diff --git a/docs-mslearn/toolkit/changelog.md b/docs-mslearn/toolkit/changelog.md index 92501d68d..248685df4 100644 --- a/docs-mslearn/toolkit/changelog.md +++ b/docs-mslearn/toolkit/changelog.md @@ -29,6 +29,7 @@ The following section lists features and enhancements that are currently in deve - **Added** - Added VNet and private network modes, including opt-in NAT Gateway support for private mode; NAT Gateway incurs additional cost when enabled ([#2163](https://github.com/microsoft/finops-toolkit/pull/2163)). + - Added an optional `resourceGroupTags` parameter that merges tags onto the resource group the hub deploys into, for internal test/dev deployments that need a resource-group-level policy tag to work around `DeploymentScriptACIProvisioningTimeout` ([#2241](https://github.com/microsoft/finops-toolkit/issues/2241)). - **Changed** - Clarified that the FinOps toolkit exclusively manages the FinOps hub virtual network and documented customer-managed private endpoints as the preferred private-access topology, with virtual network peering as a secondary option ([#2156](https://github.com/microsoft/finops-toolkit/issues/2156)). - Replaced redundant `tolower()` comparisons in hub KQL with case-insensitive operators (`has`, `=~`, `!~`) so the engine can use the term index instead of scanning every row ([#2213](https://github.com/microsoft/finops-toolkit/issues/2213)). diff --git a/docs-mslearn/toolkit/help/errors.md b/docs-mslearn/toolkit/help/errors.md index f9adc25eb..318ec9253 100644 --- a/docs-mslearn/toolkit/help/errors.md +++ b/docs-mslearn/toolkit/help/errors.md @@ -3,7 +3,7 @@ title: Troubleshoot common FinOps toolkit errors description: This article describes common FinOps toolkit errors and provides solutions to help you resolve issues you might encounter. author: flanakin ms.author: micflan -ms.date: 08/13/2026 +ms.date: 08/26/2026 ms.topic: troubleshooting ms.service: finops ms.subservice: finops-toolkit @@ -362,6 +362,26 @@ Report unresolved issues at .
+## DeploymentScriptACIProvisioningTimeout + +Severity: Major + +FinOps hub deployments use `Microsoft.Resources/deploymentScripts` resources to run PowerShell setup scripts. Each deployment script provisions a temporary Azure Container Instance (ACI) to execute its script. If that container instance doesn't start in time, the deployment script — and the overall deployment — fails with `DeploymentScriptACIProvisioningTimeout`. + +This error isn't caused by the script itself; it means the underlying ACI never finished provisioning. We've seen two causes: + +- **Transient ACI capacity or scheduling delay.** The container instance service is momentarily unable to place the container. This usually resolves on its own. +- **Restrictive tenant security policies (for example, Microsoft SFI) blocking the deployment script's use of a storage account key.** The container gets stuck in a `Waiting to run` or `Creating` state and never progresses. + +**Mitigation**: + +1. **Retry the deployment.** Most instances of this error are transient — simply redeploying resolves it. +2. **If it keeps failing, set the `SecurityControl` tag to `Ignore` on the target resource group before deploying.** Some tenant security policies disable the shared storage account key that deployment scripts rely on; this tag bypasses that restriction for the deployment. You can either tag the resource group yourself before deploying (for example, `az group create --tags SecurityControl=Ignore` or `az group update --tags SecurityControl=Ignore`), or pass `resourceGroupTags: { SecurityControl: 'Ignore' }` to the FinOps hub template, which merges the tag onto the resource group as part of the deployment. + +Report unresolved issues at . + +
+ ## DeploymentOutputEvaluationFailed Severity: Major diff --git a/docs-mslearn/toolkit/hubs/template.md b/docs-mslearn/toolkit/hubs/template.md index 3073275b1..08ab035d4 100644 --- a/docs-mslearn/toolkit/hubs/template.md +++ b/docs-mslearn/toolkit/hubs/template.md @@ -3,7 +3,7 @@ title: FinOps hub template description: Learn about what's included in the FinOps hub template including parameters, resources, and outputs. author: flanakin ms.author: micflan -ms.date: 06/03/2026 +ms.date: 08/26/2026 ms.topic: concept-article ms.service: finops ms.subservice: finops-toolkit @@ -90,6 +90,7 @@ Here are the parameters you can use to customize the deployment: | **dataExplorerSkuCapacity** | Int | Optional. Number of nodes to use in the cluster. Allowed values: 1 for the Basic SKU tier and 2-1000 for Standard. Default: 1. | | | **tags** | Object | Optional. Tags to apply to all resources. We will also add the `cm-resource-parent` tag for improved cost roll-ups in Cost Management. | | | **tagsByResource** | Object | Optional. Tags to apply to resources based on their resource type. Resource type specific tags will be merged with tags for all resources. | | +| **resourceGroupTags** | Object | Optional. Tags to merge onto the resource group this template deploys into. Intended for internal test/dev deployments that need a resource-group-level policy tag (for example, `SecurityControl: 'Ignore'` to work around [DeploymentScriptACIProvisioningTimeout](../help/errors.md#deploymentscriptaciprovisioningtimeout)). Not applicable to most deployments. | {} | | **scopesToMonitor** | Array | Optional. List of scope IDs to monitor and ingest cost for. | | | **exportRetentionInDays** | Int | Optional. Number of days of data to retain in the msexports container. | 0 | | **ingestionRetentionInMonths** | Int | Optional. Number of months of data to retain in the ingestion container. | 13 | diff --git a/src/templates/finops-hub/main.bicep b/src/templates/finops-hub/main.bicep index d93fe98c4..a55d7865a 100644 --- a/src/templates/finops-hub/main.bicep +++ b/src/templates/finops-hub/main.bicep @@ -141,6 +141,9 @@ param tags object = {} @description('Optional. Tags to apply to resources based on their resource type. Resource type specific tags will be merged with tags for all resources.') param tagsByResource object = {} +@description('Optional. Tags to merge onto the resource group this template deploys into (in addition to any tags it already has). Intended for internal test/dev deployments that need a resource-group-level policy tag -- e.g. SecurityControl=Ignore to work around DeploymentScriptACIProvisioningTimeout caused by tenant security policies blocking deployment script storage access (see docs-mslearn/toolkit/help/errors.md). Not applicable to most deployments; leave empty unless you know you need it. Default: {}.') +param resourceGroupTags object = {} + @description('Optional. List of scope IDs to monitor and ingest cost for.') param scopesToMonitor array = [] @@ -170,6 +173,15 @@ param virtualNetworkAddressPrefix string = '10.20.30.0/26' // Resources //============================================================================== +// Merge (not overwrite) resourceGroupTags onto the resource group's existing tags, if any were specified. Skipped +// entirely when resourceGroupTags is empty so typical deployments don't add an unnecessary deployment operation. +resource mergeResourceGroupTags 'Microsoft.Resources/tags@2022-09-01' = if (!empty(resourceGroupTags)) { + name: 'default' + properties: { + tags: union(resourceGroup().tags, resourceGroupTags) + } +} + module hub 'modules/hub.bicep' = { name: 'hub' params: {