machines, are enough, since only one standard gateway can run per machine. All members should use the same version, and members that are offline should be removed or disabled.

What happens if we lose the recovery key?

Then the gateway can be neither moved nor restored, and the service account can no longer be changed either. Microsoft has no access to this key and cannot reconstruct it. The only option left is to register a new gateway and set up every connection in Power Automate again.