From 30169c0cd8a9921492b3b75c69d567bdc2ff0471 Mon Sep 17 00:00:00 2001 From: Michael Flanakin Date: Wed, 26 Aug 2026 13:27:38 -0700 Subject: [PATCH 1/2] feat(hubs): add resourceGroupTags for internal test deployments Adds an optional resourceGroupTags Bicep parameter that merges tags onto the resource group the hub template deploys into (main.bicep is resource-group scoped and has no other way to touch the RG's own tags). Uses Microsoft.Resources/tags, not a deploymentScript, so it doesn't provision an ACI and can't hit the timeout it exists to work around. Intended for Microsoft FTEs deploying internal test hubs that need a resource-group-level policy tag -- most commonly SecurityControl=Ignore to bypass tenant security policies (e.g. SFI) that block deployment scripts from using storage account shared keys, causing DeploymentScriptACIProvisioningTimeout (#2241, #1816). No portal UI change: createUiDefinition.json configures the deployment target, not the resource group the portal already created before the template runs, so a portal checkbox can't express this. Deliberately Bicep-parameter-only (CLI/PowerShell-visible) so it doesn't add UI clutter for the vast majority of deployments that will never need it. Documents the parameter and both ways to set the tag (az group create/update, or the new parameter) in the DeploymentScriptACIProvisioningTimeout troubleshooting entry. Co-Authored-By: Claude Sonnet 5 --- docs-mslearn/toolkit/help/errors.md | 20 ++++++++++++++++++++ docs-mslearn/toolkit/hubs/template.md | 1 + src/templates/finops-hub/main.bicep | 12 ++++++++++++ 3 files changed, 33 insertions(+) diff --git a/docs-mslearn/toolkit/help/errors.md b/docs-mslearn/toolkit/help/errors.md index f9adc25eb..e7d59eb17 100644 --- a/docs-mslearn/toolkit/help/errors.md +++ b/docs-mslearn/toolkit/help/errors.md @@ -362,6 +362,26 @@ Report unresolved issues at .
+## DeploymentScriptACIProvisioningTimeout + +Severity: Major + +FinOps hub deployments use `Microsoft.Resources/deploymentScripts` resources to run PowerShell setup scripts. Each deployment script provisions a temporary Azure Container Instance (ACI) to execute its script. If that container instance doesn't start in time, the deployment script — and the overall deployment — fails with `DeploymentScriptACIProvisioningTimeout`. + +This error isn't caused by the script itself; it means the underlying ACI never finished provisioning. We've seen two causes: + +- **Transient ACI capacity or scheduling delay.** The container instance service is momentarily unable to place the container. This usually resolves on its own. +- **Restrictive tenant security policies (for example, Microsoft SFI) blocking the deployment script's use of a storage account key.** The container gets stuck in a `Waiting to run` or `Creating` state and never progresses. + +**Mitigation**: + +1. **Retry the deployment.** Most instances of this error are transient — simply redeploying resolves it. +2. **If it keeps failing, set the `SecurityControl` tag to `Ignore` on the target resource group before deploying.** Some tenant security policies disable the shared storage account key that deployment scripts rely on; this tag bypasses that restriction for the deployment. You can either tag the resource group yourself before deploying (for example, `az group create --tags SecurityControl=Ignore` or `az group update --tags SecurityControl=Ignore`), or pass `resourceGroupTags: { SecurityControl: 'Ignore' }` to the FinOps hub template, which merges the tag onto the resource group as part of the deployment. + +Report unresolved issues at . + +
