Skip to content

Network access for a self-hosted deployment

When you deploy BI Pixie on Azure, the Network tab decides who can reach BI Pixie over the network. The default, Public, suits most organizations. This page explains the other two choices, Restricted and Private, so that you can decide whether your organization needs one of them.

Who this is for

This setting is for organizations whose security policy does not allow a service in their subscription to accept requests from the whole internet. If your policy has no such rule, keep Public: every viewer is tracked, and there is nothing more to prepare.

The Network tab appears only when the deployment creates new Function Apps, from version 1.1.0 of the deployment template. A deployment that uses existing Function Apps keeps the network setup they already have.

Why network access decides who is tracked

Pixies are images that each report viewer’s own browser loads. The BI Pixie event address must therefore be reachable from wherever your viewers are. A viewer who cannot reach it is not tracked. Their reports still open and work normally, so nothing tells the viewer or you that their activity is missing.

The three choices

  • Public. The standard setup. Every viewer is tracked, wherever they are. It costs nothing more.
  • Restricted to my network addresses. The event address accepts requests only from the public IP addresses or ranges you list, such as your office and VPN exit addresses. It costs nothing more.
  • Private. The event address, the new storage accounts and a new Event Hubs namespace get private addresses in your virtual network, and their public access is turned off. Private endpoints cost about $44 to $66 a month.

Every cost on this page is an Azure charge in your own subscription, billed to you by Microsoft, not by BI Pixie.

Restricted to my network addresses

What changes for viewers

Viewers whose traffic leaves through one of the addresses you list are tracked. Viewers whose traffic does not are not tracked, for example a phone on a cellular network, a guest user from another organization, or a laptop off the VPN.

What to prepare

A list of the public IP addresses or ranges your viewers’ traffic leaves through. Your network team usually holds it. In Allowed public IP addresses or ranges, enter them separated by commas, for example 203.0.113.10, 198.51.100.0/24.

What stays public

Only the event address is restricted. Storage and Event Hubs keep their public addresses, protected by keys and identity.

Private

What changes for viewers

Only viewers on your corporate network or VPN are tracked. A viewer at home without the VPN, on a phone, or from another organization is not tracked.

What to prepare

  • An existing virtual network in the same region as the deployment, connected to your corporate network. Enter its resource ID in Virtual network resource ID.
  • An empty subnet for the BI Pixie Function Apps, delegated to Microsoft.App/environments for the Flex Consumption plan or to Microsoft.Web/serverFarms for the Elastic Premium plan. For the Flex Consumption plan, the Microsoft.App resource provider must be registered in the subscription. Without it, the deployment waits about 20 minutes and then fails.
  • A second subnet for the private endpoints. It must not be delegated.
  • A decision about DNS. Select Create private DNS zones for me only if your network does not already have private DNS zones for Azure Storage, Event Hubs and Azure Functions. Each zone costs about $0.50 a month. If your organization resolves privatelink names centrally, leave it cleared and add the records yourself.

What else changes with Private

  • The BI Pixie Dashboard refresh needs an on-premises or virtual network data gateway, because the Power BI service cannot reach private storage.
  • If you use the BI Pixie workload in Microsoft Fabric, choose Public or Restricted instead.
  • The MCP server for AI agents is not offered in the same deployment. It can be added later in a separate deployment.
  • The Function Apps still need outbound access to the Power BI REST API (api.powerbi.com), Microsoft sign-in (login.microsoftonline.com), Log Analytics when you use it (api.loganalytics.io), and bipixie.com, which serves the BI Pixie code package at deployment. Allow them if your network filters outbound traffic.

Adding a web application firewall

With Private, you can also put a web application firewall in front of the event address. It serves Pixies under a host name in your own domain and costs about $335 to $350 a month. See Web application firewall.

After the deployment

With Public or Restricted, there is nothing more to do. Continue with Add Pixies to your reports.

With Private, make sure your DNS resolves the private addresses before you add Pixies, and set up the data gateway before the first dashboard refresh. Then open a report with Pixies from a device on your network and check that its activity appears.

The network choice is made when BI Pixie is installed. A Managed App cannot change it afterwards, because Azure keeps the resources in its managed resource group read-only for you. Changing it takes a new deployment.