GatewayLens

The free admin console for Power BI and Microsoft Fabric data gateways - on-premises and VNet.
Rotate a password on hundreds of gateway connections in one run, hand over a leaver's access,
find the access the portal hides, and watch every gateway cluster on one screen.

Download GatewayLens.exe  |  Try the demo - no sign-in  |  Everything it does  |  Questions

Why gateway admins use it

The portal's Manage connections and gateways page works one connection at a time. With dozens of gateway clusters and thousands of connections, everyday work turns into days of clicking. GatewayLens does the same work in bulk, safely:

• A service account password changed? Filter by the account stored in the credentials and update every connection that uses it in one run - each one is then tested, and the username stays visible, just as when you use the portal.
• Someone is leaving? Move all their access - every connection, every gateway cluster, the same roles - to their successor. Nothing is ever left without an owner.
• Access nobody can see. Accounts deleted from Microsoft Entra ID keep their roles on gateways and connections, and the portal does not list them. GatewayLens counts them, names them when Microsoft still can, and lets you remove them.
• A cluster filling up? Microsoft allows 1,000 data sources per gateway cluster. Every tile says how many are unused; one click lists them with the reason, and a cleanup report tells their owners before you delete.
• Is anything down? A live wall of every gateway cluster, a kiosk view for a TV on the wall, and a message in Teams when a member drops.

Free and open source (MIT). One exe, nothing to install on the gateways, and it signs in as you - so it can do exactly what you can do in the portal, and nothing more.

Tip

Look around before you sign in anywhere: start GatewayLens and choose Try the demo. Contoso is a fictional company, every button works, and nothing leaves your computer.

Built for big tenants

The job	In the portal	In GatewayLens
Rotate a service account password	Edit each connection's credentials, one by one	Filter by the account in the credentials, update every connection in one run, each one tested afterwards
Someone leaves the company	Find each connection and gateway they can use, share it again, remove them	Move access: their successor gets exactly the same roles everywhere, then theirs are removed
Who can use what?	Open each connection's list of users	Filter by person, by credential account, by server or database - and export an access report for the auditor
Who still has access after leaving?	Not shown - deleted accounts are left out of the lists	Show N not in Entra ID, and Access by accounts not in Entra ID across every connection
Make room on a cluster	Check connections one by one	Every tile: "940 of 1,000 - 312 unused". Cleanup candidates with the reason, a cleanup report for the owners - then delete, with a backup written first
Is every gateway up, current and supported?	Open each gateway	One coloured tile per cluster, versions checked against Microsoft's supported releases, a kiosk view and alerts
What changed, and who did it?	-	Every change is recorded the moment it happens: who, when, what, and the result

See it

The gateway wall - every cluster, problems first; members, versions, the 1,000 limit and who can manage each one.

Find any connection - by who has access, the account in its credentials, the server or database - and see who can use it, by name.

Test hundreds at once - every result in the log as it comes, in colour, with the gateway's own reason for each failure.

Find what the portal hides - roles still held by accounts deleted from Microsoft Entra ID, by name when it is recent.

Make room before the 1,000 limit - a cleanup report to forward: how full each cluster is, how recently its connections were used, what can go and why, and whom to ask.

A wall screen - the kiosk view: full screen, nothing that changes anything, counting down to the next refresh.

More: alerts, the start page, and the light theme

Every picture shows Contoso, a fictional company: the built-in demo - and for the cleanup report, a larger made-up Contoso, the size of tenant the report is for.

What it does

Watch every gateway - and hear when one drops

• One coloured tile per gateway cluster - on-premises and virtual network: green online, amber degraded, red offline. Problems come first, so they are seen from across the room.
• Each tile shows members online ("1 of 2 members online"), the gateway version and its release month, how long a member has been down, and the cluster's connections against the 1,000 limit.
• Versions against Microsoft's own list - the newest build from the Download Center and the six monthly releases Microsoft still supports from Learn. Badges say UNSUPPORTED VERSION, UPDATE AVAILABLE, MIXED VERSIONS, NEAR CONNECTION LIMIT or AT CONNECTION LIMIT.
• Alerts - when a member goes down, and when it is back: a Windows notification, a sound, or a message in a Teams channel - or a Power Automate flow, which can send an email or open a ticket. A member counts as down only after two checks in a row, so one slow answer wakes nobody. Off until you turn them on.
• The taskbar button turns yellow while a gateway is degraded and red while one is offline - seen even with the window minimised.
• Kiosk view - full screen, tiles only, nothing that changes anything, refreshing every minute with a countdown. The Kiosk view button, -Kiosk or F11; Esc leaves it.
• VNet gateways are never woken up. A status check starts a VNet gateway that has gone to sleep, and it then uses capacity - so Skip VNet status is on by default.
• Enable or disable one member or several at once, with a warning before the last one. Copy a cluster as tab-separated text for Excel or a ticket. Resolve member machines to IP addresses.

