RUN-GW-001 / SOURCE CONTROLLED
On-premises data gateway continuity checklist
Use when Power BI, Power Apps or Power Automate depends on on-premises data and loss of one gateway host must not become loss of the service.
● CONTROLLEDOWNER / SYSTEM 8REVIEW / MONTHLY
Dependency inventory
| LAYER | CAPTURE | FAILURE PROOF |
|---|---|---|
| Cloud workload | Workspace/environment, asset/flow, owner, schedule | Refresh/run history |
| Connection | Connector, connection owner, cluster/data source | Binding export |
| Gateway cluster | Cluster/member IDs, admins, region, load setting | Admin inventory |
| Member host | VM/host, version, service, CPU/RAM/disk/spool | Host monitoring |
| Network | DNS, proxy, firewall, outbound relay path | Port test + network evidence |
| Data source | Server, driver, identity, permissions, HA state | Connection and owner test |
| Recovery | Key escrow, installer, restore authority | Retrieval/restore exercise |
Cluster build gate
- Use standard-mode gateways for shared Power Platform workloads.
- Provide at least two members for a business-critical cluster.
- Separate host and maintenance failure domains.
- Prove identical data-source, proxy and outbound connectivity from every member.
- Align supported versions, drivers, service settings and capacity.
- Join the existing cluster with the controlled recovery key.
- Remove or disable persistently offline members through supported administration.
Failover acceptance matrix
| TEST | EXPECTED OUTCOME | EVIDENCE |
|---|---|---|
| Normal import refresh | Current data within SLA | Refresh + gateway request IDs |
| DirectQuery interaction | Query completes through available member | Query and member logs |
| Power Automate read | One successful response | Run + source evidence |
| Power Automate write | One authoritative business effect | Run + destination key |
| Member A unavailable | New requests use member B | Cluster/member evidence |
| Member B unavailable | New requests use member A | Cluster/member evidence |
| Shared dependency failure | Alert and controlled degraded state | Network/source alert |
| One-member update | Service remains within SLA | Maintenance record |
Recovery-key and restore gate
- Verify two authorised operators can retrieve the recovery key without disclosing it.
- Confirm installer, tenant sign-in, cluster selection and host prerequisites.
- Exercise restore/takeover in a bounded plan without deleting the live cluster.
- Validate every Power BI and Power Platform connection after recovery.
- After key change, explicitly re-encrypt/edit non-Power-BI connections as required.
- Retire a legacy key only after the complete binding inventory passes.
Monitoring and alert thresholds
| SIGNAL | CONTROL |
|---|---|
| Member offline / cluster degraded | Alert before total outage |
| Version drift | Sequential monthly review/update |
| CPU, memory, disk, spool | Capacity thresholds and trend |
| Network-port/proxy failure | Scheduled synthetic connectivity test |
| Query duration/failure | Gateway performance logs |
| Refresh/run failure | Workload owner notification |
| Credential/owner expiry | Lifecycle review before failure |
Operating cadence
- Daily: gateway/member and failed-workload alert handling.
- Monthly: version, owner, credential, capacity and offline-member review.
- Quarterly: controlled loss of each member and replay/reconciliation test.
- Annually: bounded restore/takeover exercise and continuity-objective review.
- After change: network, proxy, driver, service account, gateway or data-source regression tests.
Limits
A gateway cluster does not make the data source, DNS, proxy, firewall, identity provider or workflow transaction highly available. It routes new requests through available gateway members; interrupted operations still require workload-specific retry and reconciliation. This checklist does not authorise destructive cluster deletion or production fault injection.