fix(hubs): make ADF trigger startTime Z-suffix conditional on UTC fallback - #2291
Open
Michael Flanakin (flanakin) wants to merge 8 commits into
Open
fix(hubs): make ADF trigger startTime Z-suffix conditional on UTC fallback#2291Michael Flanakin (flanakin) wants to merge 8 commits into
Michael Flanakin (flanakin) wants to merge 8 commits into
Conversation
…nifest (#2260) Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
…storage in private mode (#2259) Private-mode deployments failed at the first deployment script with DeploymentScriptStorageAccountWithServiceEndpointEnabled, because the script storage account was reached through a Storage service endpoint while private subnets set defaultOutboundAccess to false. Azure Policy 7bca8353-aa3b-429b-904a-9229c4385837 ("Subnets should be private") requires defaultOutboundAccess to be present and false, so that setting has to stay. The service endpoint is the optional half of the conflict and is replaced here with the documented Azure Files private endpoint path: - Private subnets keep defaultOutboundAccess: false; the NAT Gateway continues to provide egress for the script and Data Explorer subnets. - The Storage service endpoint is removed from the script subnet. - The script storage account moves to publicNetworkAccess: Disabled with no virtual network rules, reached through a file private endpoint and a privatelink.file.core.windows.net zone. - HubsPrivateNetworking.Tests.ps1 pins all of the above in the compiled ARM. - Stale defaultOutboundAccess wording removed from six user-facing strings. Validated live in both affected modes (storage-only, westus): deployment succeeds, all 7 deployment scripts execute, all three subnets carry defaultOutboundAccess: false in private mode, the script storage has no virtual network rules and no public access, and the file private DNS zone is present. Fixes #2258
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: MSBrett <MSBrett@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
…ates (#2261) Co-authored-by: Roland Krummenacher <roland.krummenacher@alescent.com> Co-authored-by: MSBrett <MSBrett@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
… type (#2251) Co-authored-by: Roland Krummenacher <roland.krummenacher@alescent.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: MSBrett <MSBrett@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
…lback FinOps hub deployments to regions not covered by timeZones.bicep's region-to-Windows-timezone map (e.g. Sweden Central) fail with InvalidWorkflowTriggerRecurrence. Data Factory requires startTime to end in 'Z' when timeZone resolves to 'UTC', but the three schedule triggers (config_DailySchedule, config_MonthlySchedule, queries_DailySchedule) hardcoded startTime without a trailing 'Z', which is only valid when timeZone is non-UTC. Emit the 'Z' suffix only when timeZones.outputs.Timezone resolves to the 'UTC' fallback, so mapped, non-UTC regions keep scheduling on local wall-clock time as before. Fixes #2157 Note: the reporter also saw a failure in Norway East, which IS in the timezone map (non-UTC), so this fix does not explain or address that - it needs separate diagnostic info and is treated as a distinct, unverified issue. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Michael Flanakin (flanakin)
requested review from
Brett Wilson (MSBrett) and
Roland Krummenacher (RolandKrummenacher)
as code owners
August 26, 2026 22:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #2157 — FinOps hub deployments fail in regions not covered by
timeZones.bicep's region→Windows-timezone map (e.g. Sweden Central) withInvalidWorkflowTriggerRecurrence.Root cause: Three ADF schedule triggers hardcode
startTimewithout a trailingZ(UTC zone designator):config_DailyScheduleandqueries_DailySchedule:'2023-01-01T01:01:00'config_MonthlySchedule:'2023-01-05T01:11:00'These triggers set
timeZonefromtimeZones.bicep's region lookup, which falls back to the literal'UTC'for any region not in its explicit map (confirmed: Sweden Central is one such region; likely also Qatar Central, Poland Central, Italy North, Israel Central, though the map should be checked directly rather than assuming this list is exhaustive). Azure Data Factory requiresstartTimeto end inZ(formatyyyy-MM-ddTHH:mm:ssZ) whenevertimeZoneresolves to'UTC'— otherwise trigger activation fails withInvalidWorkflowTriggerRecurrence, which surfaces during deployment asInit-DataFactory.ps1'sStart-AzDataFactoryV2Triggerretrying up toMAX_RETRIES = 20and then failing the whole deployment.Fix: Make the
Zsuffix conditional on the resolvedtimeZoneactually being'UTC':Applied to all three triggers:
src/templates/finops-hub/modules/Microsoft.CostManagement/ManagedExports/app.bicep—config_DailyScheduleandconfig_MonthlySchedulesrc/templates/finops-hub/modules/Microsoft.FinOpsHubs/IngestionQueries/app.bicep—queries_DailyScheduleThis preserves the existing local-wall-clock scheduling behavior for every region that is mapped (no
Z, non-UTCtimeZone), and only addsZfor the fallback case, fixing activation there.Explicitly not done, and why:
Zto all three literals — that would silently switch every mapped region from local-time scheduling to UTC wall-clock scheduling, a user-facing behavior change for currently-working regions.Out of scope: The issue reporter also mentioned a failure in Norway East. Norway East is present in
timeZones.bicep's map ('W. Europe Standard Time', non-UTC), so the root cause above does not explain a Norway East failure. This looks like a second, distinct issue that needs more diagnostic detail from the reporter — it is not addressed by this PR.Test plan
bicep buildon both changed files completes cleanly (only the expected@validate()experimental-feature warning, unrelated to this change)if(equals(...Timezone..., 'UTC'), '...Z', '...')expression for all threestartTimepropertiespwsh -Command "./src/scripts/Test-PowerShell.ps1 -Lint"— 3585/3585 tests passedInvalidWorkflowTriggerRecurrence🤖 Generated with Claude Code