To support the data refresh operations of Azure Analysis Services models based on on-premises sources, an On-premises data gateway resource is created in Azure and associated with the Azure Analysis Services resource. As shown in the following image, the gateway resource is located in the same region (North Central US) as the Power BI service tenant:

To create a gateway resource in Azure (for example, FrontlineGateway), either search the Azure marketplace for On-premises data gateway in the Azure portal or use the link (Create a gateway in Azure) provided on the Status page of the On-premises data gateway application. Like other resources in Azure, an Azure subscription and resource group are required to create and configure the gateway resource. However, the gateway resource only stores metadata to reference an existing gateway installation and thus there are no billing charges associated with the gateway itself. The name of the existing (and running) gateway should appear on the Installation name property of the Create connection gateway blade in the Azure portal. 

Once created, the gateway resource in Azure must be associated with the Azure Analysis Services resource, as shown in the following image:

In the preceding example, the AAS resource (frontline) has been configured to use the FrontlineGateway resource via the On-premises data gateway setting for AAS resources. The FrontlineGateway, in turn, references an existing installation of the On-premises data gateway. Because the AAS resource is associated with the gateway in the Azure portal, it does not need to be added as a data source in the manage gateways portal of Power BI. 

From a user authentication and row-level security standpoint, Live connection queries against AAS provide the Azure Active Directory account of the user. Therefore, the row-level security models built into AAS models must reflect these AAD identities to be enforced.