Skip to content

feat(hubs): add resourceGroupTags for internal test deployments #2289

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Michael Flanakin (flanakin) wants to merge 2 commits into
base: dev
Choose a base branch
from
Draft

feat(hubs): add resourceGroupTags for internal test deployments #2289

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
30169c0
feat(hubs): add resourceGroupTags for internal test deployments
flanakin Aug 26, 2026
e1b401c
chore: Update ms.date in docs-mslearn files
github-actions[bot] Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 21 additions & 1 deletion docs-mslearn/toolkit/help/errors.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Troubleshoot common FinOps toolkit errors
description: This article describes common FinOps toolkit errors and provides solutions to help you resolve issues you might encounter.
author: flanakin
ms.author: micflan
ms.date: 08/13/2026
ms.date: 08/26/2026
ms.topic: troubleshooting
ms.service: finops
ms.subservice: finops-toolkit
Expand Down Expand Up @@ -362,6 +362,26 @@ Report unresolved issues at <https://aka.ms/ftk/ideas>.

<br>

## DeploymentScriptACIProvisioningTimeout

<sup>Severity: Major</sup>

FinOps hub deployments use `Microsoft.Resources/deploymentScripts` resources to run PowerShell setup scripts. Each deployment script provisions a temporary Azure Container Instance (ACI) to execute its script. If that container instance doesn't start in time, the deployment script — and the overall deployment — fails with `DeploymentScriptACIProvisioningTimeout`.

This error isn't caused by the script itself; it means the underlying ACI never finished provisioning. We've seen two causes:

- **Transient ACI capacity or scheduling delay.** The container instance service is momentarily unable to place the container. This usually resolves on its own.
- **Restrictive tenant security policies (for example, Microsoft SFI) blocking the deployment script's use of a storage account key.** The container gets stuck in a `Waiting to run` or `Creating` state and never progresses.

**Mitigation**:

1. **Retry the deployment.** Most instances of this error are transient — simply redeploying resolves it.
2. **If it keeps failing, set the `SecurityControl` tag to `Ignore` on the target resource group before deploying.** Some tenant security policies disable the shared storage account key that deployment scripts rely on; this tag bypasses that restriction for the deployment. You can either tag the resource group yourself before deploying (for example, `az group create --tags SecurityControl=Ignore` or `az group update --tags SecurityControl=Ignore`), or pass `resourceGroupTags: { SecurityControl: 'Ignore' }` to the FinOps hub template, which merges the tag onto the resource group as part of the deployment.

Report unresolved issues at <https://aka.ms/ftk/ideas>.

<br>

## DeploymentOutputEvaluationFailed

<sup>Severity: Major</sup>
Expand Down
3 changes: 2 additions & 1 deletion docs-mslearn/toolkit/hubs/template.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: FinOps hub template
description: Learn about what's included in the FinOps hub template including parameters, resources, and outputs.
author: flanakin
ms.author: micflan
ms.date: 06/03/2026
ms.date: 08/26/2026
ms.topic: concept-article
ms.service: finops
ms.subservice: finops-toolkit
Expand Down Expand Up @@ -90,6 +90,7 @@ Here are the parameters you can use to customize the deployment:
| **dataExplorerSkuCapacity** | Int | Optional. Number of nodes to use in the cluster. Allowed values: 1 for the Basic SKU tier and 2-1000 for Standard. Default: 1. | |
| **tags** | Object | Optional. Tags to apply to all resources. We will also add the `cm-resource-parent` tag for improved cost roll-ups in Cost Management. | |
| **tagsByResource** | Object | Optional. Tags to apply to resources based on their resource type. Resource type specific tags will be merged with tags for all resources. | |
| **resourceGroupTags** | Object | Optional. Tags to merge onto the resource group this template deploys into. Intended for internal test/dev deployments that need a resource-group-level policy tag (for example, `SecurityControl: 'Ignore'` to work around [DeploymentScriptACIProvisioningTimeout](../help/errors.md#deploymentscriptaciprovisioningtimeout)). Not applicable to most deployments. | {} |
| **scopesToMonitor** | Array | Optional. List of scope IDs to monitor and ingest cost for. | |
| **exportRetentionInDays** | Int | Optional. Number of days of data to retain in the msexports container. | 0 |
| **ingestionRetentionInMonths** | Int | Optional. Number of months of data to retain in the ingestion container. | 13 |
Expand Down
12 changes: 12 additions & 0 deletions src/templates/finops-hub/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,9 @@ param tags object = {}
@description('Optional. Tags to apply to resources based on their resource type. Resource type specific tags will be merged with tags for all resources.')
param tagsByResource object = {}

@description('Optional. Tags to merge onto the resource group this template deploys into (in addition to any tags it already has). Intended for internal test/dev deployments that need a resource-group-level policy tag -- e.g. SecurityControl=Ignore to work around DeploymentScriptACIProvisioningTimeout caused by tenant security policies blocking deployment script storage access (see docs-mslearn/toolkit/help/errors.md). Not applicable to most deployments; leave empty unless you know you need it. Default: {}.')
param resourceGroupTags object = {}

@description('Optional. List of scope IDs to monitor and ingest cost for.')
param scopesToMonitor array = []

Expand Down Expand Up @@ -170,6 +173,15 @@ param virtualNetworkAddressPrefix string = '10.20.30.0/26'
// Resources
//==============================================================================

// Merge (not overwrite) resourceGroupTags onto the resource group's existing tags, if any were specified. Skipped
// entirely when resourceGroupTags is empty so typical deployments don't add an unnecessary deployment operation.
resource mergeResourceGroupTags 'Microsoft.Resources/tags@2022-09-01' = if (!empty(resourceGroupTags)) {
name: 'default'
properties: {
tags: union(resourceGroup().tags, resourceGroupTags)
}
}

module hub 'modules/hub.bicep' = {
name: 'hub'
params: {
Expand Down