Error when trying to run Config_runbackfill pipeline on an MCA account

[abdulkhawaja99]

I have a client with an MCA account who have deployed the FinOps Hub. When they're trying to run the Config_runbackfill pipeline, they keep getting this error. They have assigned all the necessary permissions to the managed identities

{"error":{"code":"RBACAccessDenied","message":"The client does not have authorization to perform action. Request ID: NoHttpContext"}}

[microsoft-github-policy-service]

Thank you for submitting this issue! We try to respond within 3 business days. In the meantime:

• 📖 Check the troubleshooting guide for common issues
• 💬 Ask questions in Discussions
• 📅 Join our biweekly office hours for live help from the team

[RolandKrummenacher]

Thanks for reporting this! The RBACAccessDenied error you're seeing isn't actually a permissions problem — it's a platform limitation.

The config_RunBackfillJob pipeline is part of the FinOps hubs managed exports feature, which calls the Cost Management exports/run REST API using the Data Factory managed identity. Cost Management does not support managed exports for Microsoft Customer Agreement billing accounts or billing profiles — the API rejects the call regardless of what RBAC roles you assign to the managed identity. This is called out in Configure scopes → Configure managed exports.

For MCA billing profiles, you'll need to configure exports manually and use one of the alternative backfill options:

1. Configure exports manually at the billing profile scope: Configure exports manually. For MCA, use a scope of /providers/Microsoft.Billing/billingAccounts/{id}/billingProfiles/{id} and create exports for FocusCosts, PriceSheet, ReservationTransactions, ReservationDetails, and ReservationRecommendations.

2. Backfill historical data using either:

   • Cost Management UI — open the export and use Export selected dates to pick a date range.
   • PowerShell — use Start-FinOpsCostExport with -Backfill or explicit -StartDate / -EndDate:

     Start-FinOpsCostExport -Name "{export-name}" -Scope "/providers/Microsoft.Billing/billingAccounts/{id}/billingProfiles/{id}" -Backfill 12

We'll look at improving the docs so this limitation is clearer in the backfill section. Let me know if you hit any issues with the manual setup!

[abdulkhawaja99]

Hey Roland, Thank you for the detailed explanation. There’s a few other things that I also wanted to address for the same customer if possible. I can open a separate issue for them as well if needed, but wanted to share them here first in-case you are able to help out 1. In the FinOps hub deployment, the Azure Data Explorer instance had to be changed to public networking to be able to work properly, as it wasn't working on private networking. Are there any specific requirements for the ADE instance to be able to properly work privately, as the customer has a strict private networking requirement for their prod deployment 1. The datafactory pipelines seem to not be triggered simply by the cost exports running in the portal. They are needing to be triggered manually in data factory studio and each time, we are having to enter a different path of the folder where the azure cost exports are. This is a quite tedious process. I was wondering if this is supposed to happen, and if not, how to setup the pipelines to run automatically once the export is created in the storage account in the portal, given that the export get’s created in a new folder and so the path changes each time Regards, Abdul Khawaja Cloud Solutions Architect Cloud & AI | in/abdulmkhawaja ***@***.******@***.***> Phone: +1 (226) 977-7208 [Microsoft Logo] From: Roland Krummenacher ***@***.***> Sent: April 30, 2026 1:50 AM To: microsoft/finops-toolkit ***@***.***> Cc: Author ***@***.***> Subject: Re: [microsoft/finops-toolkit] Error when trying to run Config_runbackfill pipeline on an MCA account (Issue #2113) Thanks for reporting this! The RBACAccessDenied error you're seeing isn't actually a permissions problem - it's a platform limitation. The config_RunBackfillJob pipeline is part of the FinOps hubs managed exports feature, which calls the Cost Management exports/run REST API using the Data Factory managed identity. Cost Management does not support managed exports for Microsoft Customer Agreement billing accounts or billing profiles - the API rejects the call regardless of what RBAC roles you assign to the managed identity. This is called out in Configure scopes → Configure managed exports<https://learn.microsoft.com/en-us/cloud-computing/finops/toolkit/hubs/configure-scopes#configure-managed-exports>. For MCA billing profiles, you'll need to configure exports manually and use one of the alternative backfill options: 1. Configure exports manually at the billing profile scope: Configure exports manually<https://learn.microsoft.com/en-us/cloud-computing/finops/toolkit/hubs/configure-scopes#configure-exports-manually>. For MCA, use a scope of /providers/Microsoft.Billing/billingAccounts/{id}/billingProfiles/{id} and create exports for FocusCosts, PriceSheet, ReservationTransactions, ReservationDetails, and ReservationRecommendations. 2. Backfill historical data using either: * Cost Management UI - open the export and use Export selected dates to pick a date range. * PowerShell - use Start-FinOpsCostExport<https://learn.microsoft.com/en-us/cloud-computing/finops/toolkit/powershell/cost/start-finopscostexport> with -Backfill or explicit -StartDate / -EndDate: Start-FinOpsCostExport -Name "{export-name}" -Scope "/providers/Microsoft.Billing/billingAccounts/{id}/billingProfiles/{id}" -Backfill 12 We'll look at improving the docs so this limitation is clearer in the backfill section. Let me know if you hit any issues with the manual setup! - Reply to this email directly, view it on GitHub<#2113 (comment)> or unsubscribe<https://github.com/notifications/unsubscribe-auth/A4CQPNVBRWPEJW7QDM5NKKL4YLSRHBFKMF2HI4TJMJ2XIZLTSWBKK5TBNR2WLJDUOJ2WLJDOMFWWLO3UNBZGKYLEL5YGC4TUNFRWS4DBNZ2F6YLDORUXM2LUPGBKK5TBNR2WLJDUOJ2WLJDOMFWWLLTXMF2GG2C7MFRXI2LWNF2HTAVFOZQWY5LFUVUXG43VMWSG4YLNMWVXI2DSMVQWIX3UPFYGLAVFOZQWY5LFU4YTQMBTGQ4DNJDOMFWWLKDBMN2G64S7NFSIFJLWMFWHKZNKGUYDAMRSGQ2TSMZSURXGC3LFVFUGC427NRQWEZLMVRZXKYTKMVRXIX3UPFYGLLCJONZXKZKDN5WW2ZLOOSTHI33QNFRXHEUCUR2HS4DFVJZGK4DPONUXI33SPGSXMYLMOVS2SNJYG44TMNJYGYZIFJDUPFYGLJLJONZXKZNFOZQWY5LFVI2DGNJSHA4TENJVHCTXI4TJM5TWK4VGMNZGKYLUMU>. You are receiving this email because you authored the thread. Triage notifications on the go with GitHub Mobile for iOS<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android<https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>.

