Fix private networking deployment by dropping defaultOutboundAccess - #2259
Open
Roland Krummenacher (RolandKrummenacher) wants to merge 1 commit into
Open
Conversation
Deploying with enablePublicAccess = false currently fails on dev at the first deployment script: DeploymentScriptStorageAccountWithServiceEndpointEnabled Storage account '<script storage>' has firewall settings enabled which are not supported for deployment scripts. The shipped v14 template deploys the same scenario successfully, so this is a regression in the current cycle. The error message is misleading: the script storage account is configured identically in the working v14 deployment (publicNetworkAccess Enabled, defaultAction Deny, bypass AzureServices, one virtual network rule). The firewall is not the cause. The cause is defaultOutboundAccess being set explicitly on the subnets. Setting it -- at any value, on any subnet in the virtual network -- makes the Deployment Scripts service reject the script storage account. Isolated over nine deployments (storage-only, same region, same subscription): failure occurs exactly when the property is set, without exception. Two runs differing in nothing but this property gave opposite results; the successes reproduce; removing the property only from the script subnet, or leaving that subnet untouched entirely, still fails while other subnets carry it. A final run with the NAT Gateway attached and the property removed everywhere succeeds, which clears the NAT Gateway. Attaching the NAT Gateway is what routes outbound traffic, so the property is redundant. The feature is unaffected. Verified: rebuilt from source and deployed with enableNatGateway = true and enablePublicAccess = false -- deployment succeeds and all 7 deployment scripts run. Fixes #2258 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Roland Krummenacher (RolandKrummenacher)
requested review from
Brett Wilson (MSBrett) and
Michael Flanakin (flanakin)
as code owners
August 13, 2026 15:51
microsoft-github-policy-service
Bot
requested review from
Zach (FallenHoot) and
Hélder Pinto (helderpinto)
August 13, 2026 15:52
Copilot started reviewing on behalf of
Roland Krummenacher (RolandKrummenacher)
August 13, 2026 15:52
View session
microsoft-github-policy-service
Bot
added
the
Needs: Review 👀
microsoft-github-policy-service
Bot
added
the
Skill: Deployment
microsoft-github-policy-service
Bot
added
the
Tool: FinOps hubs
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes a regression in the FinOps hub private networking deployment (when enablePublicAccess = false) by removing an Azure subnet property that causes Deployment Scripts to fail even though the script storage account configuration is unchanged.
Changes:
- Removed
defaultOutboundAccessfrom all three subnet definitions to prevent Deployment Scripts from rejecting the script storage account. - Updated the NAT Gateway section comment to document the deployment-script failure mode and why
defaultOutboundAccessmust not be reintroduced.
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #2258
🐛 Problem
Deploying with
enablePublicAccess = falsefails ondevat the first deployment script:The shipped v14 template deploys the same scenario successfully, so this is a regression in the current cycle. Both private network modes are affected, since
privateRoutingis!enablePublicAccess.The error message is misleading. The script storage account it names is configured identically in the working v14 deployment:
🔍 Cause
defaultOutboundAccessis now set explicitly on all three subnets. Setting it — at any value, on any subnet in the virtual network — makes the Deployment Scripts service reject the script storage account.🔧 Solution
Drop the property from the three subnet definitions. Attaching the NAT Gateway is what routes outbound traffic, so the explicit setting is redundant and the feature is unaffected.
A comment above the NAT Gateway block records why the property must not come back, including the fact that the Azure error points at the storage account rather than the subnet.
🧪 Validation
Nine deployments on a test subscription (storage-only, same region):
Failure occurs exactly when the property is set, without exception. #3 vs #4 differ in nothing else. #5/#8 show the successes reproduce. #6/#7 rule out a script-subnet-only explanation. #9 was run as a falsifiable prediction and cleared the NAT Gateway.
This branch: rebuilt from source and deployed with
enableNatGateway: trueandenablePublicAccess: false— succeeded in 18 minutes, all 7 deployment scripts ran, NAT Gateway attached to the script and Data Explorer subnets, property absent everywhere.Single-file template change; no PowerShell, workbook or query code is touched.
🤖 Generated with Claude Code