Find any connection

Filters you can combine, which the portal does not have:

• who has access - one person, a group, anyone whose name or email contains a word
• the account stored in the credentials - every connection that uses svc_sales
• the server, database or path - several values at once: sql01; sql02; ora-prd
• gateway, connectivity, type, and whether the connection's gateway is online
• gateway connections only by default; cloud connections with one tick

Every list works like a spreadsheet: click a column name to sort - the sort stays through refreshes - and copy a cell, the selected rows or all of them, with or without the column names (Ctrl+C, Ctrl+Shift+C, or right-click). It pastes into Excel as cells. Double-click a cell to select just part of it, such as a server name in a long path.

Change hundreds of connections at once

Everything acts on every listed connection - filter first, exclude what you want to leave alone, then press one button:

• Update credentials - Windows, Basic, Anonymous or Key - the way the portal does it, so the username stays visible, and tested afterwards, so you know at once which ones still fail. For connections on on-premises gateways; VNet gateway connections are on the roadmap.
• Grant or remove access for any number of people and groups. Someone who already has the role is left alone, a lower role is raised, and the list is read again afterwards, so it shows what really happened.
• Verify status - the gateway's own reason for every failing connection, each one in the log as it is tested. A connection with Skip test connection on is marked Unverified: its test passes whatever the data source says.
• Verify users - who has access to each one, by name, in the list and the log. Right-click a few rows to verify the status or the users of just those.
• Delete - only after typing the count, and only after a backup is written.

Hand over access

For someone leaving, or a new owner of a team's connections. Name who hands over and who takes over. Copy access gives the successor exactly the same roles on every listed connection - and, with Gateway clusters too, on every gateway cluster - raising a lower role where they already have one. Move access does that, then removes the old roles - but only where the successor has them by then, so nothing is ever left without an owner. It works for an account that is already deleted, too: by the object id the access lists show.

Clean up before you hit the limit

Microsoft allows 1,000 data sources per gateway cluster, and a full cluster takes no new connection. GatewayLens says what could make room, from Microsoft's connection recency (preview in Fabric):

• Every tile counts its cluster against the limit, and how many could go: "940 of 1,000 connections - 312 unused". Right-click it > List the unused connections.
• The Cleanup column says why, for each connection: not used for 212 days, no use recorded since it was made, a copy of 'Sales DW'.
• Show > Cleanup candidates lists what can go now: not used for more than four months - so a quarterly refresh is never taken for unused - or never used. Nothing made or linked to an item in the last 30 days, and nothing without recency data. A copy still in use is merge first: point its items at the copy that stays. A copy means the same server, account and sign-in settings - the same path with other credentials is often on purpose, and is never called a copy.
• Cleanup report... - a page to forward and print: how full each cluster is now and after cleanup, how recently its connections were used, what can go and why, and who to ask - each owner with theirs, read fresh from Fabric. With a table for Excel or a mail merge.
• Then Delete all listed connections - with a backup written first.

More views in Show: last used over 30, 90, 180 or 365 days ago, no use recorded, duplicates side by side, failing tests, Skip test connection on, and access by accounts not in Entra ID.

Find access the portal hides

Fabric keeps the roles of accounts that were deleted from Microsoft Entra ID, and the portal leaves them out of its lists. GatewayLens lists the same people as the portal, and counts the others apart: tick Show N not in Entra ID to see them. What it says about each one comes from Microsoft Graph, and only from there - an account deleted in the last 30 days by name, with the day it went; one gone for good as a Deleted account; and when Graph will not say, Not found - never a guess.

Prove it to an auditor

• Access report - one row per connection or gateway and person, with the role and whether the account still exists, read fresh from Fabric. With the User filter set: everything that one person can access.
• Change record - every change GatewayLens makes, one row each, as it happens: who, when, what, the person and role, the result, and Microsoft's reason for anything that failed. If the record cannot be written, the change is not made.
• CSV export of any list, ready for Excel.

