Metabase vs Power BI on Azure SQL Database

Power BI and Metabase both build dashboards on Azure SQL Database. Power BI imports tables into a semantic model that it refreshes on a schedule, or it sends DirectQuery queries that you set up in Power BI Desktop. Sharing a report takes a paid license, Power BI Pro at $14.00 per user per month paid yearly or Premium Per User. Unless the workspace runs on a Fabric F64 or Power BI Premium P1 capacity or larger, each viewer needs Pro, Premium Per User or a trial too. Metabase connects with its SQL Server driver and runs each question against Azure SQL, with caching for results that change slowly. Its open-source edition is free with unlimited users, and guest embeds with locked parameters work on every plan, including the free one.

You can run Metabase in your own Azure subscription, as an App Service web app next to the database, or let Metabase Cloud run it for you. Since Metabase 64, Metabase can sign in to Azure SQL with Microsoft Entra ID, through a service principal or, when Metabase runs in Azure, a managed identity. Prices and plan details were checked on October 30, 2026.

Connecting to Azure SQL: the SQL Server connection form, field by field

Azure SQL Database uses Metabase’s SQL Server connection, in Admin > Databases > Add a database. The section Connecting to Azure SQL in Metabase’s docs tells you to set the port to 1433. The host is the address of your logical server’s public endpoint, such as yourserver.database.windows.net, and the form has these fields:

• Connection string: paste one here, and Metabase fills in the fields below it.
• Display name: the name that people see for this database in Metabase.
• Host, Port and Database name: your server’s name, 1433, and the name of your database.
• Database instance name: Metabase’s docs use it when you run multiple databases on the same host.
• Authentication method: one of the four options below, and each option shows its own fields.
• Default impersonation user: the user for system queries when you use impersonation and the connection’s own user can’t be impersonated.
• Schemas: the schemas that Metabase syncs, such as the one that holds your reporting views.
• Use a secure connection (SSL) and Use an SSH tunnel: encryption, and a route through a bastion host to a database in a private network.
• Additional JDBC connection string options: extra driver options, with trustServerCertificate=false as the example in the field.
• Re-run queries for simple explorations, Choose when syncs and scans happen and Periodically refingerprint tables: advanced options that decide how often Metabase queries the database.

Microsoft Entra ID: service principal or managed identity

Metabase 64 added Microsoft Entra ID authentication for SQL Server and Azure SQL connections, and under Authentication method, you pick how Azure SQL identifies Metabase:

• SQL Server login: a Username and Password, which works when SQL authentication is turned on for the server.
• Azure AD - Service principal: the Client ID and Client secret of an Entra ID app registration, and you grant that service principal CONNECT on the database.
• Azure AD - Service principal (certificate): the same app registration with its certificate in Client certificate, plus Certificate password, Client key and Client key password if you need them.
• Azure AD - Managed identity: Metabase signs in as the managed identity of the Azure compute that runs it, such as App Service, Container Apps, a VM or AKS. Leave Managed identity client ID blank for the default identity, or enter the client ID of a user-assigned identity.

So a self-hosted Metabase in your Azure subscription connects with no password or secret. Metabase Cloud, which runs on AWS, connects with a SQL Server login or a service principal. Metabase’s docs recommend keeping Use a secure connection (SSL) turned on, and the toggle sets the JDBC encrypt property. With encrypt on and trustServerCertificate=false, the Microsoft JDBC driver validates the server’s TLS certificate, which makes sure that Metabase connects to the right server.

