Data security

SYSPRO data in Power BI, secured by Microsoft.

ForesightSA apps install into the company’s own Microsoft 365 tenant. ForesightSA has no access to the data, the reports or the SQL Server.

Compare the two setupsWatch the gateway video
Architecture

How the data flows

Encrypted from SQL Server to the report. No inbound firewall ports.

Company premises or hosting partner

SYSPRO SQL Server

Read-only SQL login

On-premises data gateway

Free Microsoft app

Outbound onlyHTTPS, TCP 443
Company Microsoft 365 tenant

Power BI service

Encrypted at rest

Company users

Microsoft work accounts

ForesightSA receives the licence key only. No SYSPRO data.

Security controls

Security facts for IT and auditors

No inbound ports

The gateway only connects out to Microsoft.

Read-only

Power BI can’t change SYSPRO data.

SQL password remains local

Only the gateway machine can decrypt it.

Encrypted

TLS 1.2 in transit. Encrypted at rest in Power BI.

Microsoft sign-in

Disabling a Microsoft 365 account removes access.

Data region

Stored in the tenant’s home region.

Hosted SQL Server

The gateway reaches SQL Server over the hosting partner’s VPN, or runs inside the partner’s network. SQL port 1433 remains closed to the internet.

Two setups

Microsoft 365, with or without Azure

Same app and gateway. Azure adds stricter sign-in and monitoring.

Security control
Microsoft 365Power BI Pro or Premium Per User
Microsoft 365 + AzureMicrosoft Entra ID P1 or P2
Microsoft work account sign-in
Multi-factor authentication
Security defaults
Conditional Access
Gateway, outbound only
Power BI audit log
Sign-in from company devices only
Block sign-in by country
Time-limited admin rights
Entra ID P2
Private network access
Private Link
Company’s own encryption key
Fabric or Premium capacity

Every Microsoft 365 tenant includes Microsoft Entra ID (formerly Azure Active Directory).

ForesightSA’s access

What ForesightSA can see

Item
ForesightSA access
SYSPRO database
No access
Reports and data
No access
SQL login and password
No access
Gateway
No access
Licence key
Checked at each refresh
Support call
The shared screen, by invitation

The licence service records the key, the time and the IP address of the calling Microsoft server.

SYSPRO side

SYSPRO and SQL Server settings

Dedicated read-only login

A SQL login for Power BI only, with db_datareader.

TLS 1.2

Encrypts SQL connections from SYSPRO 8 2020 R1.

TDE

Encrypts the SQL data and log files on disk.

SQL Server Audit

Logs every query from the Power BI login.

SYSPRO Cloud ERP allows no direct SQL access, only read-only OData. Contact ForesightSA.

Questions

Common questions

Does SYSPRO data leave the building?
  • A copy of the report data is stored, encrypted, in the company’s Power BI tenant. The live database remains on the company’s SQL Server.
Is an Azure subscription required?
  • No. Microsoft 365 and Power BI Pro or Premium Per User are enough.
Does the firewall require changes?
  • Usually not. The gateway only connects outbound on TCP 443.
What happens when an employee leaves?
  • IT disables the Microsoft 365 account, and the person loses access to the reports.
Further reading

Microsoft and SYSPRO documentation

Questions from the IT team?

ForesightSA can take the IT team through the setup on a short Teams or Zoom call.

Contact ForesightSA