Try it in two minutes

Start GatewayLens.exe and choose Try the demo - or from PowerShell:

.\GatewayLens.ps1 -Demo

The demo opens the real application on Contoso, a fictional company: gateways online, offline and slow, connections that fail for different reasons, a stale duplicate, an account that left the company, people and groups. Every button works, nothing leaves your computer, and no sign-in is needed. Sign in to your tenant in its top bar takes you to the start page. Things to try:

1. Kiosk view (F11) - the wall screen.
2. Connections > Verify status - five connections fail, and the StatusDetail column says why: a login, an expired password, a gateway that is offline.
3. Joe Smith is leaving: set User to joe.smith, then in Hand over access set To to ana.novak@contoso.com and press Move access.
4. Show > Access by accounts not in Entra ID - Tom Wright left, and still owns a connection.
5. Show > Duplicates - a stale copy of Sales DW is taking a slot on the Prod cluster.
6. Cleanup report... - what can go on every cluster, and whom to ask.

Use it on your tenant

The exe - download GatewayLens.exe from Releases and run it. It carries the script inside it and starts it in PowerShell 7; if PowerShell 7 is missing, it says how to install it. It opens on a start page: sign in when you are ready - with an admin account, if you keep one - or try the demo first. How every release is built, checked and signed: the code signing policy.

Or the script:

Unblock-File .\GatewayLens.ps1      # allow the downloaded script to run
.\GatewayLens.ps1 -SelfTest         # what works for your account - read-only, changes nothing
.\GatewayLens.ps1                   # the console

Run the self-test first - GatewayLens.exe -SelfTest works too. It signs you in, calls every API once and reports what your account can and cannot do, so a missing permission shows up as one clear line instead of an empty grid.

Requirements and sign-in

• Windows with PowerShell 7.2 or later - winget install Microsoft.PowerShell
• Az.Accounts, once: Install-Module Az.Accounts -Scope CurrentUser - no admin rights, and no approval: Microsoft's Azure PowerShell is already approved in practically every tenant.
• GatewayLens signs in as you, in the browser, and acts with your permissions - exactly what you can see and change in the portal, no more.

	You need	Approval by your organisation
Az.Accounts - the way in today	Install-Module Az.Accounts -Scope CurrentUser, once, no admin rights	None
Your organisation's app registration	-ClientId <application id> - docs/sign-in.md	Once, by IT
Built-in - coming: nothing to install	Nothing	Once, the first time anyone uses GatewayLens

docs/sign-in.md has the details, and a section to forward to IT. docs/permissions.md says which role each action needs.

Options

.\GatewayLens.ps1 -Kiosk                                # straight into the wall screen
.\GatewayLens.ps1 -Account admin.jane@contoso.com       # a separate admin account
.\GatewayLens.ps1 -TenantId contoso.onmicrosoft.com     # a specific tenant
.\GatewayLens.ps1 -DeviceCode                           # sign in on another device
.\GatewayLens.ps1 -LogFolder \\server\share\gatewaylens  # one change record for a whole team
.\GatewayLens.ps1 -SignIn Browser                       # the built-in sign-in, even with Az.Accounts
.\GatewayLens.ps1 -ClientId <application id>            # your organisation's own app registration
.\GatewayLens.ps1 -DnsSuffix corp.contoso.com           # an extra suffix for Resolve IPs
.\GatewayLens.ps1 -Inspect                              # which fields the APIs return (no data)
.\GatewayLens.ps1 -Demo -SelfTest                       # the self-test against the demo
Get-Help .\GatewayLens.ps1 -Full                        # everything else

Safe by design

GatewayLens can change access and credentials on hundreds of connections, so it is built to make mistakes hard:

• Nothing changes until you press a button that says so - and every one of them asks first, naming exactly what it will do and to how many items.
• One item at a time, cancellable at any point, with every item and its result in the log - and the reason for each one that did not succeed.
• One thing at a time - while a change or a reload runs, the buttons that would clash with it wait.
• No record, no change - every change is written to the change record as it happens, and is not made at all if the record cannot be written.
• Delete writes a backup first - everything needed to recreate each connection except its password, which the API never returns. No backup, no delete. You type the count to confirm.
• Move access never leaves a connection without an owner - the old role is only removed where the new person has it.
• Names are never guessed - a name that matches more than one person is refused, and an account is only called deleted when Microsoft Graph says so.
• No passwords or tokens are stored - you sign in on Microsoft's own page, and tokens live in memory only. Password boxes are never remembered. A Teams alert address is kept encrypted for your Windows account.
• Nothing is sent anywhere but Microsoft - no telemetry, no server of ours.
• VNet gateways are not woken up unless you ask.
• Open source, with over 500 automated tests - and a demo mode to try every button first.