Azure SQL firewall rules for Metabase Cloud’s IP addresses

Metabase Cloud connects from fixed IP addresses that Metabase publishes for each region, and the SQL Server form on Metabase Cloud shows them in a banner. Add them as server-level IP firewall rules on your logical server:

# Metabase Cloud to Azure SQL Database: one server-level firewall rule per address.
# These are the eu-central-1 (Frankfurt) addresses from "IP addresses to whitelist";
# use the list for your region.
i=1
for ip in 18.192.2.142 18.184.191.58 3.65.184.173; do
  az sql server firewall-rule create --resource-group analytics-rg --server your-sql-server \
    --name "metabase-cloud-$i" --start-ip-address "$ip" --end-ip-address "$ip"
  i=$((i + 1))
done

A read-only database user for Metabase

Metabase needs CONNECT on the database and SELECT on the schemas it reads, and its sync reads view names as well as table names. Connect to your database as a user with the ALTER ANY USER permission, then run one of these options. For Option 2, that user must sign in with a Microsoft Entra identity:

-- Run in your database, not in master. Follows "Database users, roles, and privileges"
-- (Metabase) and Microsoft's CREATE USER, GRANT and Microsoft Entra authentication docs.

-- Option 1: a contained database user with a password, for "SQL Server login".
CREATE USER metabase WITH PASSWORD = 'Replace-with-a-Str0ng-password';
GRANT CONNECT TO metabase;
GRANT SELECT ON SCHEMA::reporting TO metabase;

-- Option 2: a service principal (use its display name) or a web app's
-- system-assigned managed identity (use the web app's name).
CREATE USER [your-metabase] FROM EXTERNAL PROVIDER;
GRANT CONNECT TO [your-metabase];
GRANT SELECT ON SCHEMA::reporting TO [your-metabase];

Run Metabase in your own Azure subscription, next to Azure SQL Database

Metabase’s guide Running Metabase on Microsoft Azure deploys the official Docker image as an App Service web app on Linux, joined to a virtual network. Metabase’s application database, which holds your questions and dashboards, runs in Azure Database for PostgreSQL behind a private endpoint. That keeps traffic from the web app to the database on Azure’s network. The guide asks for a production plan with at least 200 total ACU and 3.5 GB of memory.

The open-source edition needs no purchase or contract from Metabase. You download the metabase/metabase image, which Metabase releases under the AGPL license, and run it on Azure resources in your own subscription, so those resources are what you pay for. In a dedicated App Service tier, such as Premium v3, Azure charges for each VM instance in the plan. Pin a fixed image tag, such as metabase/metabase:v0.64.5. Metabase 64 is the current long-term support (LTS) release on Metabase’s version support page, and 64.5 was its latest patch on November 6, 2026.

App Service Health check pings a path such as Metabase’s /api/health every minute, and it replaces an instance that stays unhealthy for one hour. You can also create an Azure Monitor alert rule on its Health check status metric. Azure Database for PostgreSQL patches the database engine for you and keeps backups for seven days by default. To upgrade Metabase, back up the application database, then change the image tag in the web app’s Deployment Center.

# Metabase on App Service, in the same subscription and region as Azure SQL Database.
# Follows "Running Metabase on Microsoft Azure", with flags from the Azure CLI reference.
# Assumes a virtual network, metabase-vnet, that can reach an Azure Database for
# PostgreSQL flexible server, metabase-appdb, with a database and a login both named metabase.
RG=analytics-rg
APP=your-metabase   # also the name of the web app's managed identity
MB_DB_PASS='<password of the metabase login>'   # or read it from Key Vault

# A subnet for the web app, with a service endpoint for Azure SQL Database.
az network vnet subnet create --resource-group $RG --vnet-name metabase-vnet --name apps \
  --address-prefixes 10.0.3.0/24 --service-endpoints Microsoft.Sql

# A Linux plan (P1V3: 2 vCPUs, 8 GB of memory) and the web app on a fixed image.
az appservice plan create --resource-group $RG --name metabase-plan --is-linux --sku P1V3
az webapp create --resource-group $RG --plan metabase-plan --name $APP \
  --container-image-name metabase/metabase:v0.64.5 \
  --vnet metabase-vnet --subnet apps --https-only true

