What should you deploy to provide Power BI Service users access to on-premises data sources without exposing database servers to the internet?

To provide Power BI Service users access to on-premises data sources securely without exposing the database servers to the internet, deploying an on-premises data gateway is the correct approach. This gateway acts as a bridge, facilitating secure data transfer between on-premises data sources and Power BI in the cloud. By using the on-premises data gateway, users can refresh datasets and access reports without needing to open up direct connections to the database servers over the internet, thus maintaining a secure environment for sensitive data.

The on-premises data gateway can be configured to work with large data sources and supports different authentication methods. Moreover, it allows organizations to manage data access in compliance with security policies while ensuring that users can obtain the latest data for their reports and dashboards.

Other options, such as a virtual network data gateway or an ExpressRoute connection, serve different purposes. The virtual network data gateway is typically used for establishing VPN connections with Azure services but does not directly serve Power BI's purpose of accessing on-premises data. An ExpressRoute connection is meant for creating private connections to Azure services from on-premises networks but still does not provide the same level of integration with Power BI as the on-premises data gateway. The personal mode of the on-premises data gateway,