Exported CSV files contain your tenant's gateway, connection and user names - treat them accordingly. SECURITY.md says what GatewayLens touches, and how to report a security problem.

What you will see

GatewayLens shows what your account can see. The Fabric API lists the gateways and connections you hold a role on - it is not a tenant-wide inventory, even for Fabric administrators. Connection counts are what your account can see too, so a cluster can hold more. To manage a gateway or its connections you need the matching role on it - docs/permissions.md.

Where the data comes from

Feature	API	Status
Sign-in	Microsoft Entra ID (OAuth 2.0)	Documented
Gateways, members, connections, access, recency, delete	Fabric REST API	Documented (recency is in preview)
Connection test, update credentials	Power BI REST API	Documented
Update credentials like the portal - keeps the username readable	Power BI v2 credentialsV2	Unofficial - the documented call is used if it is refused
Names of who has access, deleted accounts, name lookup when granting access	Microsoft Graph	Documented
Live member status	Power BI v2 gatewayClusters	Unofficial
Usernames and access in one call	Power BI v2 gatewayClusterDatasources	Unofficial
Alerts in Teams or a flow - only if you turn them on	Your own Teams workflow or Power Automate flow	Documented
Newest gateway version, supported releases	Microsoft Download Center and Learn pages	Public web pages - read once a session, no sign-in, nothing about your tenant is sent

About the unofficial parts. A few things are not available from the documented APIs at a reasonable cost, so GatewayLens takes them from the endpoints the portal itself uses: whether each member is online right now, the account stored in each connection's credentials with its users, and updating credentials so that account stays visible. Each is isolated in a single function, with its own checkbox. If Microsoft changes one, the only effect is empty columns, or the documented way - everything else keeps working.

About credentials. Credentials sent to a gateway must be encrypted with that gateway's public key, in exactly the format the gateway expects. GatewayLens uses a port of Microsoft's own implementation from the open-source Power BI .NET SDK (MIT License), and the test suite decrypts its output with a private key to prove the format byte for byte.

Log, change record and look

• The log panel says what happens as it happens, in colour - green done, amber warnings, red failures: every item of a bulk run with its result, how long each load took, what the list shows after a filter changes. It filters by text or level, and copies or saves what it shows. Everything in it also goes to a daily log file, kept for 30 days. The change record is kept for good.
• The status bar says what is running and how far it is - "reading the connections - 1,500 of about 2,600" - and shows what GatewayLens uses: CPU, memory, its workers, and the calls it made to Microsoft, with how many were throttled.
• Both records live in %LOCALAPPDATA%\GatewayLens\logs - Open folder takes you there. With -LogFolder \\server\share\gatewaylens a whole team's records sit in one place; each person writes only to files with their own name in them.
• Themes: Light, Dark, Midnight and Contrast. Text size: A- and A+, Ctrl + mouse wheel, or Ctrl + plus and minus - Ctrl + 0 goes back to the default. Rows and tiles follow the text size. Drag the grips between the panels to give the list or the actions more room - the sizes are kept.
• Help is one click away: the ? button (or F1) - the guide, what each action needs, what is new, and where to report a problem. The search and name boxes remember their last 20 entries; password boxes never do.

Questions

How do I update the credentials of many gateway connections at once?

Filter the Connections list to the ones you mean - by the account stored in their credentials, a server, a gateway - then Update credentials below it. Every listed connection gets the new username and password, encrypted for its gateway, and is tested afterwards. The username stays visible in the portal, as if you had typed it there.

How do I find every connection a service account is used in?

Type the account into Account: every connection whose credentials use it is listed, on every gateway you can see. Export CSV gives you the list.

How do I hand over a leaver's connections and gateways?

Set User to them, then in Hand over access set To to their successor and press Move access. Tick Gateway clusters too for the gateway roles. The successor gets exactly their roles; theirs are removed only where the successor has them by then.

Why does GatewayLens list accounts the portal does not show?

The portal leaves out accounts that were deleted from Microsoft Entra ID - but they still hold their roles. GatewayLens lists the same people as the portal, and counts those apart: tick Show N not in Entra ID to see them, then remove them.

Can I get an alert when a gateway member goes offline?

Yes: Alerts on the Gateways tab - a Windows notification, a sound, or a message in a Teams channel or a Power Automate flow. They come while GatewayLens is open with auto-refresh on - on a wall screen in kiosk view, for example.

How close am I to the 1,000 data source limit?