# Metabase listens on port 3000, and the MB_DB_* settings point to its application database.
az webapp config appsettings set --resource-group $RG --name $APP --settings \
  WEBSITES_PORT=3000 \
  MB_DB_CONNECTION_URI="jdbc:postgresql://metabase-appdb.postgres.database.azure.com:5432/metabase?ssl=true&sslmode=require" \
  MB_DB_USER=metabase \
  MB_DB_PASS="$MB_DB_PASS"

# Keep the app loaded when idle, and turn on Health check.
az webapp config set --resource-group $RG --name $APP --always-on true \
  --generic-configurations healthCheckPath=/api/health

# A system-assigned managed identity, for "Azure AD - Managed identity".
az webapp identity assign --resource-group $RG --name $APP

# Let the subnet through the firewall of your logical server.
az sql server vnet-rule create --resource-group $RG --server your-sql-server --name metabase-apps \
  --vnet-name metabase-vnet --subnet apps

Then create a database user for the managed identity with Option 2 above, and pick Azure AD - Managed identity in the connection form. Azure SQL requires the subnets in its virtual network rules to be in the same region as the database. If you deploy with Bicep, alwaysOn and healthCheckPath are part of the siteConfig of a Microsoft.Web/sites resource.

Does Power BI need a gateway for Azure SQL? Firewall rules and private networks

Power BI needs no data gateway for Azure SQL Database when it can reach the database directly. For that case, Microsoft’s Power BI docs say to set the database firewall to “Allow access to Azure services”. That setting adds the rule AllowAllWindowsAzureIps, and Microsoft warns that it allows connections from all Azure services, including services in other organizations’ subscriptions.

A database in a virtual network needs a gateway, and the virtual network data gateway needs a capacity: any F SKU, A4 or higher, or any P SKU. Each gateway member uses 4 capacity units of that capacity while it runs. The other option, the on-premises data gateway, is Windows software that you install and run yourself. Service principal sign-in to Azure SQL doesn’t work through either gateway.

Metabase has no gateway, because it connects to the database’s host and port from wherever it runs. In your virtual network, it reaches Azure SQL through a service endpoint, as in the script above, or through a private endpoint. Microsoft suggests both in place of AllowAllWindowsAzureIps, because they limit connections to specific subnets or private networks.

Metabase Cloud needs no gateway either, because you add its IP addresses to the Azure SQL firewall, as shown in the connection section. To keep outside addresses out of the firewall, turn on Use an SSH tunnel and connect through a bastion VM in your virtual network. Metabase’s SSH tunnel guide recommends that the bastion deny all traffic except from approved clients, which here are the Metabase Cloud addresses.

Power BI Pro pricing next to Metabase plans

These prices were checked on October 30, 2026. Power BI Pro costs $14.00 per user per month and Premium Per User costs $24.00, both paid yearly, and Microsoft 365 E5 and Office 365 E5 include Pro. Power BI Desktop is a free download, and a free license lets you build reports for your own use. To share them, you need Pro or Premium Per User. Unless the workspace runs on F64 or larger, or on Premium P1 or larger, each viewer needs Pro, Premium Per User or a trial. Fabric capacity costs $0.18 per capacity unit per hour, pay-as-you-go in East US, so an F64 costs $11.52 an hour, and publishing to it still takes a Pro license.

Metabase prices by plan and by user, and the price stays the same however many dashboards, queries or data sources you have. The open-source edition is free with unlimited users, under the AGPL license, and it needs no account or credit card. In the words of Metabase’s store, “No account needed. Download and self-host for free.” Starter is a Metabase Cloud plan at $100 a month with 5 users included, then $6 per extra user per month. Pro costs $575 a month with 10 users included, then $12 per extra user per month, on Metabase Cloud or self-hosted. Yearly billing saves 10% on Starter and Pro, and Enterprise starts at $20,000 a year.

