Unable to deploy - DenyPublicEndpoint Policy on Tenant.

[fayerowett]

Looking to test this to see if it is suitable for the company I work for, but we have immediately been unable to deploy the template as it violates the Deny-PaaSEndpoints policy as it is trying to deploy a public endpoint on the storage account.
Can this be modified to a private endpoint and still be effective? If it is possible, which parameter would need to be updated?
Thanks for the help.

[fbcarvalho]

Hello,

I had the same issue. You should create an exemption at the subscription level, deploy the AOE, and then remove the exemption.

[fayerowett]

Thanks @fbcarvalho - we did this but we have unfortunately encountered lots of challenges we are working through to make this work.
The latest issue we have is that the removal of the Public endpoint means that MHIR doesn't work, so I are going to deploy SHIR and amend the ADF to point to that.
I expect the next issue will be that the Managed Identity wont be able to speak to the Vault when I change the FW setting from public access to disabled.

[flanakin]

@fayerowett Do you need a preview release of our private endpoint support? We should be able to share that next week, if it'd help.

[fayerowett]

@flanakin - this would be brilliant if you could - would be happy to give it a test run and see if it can get us working.

[flanakin]

@fayerowett At the top of PR #1040, there's a link to deploy hubs 0.4 with private endpoints enabled. There are a few open issues, but creating this to support anyone who wants to deploy it as-is. Please let us know if you run into any issues!

[fayerowett]

Unfortunately, we still cant get this working - @MSBrett - would we be able to get some of your time to troubleshoot at all please?

We have tried manual exports in which, when running msexports_ETL_Ingestion case we cant get the format right for the blobPath, error is ErrorCode: 'PathNotFound'. Message: 'The specified path does not exist.'.

We have also tried FinOpsHubs but without the use of MHIR to run config_RunBackfill as we get error - '
{"error":{"code":"NotFound","message":"The requested export with export name: hub-finops-prod-uks-01-monthly-costdetails could not be found."}}

Thanks all for any support.

[flanakin]

We have tried manual exports in which, when running msexports_ETL_Ingestion case we cant get the format right for the blobPath, error is ErrorCode: 'PathNotFound'. Message: 'The specified path does not exist.'.

Are you pushing data into the msexports container manually or using Cost Management exports?

If you're re-running previous exports, then the files are getting moved/deleted, so the second attempt will fail with a not found error since the file is no longer there.

We have also tried FinOpsHubs but without the use of MHIR to run config_RunBackfill as we get error - '
{"error":{"code":"NotFound","message":"The requested export with export name: hub-finops-prod-uks-01-monthly-costdetails could not be found."}}

What is "MHIR"? Have you setup managed exports? The config_RunBackfill pipeline only works with managed exports because the hub identity needs access to create/run exports. If so, maybe config_ConfigureExports failed when the scope was added initially.

[fayerowett]

Hi @flanakin
Thanks for replying - we are pushing FOCUS cost management reports into msexports - both daily and monthly, set up as per the documentation.
MHIR is Microsoft Hosted Integrated Runtime that runs in Azure Data Factory, but we cannot use it as it is blocked by Policy - we would need to use Self Hosted Integration Runtime.

[MSBrett]

Unfortunately, we still cant get this working - @MSBrett - would we be able to get some of your time to troubleshoot at all please?

We have tried manual exports in which, when running msexports_ETL_Ingestion case we cant get the format right for the blobPath, error is ErrorCode: 'PathNotFound'. Message: 'The specified path does not exist.'.

We have also tried FinOpsHubs but without the use of MHIR to run config_RunBackfill as we get error - ' {"error":{"code":"NotFound","message":"The requested export with export name: hub-finops-prod-uks-01-monthly-costdetails could not be found."}}

Thanks all for any support.

Sure, lets set up a screen share and get to the bottom of this. Drop me a message and we can co-ordinate.

config_RunBackfill won't work if you're relying on manual exports or the customer is on a MCA contract.
When using manual exports we should use the powershell module - Start-FinOpsCostExport
The manual export should be configured to output an uncompressed CSV. It may be defaulting to gzip after a recent change in cost management.

[fayerowett]

Hi @MSBrett - how do I message you please? Can you provide your Microsoft email for me to get you on teams?

[flanakin]

Email us at ftk-support@ms and we can setup some time to dig into this.