+ ## DeploymentOutputEvaluationFailed Severity: Major diff --git a/docs-mslearn/toolkit/hubs/template.md b/docs-mslearn/toolkit/hubs/template.md index 3073275b1..abd663fb5 100644 --- a/docs-mslearn/toolkit/hubs/template.md +++ b/docs-mslearn/toolkit/hubs/template.md @@ -90,6 +90,7 @@ Here are the parameters you can use to customize the deployment: | **dataExplorerSkuCapacity** | Int | Optional. Number of nodes to use in the cluster. Allowed values: 1 for the Basic SKU tier and 2-1000 for Standard. Default: 1. | | | **tags** | Object | Optional. Tags to apply to all resources. We will also add the `cm-resource-parent` tag for improved cost roll-ups in Cost Management. | | | **tagsByResource** | Object | Optional. Tags to apply to resources based on their resource type. Resource type specific tags will be merged with tags for all resources. | | +| **resourceGroupTags** | Object | Optional. Tags to merge onto the resource group this template deploys into. Intended for internal test/dev deployments that need a resource-group-level policy tag (for example, `SecurityControl: 'Ignore'` to work around [DeploymentScriptACIProvisioningTimeout](../help/errors.md#deploymentscriptaciprovisioningtimeout)). Not applicable to most deployments. | {} | | **scopesToMonitor** | Array | Optional. List of scope IDs to monitor and ingest cost for. | | | **exportRetentionInDays** | Int | Optional. Number of days of data to retain in the msexports container. | 0 | | **ingestionRetentionInMonths** | Int | Optional. Number of months of data to retain in the ingestion container. | 13 | diff --git a/src/templates/finops-hub/main.bicep b/src/templates/finops-hub/main.bicep index d93fe98c4..a55d7865a 100644 --- a/src/templates/finops-hub/main.bicep +++ b/src/templates/finops-hub/main.bicep @@ -141,6 +141,9 @@ param tags object = {} @description('Optional. Tags to apply to resources based on their resource type. Resource type specific tags will be merged with tags for all resources.') param tagsByResource object = {} +@description('Optional. Tags to merge onto the resource group this template deploys into (in addition to any tags it already has). Intended for internal test/dev deployments that need a resource-group-level policy tag -- e.g. SecurityControl=Ignore to work around DeploymentScriptACIProvisioningTimeout caused by tenant security policies blocking deployment script storage access (see docs-mslearn/toolkit/help/errors.md). Not applicable to most deployments; leave empty unless you know you need it. Default: {}.') +param resourceGroupTags object = {} + @description('Optional. List of scope IDs to monitor and ingest cost for.') param scopesToMonitor array = [] @@ -170,6 +173,15 @@ param virtualNetworkAddressPrefix string = '10.20.30.0/26' // Resources //============================================================================== +// Merge (not overwrite) resourceGroupTags onto the resource group's existing tags, if any were specified. Skipped +// entirely when resourceGroupTags is empty so typical deployments don't add an unnecessary deployment operation. +resource mergeResourceGroupTags 'Microsoft.Resources/tags@2022-09-01' = if (!empty(resourceGroupTags)) { + name: 'default' + properties: { + tags: union(resourceGroup().tags, resourceGroupTags) + } +} + module hub 'modules/hub.bicep' = { name: 'hub' params: { From e1b401c5250d5c913d6b0444ffad50148b148b1e Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 26 Aug 2026 20:28:57 +0000 Subject: [PATCH 2/2] chore: Update ms.date in docs-mslearn files --- docs-mslearn/toolkit/help/errors.md | 2 +- docs-mslearn/toolkit/hubs/template.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs-mslearn/toolkit/help/errors.md b/docs-mslearn/toolkit/help/errors.md index e7d59eb17..318ec9253 100644 --- a/docs-mslearn/toolkit/help/errors.md +++ b/docs-mslearn/toolkit/help/errors.md @@ -3,7 +3,7 @@ title: Troubleshoot common FinOps toolkit errors description: This article describes common FinOps toolkit errors and provides solutions to help you resolve issues you might encounter. author: flanakin ms.author: micflan -ms.date: 08/13/2026 +ms.date: 08/26/2026 ms.topic: troubleshooting ms.service: finops ms.subservice: finops-toolkit diff --git a/docs-mslearn/toolkit/hubs/template.md b/docs-mslearn/toolkit/hubs/template.md index abd663fb5..08ab035d4 100644 --- a/docs-mslearn/toolkit/hubs/template.md +++ b/docs-mslearn/toolkit/hubs/template.md @@ -3,7 +3,7 @@ title: FinOps hub template description: Learn about what's included in the FinOps hub template including parameters, resources, and outputs. author: flanakin ms.author: micflan -ms.date: 06/03/2026 +ms.date: 08/26/2026 ms.topic: concept-article ms.service: finops ms.subservice: finops-toolkit