Metabase Cloud runs Metabase for you, and Metabase handles setup, backups and upgrades. Starter and Pro come with a 14-day free trial, and in Metabase’s words, “Trials are free, with no obligation to buy”. Metabase’s security page describes its SOC 2 Type II report, which has a clean audit opinion. It also says that each Metabase Cloud customer has its own containers, with no shared clusters. The Enterprise plan adds help with procurement and a dedicated success engineer.

Scheduled refresh limits: Import, DirectQuery and Metabase’s live queries

Power BI’s Azure SQL Database connector supports Import and DirectQuery, and an Import model refreshes on a schedule, up to eight times a day on shared capacity. On Premium Per User, Premium or Fabric capacity, it can refresh up to 48 times a day. DirectQuery to Azure SQL Database must be set up in Power BI Desktop, a Windows app that needs Windows 10 or Windows Server 2016 or later. A DirectQuery query that returns more than 1,000,000 rows fails, unless a Premium capacity raises the limit. Models that you create in the browser are Import models, and the service’s direct connector for Azure SQL Database is deprecated.

Metabase has no import step to schedule, because each question runs against Azure SQL when someone opens it, and the results come back to Metabase. To keep the load on the database low, Metabase can cache results. The adaptive policy, on every plan, caches the results of slower questions for a multiple of their average run time, while Pro and Enterprise add duration and schedule policies. You can also turn off Re-run queries for simple explorations and choose when syncs and scans happen. By default, Metabase syncs metadata every hour and scans field values once a day.

Email subscription licensing, next to Metabase dashboard subscriptions

In Power BI, subscribing other people to a report or dashboard needs Pro or Premium Per User. Each report or dashboard can have up to 24 subscriptions, sent hourly, daily, weekly, monthly or once a day after a data refresh. External email recipients are supported only in workspaces on a paid Premium capacity, not on Premium Per User. Full-report PDF or PowerPoint attachments need Premium or Premium Per User, with no more than 20 pages and less than 25 MB.

Metabase sends dashboard subscriptions by email or Slack on every plan, hourly, daily, weekly or monthly, and each one can attach a PDF of the dashboard. Email can go to people who don’t have a Metabase account, and for billing, a user is someone who signs in to Metabase. Pro and Enterprise let you set different filter values for each subscription, such as one branch for each branch manager. A self-hosted open-source Metabase sends email through your own SMTP server, and Metabase Cloud manages an email server for you.

Row-level security and embedded dashboards

Power BI defines row-level security as roles with DAX filter expressions, for Import and DirectQuery models. The roles restrict people with Viewer permissions, but they don’t apply to workspace Admins, Members or Contributors.

Metabase’s row and column security shows each person specific data based on user attributes, such as a branch, on the Pro and Enterprise plans. These plans also offer impersonation on SQL Server, which runs queries with EXECUTE AS USER. That way, your Azure SQL permissions apply to questions from both the SQL editor and the query builder. On the same plans, people can sign in to Metabase with Microsoft Entra ID through SAML.

For customers without Power BI licenses, embedding for your customers needs a capacity, such as an A, EM, P or F SKU. An A1 node costs $1.0081 an hour in East US (checked on October 30, 2026). Publish to web shows a report to anyone on the internet, and it isn’t available for reports that rely on row-level security. Metabase guest embeds work on every plan, with no Metabase account for each viewer, and they show a “Powered by Metabase” banner on the Open Source and Starter plans. Your server signs a token that sets locked parameters, such as a customer ID, which is how a guest embed restricts data.

Copilot in Power BI and Metabot with your own Azure OpenAI deployment

Copilot in Power BI needs a paid capacity, Fabric F2 or higher or Power BI Premium P1 or higher, and trial capacities and free SKUs aren’t supported. The workspace must be on that capacity, or you can use a Fabric Copilot capacity. Copilot consumes your Fabric capacity, and Microsoft says to manage its usage to avoid throttling your other Fabric work.