Every tile counts its cluster's connections against it - with a badge when it gets near, and how many are unused. Show > Cleanup candidates lists what can go, with the reason, and Cleanup report... makes a page for the owners: how full each cluster is now, and after cleanup.

Does it work with Microsoft Fabric and VNet data gateways?

Yes. It uses the Fabric REST API for gateways and connections, and shows on-premises and virtual network gateways alike - without waking a sleeping VNet gateway.

Is it really free, and is it from Microsoft?

Free - MIT licence, for any use, including at work. It is not from Microsoft: it is an independent tool that uses Microsoft's own APIs, with your sign-in and permissions.

Does it need admin rights on my PC, or anything on the gateways?

No. It runs as you, and the gateways are only reached through Microsoft's APIs.

Can it see every gateway in the tenant?

It sees what your account can see - the same as the portal. See What you will see.

Does it send my data anywhere?

Only to Microsoft's APIs, which it needs to do its job, and it reads two public Microsoft pages for the newest gateway version. Alerts go to a Teams workflow or Power Automate flow of yours, if you turn them on. There is no telemetry and no server of ours.

Troubleshooting

An empty grid. Run .\GatewayLens.ps1 -SelfTest. It names the call that failed and the API's own error message.

Sign-in says GatewayLens is not approved. Your organisation approves it once - see docs/sign-in.md, which you can forward to IT. Or install Az.Accounts (Install-Module Az.Accounts -Scope CurrentUser) and start again - no approval is needed that way.

"cannot be loaded because running scripts is disabled". Run Unblock-File .\GatewayLens.ps1, or for your user only: Set-ExecutionPolicy -Scope CurrentUser RemoteSigned.

The exe is blocked or SmartScreen warns. The exe is not code-signed, and some company security tools block unsigned programs that start PowerShell. Run the script instead - it is exactly the same tool.

The Status column shows n/a. The unofficial status endpoint did not answer - the log says why. Untick Live member status to stop trying.

A connection test fails with a data source error. That is the gateway's own answer: it reached the gateway, and the gateway could not reach the data source.

Roadmap

• The built-in sign-in: GatewayLens's own app registration, so nothing has to be installed - not even Az.Accounts
• A gateway health report - one page to send to your manager: versions, the 1,000 limit, deleted accounts with access, unused connections
• Alerts without the window open, for a server or a scheduled task
• Local snapshots, to show what changed and what was deleted since a given day
• Sign-in as a service principal, for unattended reports
• Credentials for virtual network gateway connections
• Signed releases - applied for

Ideas and bug reports are welcome as issues.

About

GatewayLens is made by Lukas Novacek, a BI infrastructure engineer who runs Power BI and Fabric at enterprise scale - and writes about the things the docs do not tell you at lukeweaves.hashnode.dev.

If GatewayLens saves you time, star the repository and share it with a colleague who runs gateways - that is what keeps it going.

Development

.\tests\Run-Tests.ps1             # the test suite - no tenant, no sign-in
.\build\Build-Exe.ps1             # builds dist\GatewayLens.exe (needs the .NET SDK)
.\build\Make-Marketing.ps1        # the pictures in this README, all from the demo

The tests replace every call to Microsoft with a stand-in, so they run on every push via GitHub Actions - which also builds the exe; download it from the run's Artifacts. Pushing a tag such as v0.9.0 publishes a release with the exe and the script attached. Changes are recorded in CHANGELOG.md.

Code signing policy

Free code signing provided by SignPath.io, certificate by SignPath Foundation.

Note

Applied for. Until it is in place, releases are not signed - check a download with the SHA-256 in its release notes.

• What is signed: GatewayLens.exe and GatewayLens.ps1 of every release - and the copy of the script inside the exe, which is signed before the exe is built.
• How: every release is built from a version tag in this repository by GitHub Actions (release.yml), checked, and signed in that same run. Nothing built anywhere else is signed.
• Committers and reviewers: Lukas Novacek
• Approvers: Lukas Novacek - every release is approved by hand before it is signed.
• Privacy: GatewayLens sends nothing about you or your tenant anywhere except to Microsoft, when you sign in and use it. It also reads two public Microsoft pages for the newest gateway version, without a token or anything about your tenant, and sends alerts only to a Teams workflow or Power Automate flow you set up. There is no telemetry. Where the data comes from lists every service it talks to.

How to check a signature, and what IT may need: docs/code-signing.md.

Licence

MIT. GatewayLens is an independent project and is not affiliated with, endorsed by or supported by Microsoft. Power BI and Microsoft Fabric are trademarks of Microsoft Corporation.