feat(hubs): Add RG tags for internal test deployments - #2289

🛠️ Description

Adds an optional resourceGroupTags parameter to main.bicep that merges tags onto the resource group the hub deploys into. main.bicep is resource-group scoped, so it has no other way to touch the RG's own tags — the existing tags/tagsByResource params only tag resources inside the RG, which doesn't affect ACI provisioning. Implemented via Microsoft.Resources/tags (a plain ARM resource), not a deploymentScript — it doesn't provision an ACI itself, so it can't hit the timeout it's meant to help work around. Merges with union(resourceGroup().tags, resourceGroupTags) rather than replacing, so it won't clobber any tags already required by the target subscription's own policy. Skipped entirely when the parameter is empty (default), so it adds zero deployment overhead for the vast majority of users who'll never set it.

Requested in #2241 (DeploymentScriptACIProvisioningTimeout) as a way for Microsoft FTEs to deploy internal test hubs with SecurityControl=Ignore set on the resource group, which works around tenant security policies (SFI) blocking deployment scripts from using storage account shared keys — the same root cause diagnosed in #1816. Only one internal tag is known/documented (SecurityControl=Ignore); the parameter accepts an arbitrary tag object so others can be added later without another template change.

No portal UI change: createUiDefinition.json configures the deployment target, not the resource group the portal already created before the template runs — a portal checkbox literally can't express "tag the resource group." This is deliberately Bicep-parameter-only (CLI/PowerShell-visible, not portal-visible) so it stays out of the way for public deployers who don't need it.

Fixes #2241
Related: #1816

📷 Screenshots

Not applicable — Bicep parameter only, no portal UI change (see description for why).

📋 Checklist

🔬 How did you test this change?

• 🤏 Lint tests
• 🤞 PS -WhatIf / az validate
• 👍 Manually deployed + verified
• 💪 Unit tests
• 🙌 Integration tests

bicep build compiles clean. Full PowerShell lint suite passes (3585/3585). No unit tests — this is a Bicep-only change with no PowerShell logic to cover; correctness is verified by the compiled ARM template output. Not yet manually deployed — see deploy-to-test below.

📦 Deploy to test?

• Hubs + ADX (managed)
• Hubs + Fabric (manual) — URI:
• Hubs (manual)
• Hubs (no data)
• Workbooks
• Alerts

🙋‍♀️ Do any of the following that apply?

• 🚨 This is a breaking change.
• 🤏 The change is less than 20 lines of code.

📑 Did you update docs/changelog.md?

• ✅ Updated changelog (required for dev PRs)
• ➡️ Will add log in a future PR (feature branch PRs only)
• ❎ Log not needed (small/internal change)

📖 Did you update documentation?

• ✅ Public docs in docs (required for dev)
• ✅ Public docs in docs-mslearn (required for dev)
• ✅ Internal dev docs in docs-wiki (required for dev)
• ✅ Internal dev docs in src (required for dev)
• ➡️ Will add docs in a future PR (feature branch PRs only)
• ❎ Docs not needed (small/internal change)

Documented the new parameter in docs-mslearn/toolkit/hubs/template.md and updated the DeploymentScriptACIProvisioningTimeout mitigation steps in docs-mslearn/toolkit/help/errors.md to mention it as an alternative to manually tagging the resource group before deploying.

Draft — pending Brett Wilson (@MSBrett) confirming the 1-2 additional internal tags mentioned when this was requested; only SecurityControl=Ignore is documented anywhere in this repo's issue/discussion history.

🤖 Generated with Claude Code