Metabot answers questions about your data in plain language, and it’s on every Metabase plan, including the open-source edition. Each question Metabot builds opens in the query builder or the SQL editor, so you can see and change the query behind the answer. Metabot works within the data and collection permissions of the person asking, so it can only see what that person can see in Metabase. It can run on your own Microsoft Azure deployment that serves an OpenAI or an Anthropic model, and connecting your own AI provider doesn’t require a paid plan. In Admin > AI, add the Microsoft Azure provider with its API key, API base URL, model provider and deployment name. On App Service, you can set them as app settings instead: MB_LLM_AZURE_API_KEY, MB_LLM_AZURE_API_BASE_URL, MB_LLM_AZURE_MODEL_FAMILY and MB_LLM_AZURE_DEPLOYMENT_NAME. Then point Metabot at that deployment: pick it as the Default model in Admin > AI, or set MB_LLM_METABOT_PROVIDER to azure/openai/<deployment-name>, or to azure/anthropic/<deployment-name> for an Anthropic model. Metabase’s MCP server at /api/metabase-mcp, also on every plan, connects AI clients such as Claude, Cursor or ChatGPT to your data with no AI provider set up in Metabase, and each client works within the Metabase permissions of the person who signs in.

Power BI project files (PBIP, PBIR, TMDL) and Metabase dashboards as code

A Power BI Project (PBIP) saves the report and the semantic model as plain text files in a folder. The report uses PBIR, which is generally available and now the default report format. Unlike the older report.json, PBIR is publicly documented and supports changes from applications other than Power BI. The semantic model is stored either in TMDL, the Tabular Model Definition Language, as a folder of text files, or in the older TMSL model.bim file. TMDL view is generally available in Power BI Desktop and in preview on the web.

Metabase keeps your questions and dashboards in its application database, and you can manage them as code in three ways. The Metabase CLI, mb, reads and writes questions, dashboards, collections and transforms through the Metabase API. Metabase’s compare plans page lists the CLI on every plan, and Pro and Enterprise add command groups such as git-sync, which works with Remote Sync. Serialization, on the Pro and Enterprise plans, exports and imports content as YAML files. Remote Sync, on the same plans, keeps your Library and transforms in Git as YAML files: published tables with their segments and measures, metrics, dashboards, SQL snippets and the glossary. A development Metabase pushes changes for review in a pull request, and a read-only production Metabase pulls them. The Library is Metabase’s semantic layer, the counterpart of a TMDL model: curated tables and metrics that people and Metabot build questions from.

# Follows "Metabase CLI": needs Node.js 20.6 or later and Metabase 58 or later.
npm install -g @metabase/cli
mb auth login --url https://your-metabase.azurewebsites.net

# Give Claude Code the CLI's skill, then describe the dashboard you want in plain language.
npx skills add metabase/agent-skills --skill metabase-cli -a claude-code

When is Power BI the natural fit?

Power BI is the natural fit when your company already pays for Microsoft 365 E5 or Office 365 E5, which include Power BI Pro. It also fits when you already run a Fabric capacity of F64 or larger, where people with a free license can view reports. And it suits teams that build DAX models in Power BI Desktop, or that want DirectQuery reports to pass each viewer’s Microsoft Entra ID sign-in to Azure SQL.

Metabase fits when people across the team should build their own questions, with unlimited users on the free open-source edition. It also fits when you want BI that runs next to Azure SQL Database in your own Azure subscription, with no gateway and no password in the connection. And it fits when you want email and Slack subscriptions, guest embeds and Metabot on your own Azure deployment, all without a paid plan.

Next steps

• Connect Metabase to SQL Server and Azure SQL
• Run Metabase on Azure and configure the application database
• Find the Metabase Cloud IP addresses and set up an SSH tunnel
• Cache query results and send dashboard subscriptions
• Set up row and column security and SAML with Microsoft Entra ID
• Create guest embeds with locked parameters
• Connect Metabot to a Microsoft Azure deployment and pick the model Metabot runs on
• Use the Metabase CLI
• Compare Metabase and Power BI in general and map Power BI terms to Metabase
• Compare Metabase plans