Skip to content

fix(hubs): use an Azure Files private endpoint for deployment script storage in private mode #2259

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Roland Krummenacher (RolandKrummenacher) merged 4 commits into from
Aug 20, 2026
Merged

fix(hubs): use an Azure Files private endpoint for deployment script storage in private mode #2259

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
833e8ce
Fix private networking deployment by dropping defaultOutboundAccess
Aug 13, 2026
acad6d3
docs(hubs): drop stale defaultOutboundAccess wording from NAT Gateway…
Aug 17, 2026
73c5e5e
fix(hubs): preserve private subnet policy compliance
MSBrett Aug 19, 2026
264e546
fix(hubs): address private networking review feedback
MSBrett Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion src/powershell/Public/Deploy-FinOpsHub.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@
Optional. Number of months of data to retain in the Data Explorer *_final_v* tables. Default: 13.

.PARAMETER NetworkMode
Optional. Network mode for the hub: 'public' (default), 'vnet' (private endpoints, default outbound), or 'private' (private endpoints + NAT Gateway, subnets locked down with defaultOutboundAccess=false - required when the 'Subnets should be private' policy is enforced).
Optional. Network mode for the hub: 'public' (default), 'vnet' (private endpoints, default outbound), or 'private' (private endpoints + NAT Gateway for controlled outbound access - required when the 'Subnets should be private' policy is enforced).

.PARAMETER DisablePublicAccess
Optional. Deprecated. Use -NetworkMode 'vnet' or -NetworkMode 'private' instead. When set without -NetworkMode, behaves as -NetworkMode 'vnet'. Ignored when -NetworkMode is supplied.
Expand Down
2 changes: 1 addition & 1 deletion src/scripts/Deploy-Hub.ps1
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@
Optional. Deploy with private networking (VNet and private endpoints, default outbound access). Equivalent to -NetworkMode vnet. Kept for back-compat. Default: false.

.PARAMETER NetworkMode
Optional. Network mode: 'public' (default), 'vnet' (private endpoints, default outbound), or 'private' (private endpoints + NAT Gateway, subnets locked down — required when the 'Subnets should be private' policy is enforced).
Optional. Network mode: 'public' (default), 'vnet' (private endpoints, default outbound), or 'private' (private endpoints + NAT Gateway for controlled outbound access — required when the 'Subnets should be private' policy is enforced).

.PARAMETER VirtualNetworkAddressPrefix
Optional. Virtual network address prefix for private networking. Requires a /26 CIDR block. When set, also sets -Private. Default: "10.20.30.0/26".
Expand Down
2 changes: 1 addition & 1 deletion src/templates/finops-hub/createUiDefinition.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -954,7 +954,7 @@
{
"name": "enableNatGateway",
"type": "Microsoft.Common.CheckBox",
"label": "Deploy NAT Gateway and disable default outbound access",
"label": "Deploy NAT Gateway for controlled outbound access",
"toolTip": "Required by the September 2025 'Subnets should be private' policy. Adds a Standard NAT Gateway and Standard static Public IP attached to the script and Data Explorer subnets to provide controlled outbound internet access. Leave unchecked if you have your own egress path (UDR to firewall, peered hub with NAT, etc.).",
"defaultValue": false,
"visible": "[equals(steps('advanced').networking.enablePublicAccess, false)]"
Expand Down
2 changes: 1 addition & 1 deletion src/templates/finops-hub/main.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@ param dataExplorerFinalRetentionInMonths int = 13
@description('Optional. Enable public access to FinOps hubs resources. Default: true.')
param enablePublicAccess bool = true

@description('Optional. Deploy a NAT Gateway for controlled outbound access when private routing is enabled. When true, subnets disable Azure default outbound access and route through the NAT Gateway. Ignored when enablePublicAccess is true. Default: false.')
@description('Optional. Deploy a NAT Gateway for controlled outbound access when private routing is enabled. When true, the script and Data Explorer subnets route outbound traffic through the NAT Gateway. Ignored when enablePublicAccess is true. Default: false.')
param enableNatGateway bool = false

@description('Optional. Address space for the workload. Minimum /26 subnet size is required for the workload. Default: "10.20.30.0/26".')
Expand Down
15 changes: 9 additions & 6 deletions src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Core/infrastructure.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ var subnets = !hub.options.privateRouting ? [] : [
name: finopsHubSubnetName
properties: {
addressPrefix: cidrSubnet(hub.options.networkAddressPrefix, 28, 0)
defaultOutboundAccess: !hub.options.natGateway
networkSecurityGroup: {
id: nsg.id
}
Expand All @@ -45,7 +44,6 @@ var subnets = !hub.options.privateRouting ? [] : [
name: scriptSubnetName
properties: {
addressPrefix: cidrSubnet(hub.options.networkAddressPrefix, 28, 1)
defaultOutboundAccess: !hub.options.natGateway
...(hub.options.natGateway ? {
natGateway: {
id: resourceId('Microsoft.Network/natGateways', natGatewayName)
Expand Down Expand Up @@ -73,7 +71,6 @@ var subnets = !hub.options.privateRouting ? [] : [
name: dataExplorerSubnetName
properties: {
addressPrefix: cidrSubnet(hub.options.networkAddressPrefix, 27, 1)
defaultOutboundAccess: !hub.options.natGateway
...(hub.options.natGateway ? {
natGateway: {
id: resourceId('Microsoft.Network/natGateways', natGatewayName)
Expand Down Expand Up @@ -211,9 +208,15 @@ resource vNet 'Microsoft.Network/virtualNetworks@2023-11-01' = if (hub.options.p
}

//------------------------------------------------------------------------------
// NAT Gateway (provides outbound for script-subnet + dataExplorer-subnet when
// defaultOutboundAccess is disabled; required by the 'Subnets should be private'
// policy and the September 2025 implicit-outbound retirement)
// NAT Gateway (provides explicit outbound for script-subnet + dataExplorer-subnet;
// required by the 'Subnets should be private' policy and the September 2025
// implicit-outbound retirement)
//
// Do not set defaultOutboundAccess on the subnets. Setting it -- at any value, on any
Comment thread
MSBrett marked this conversation as resolved.
Outdated
// subnet in this virtual network -- makes the Deployment Scripts service reject the
// script storage account with DeploymentScriptStorageAccountWithServiceEndpointEnabled,
Comment thread
MSBrett marked this conversation as resolved.
Outdated
// which fails the deployment before the app layer starts. Attaching the NAT Gateway is
// what actually routes outbound traffic, so the property is not needed here.
//------------------------------------------------------------------------------

resource natGatewayPublicIp 'Microsoft.Network/publicIPAddresses@2023-11-01' = if (hub.options.natGateway) {
Expand Down
2 changes: 1 addition & 1 deletion src/templates/finops-hub/modules/fx/hub-types.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ type HubRoutingProperties = {
keyVaultSku: 'KeyVault SKU. Allowed values: "standard", "premium".'
keyVaultEnablePurgeProtection: 'Indicates whether purge protection is enabled for the Key Vault. When enabled, deleted Key Vault and its secrets cannot be permanently deleted until the retention period expires, which is required for compliance in some environments.'
networkAddressPrefix: 'Address prefix for the FinOps hub isolated virtual network, if private network routing is enabled.'
natGateway: 'Indicates whether a NAT Gateway should be deployed for controlled outbound internet access. When enabled, subnets disable Azure default outbound access and route through the NAT Gateway.'
natGateway: 'Indicates whether a NAT Gateway should be deployed for controlled outbound internet access. When enabled, the script and Data Explorer subnets route outbound traffic through the NAT Gateway.'
privateRouting: 'Indicates whether private network routing is enabled.'
publisherIsolation: 'Indicates whether FinOps hub resources should be separated by publisher for advanced security.'
storageInfrastructureEncryption: 'Indicates whether infrastructure encryption is enabled for the storage account.'
Expand Down
2 changes: 1 addition & 1 deletion src/templates/finops-hub/modules/hub.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ param dataExplorerFinalRetentionInMonths int = 13
@description('Optional. Enable public access to the data lake. Default: true.')
param enablePublicAccess bool = true

@description('Optional. Deploy a NAT Gateway for controlled outbound access when private routing is enabled. When true, subnets disable Azure default outbound access and route through the NAT Gateway. Ignored when enablePublicAccess is true. Default: false.')
@description('Optional. Deploy a NAT Gateway for controlled outbound access when private routing is enabled. When true, the script and Data Explorer subnets route outbound traffic through the NAT Gateway. Ignored when enablePublicAccess is true. Default: false.')
param enableNatGateway bool = false

@description('Optional. Address space for the workload. Minimum /26 subnet size is required for the workload. Default: "10.20.30.0/26".')
Expand Down
Loading