[RolandKrummenacher]

Hi Abdul — both issues likely share a single root cause, so I'd start there before going further.

Most likely root cause: storage firewall trusted-services exception

On the hub storage account, check Networking → Firewalls and virtual networks → Exceptions → "Allow Azure services on the trusted services list to access this storage account." If that's off while the storage firewall is enabled, you'll see exactly the two symptoms you're describing:

• ADE looks broken on private — ADE reads exports from the hub storage account as a trusted Azure service. With the trusted-services exception off, those reads fail regardless of how ADE itself is configured. Switching ADE to public doesn't fix the underlying problem; it just changes which path is being used.
• Pipelines don't auto-trigger and need manual paths — Event Grid can't deliver BlobCreated events to Data Factory, and Data Factory's managed identity can't read the manifest from storage to discover the export folder. The msexports_ManifestAdded trigger never fires, and manual runs only succeed because the path is being supplied by hand from an authenticated portal session.

The hub template sets this up for you on deployment — the private networking docs explicitly call out: "Storage is accessible via private IP address and trusted Azure services - firewall is set to default deny with bypass for services on trusted list" — so if it's off now, something disabled it after deploy. Worth flagging that to the customer so it doesn't get turned off again.

Fix:

1. Turn on Allow Azure services on the trusted services list to access this storage account on the hub storage account.
2. In Data Factory Studio → Manage → Triggers, confirm msexports_ManifestAdded is Started. If not, start it.
3. Re-run a Cost Management export. Within ~15–20 minutes the trigger should fire automatically and the pipeline should run end-to-end into ADE.

If ADE is still unreachable on private after that

Then it's worth digging into the private networking setup. ADE itself doesn't have standalone private networking requirements you configure on the cluster — it relies on the surrounding vNet, private endpoints, DNS zones, and Data Factory managed integration runtime that the hub template provisions when Access = Private is selected at deploy time. The full set of requirements:

• vNet with three subnets — private-endpoint-subnet (/28), script-subnet (/28, delegated to Container Instances), dataExplorer-subnet (/27, delegated to Microsoft.Kusto/clusters).
• A private endpoint to the ADE cluster (group ID cluster).
• Six private DNS zones linked to the vNet: privatelink.{location}.kusto.windows.net, privatelink.blob/dfs/table/queue.core.windows.net, privatelink.vaultcore.azure.net.
• A Data Factory managed private endpoint to ADE, approved on the ADE side, with the ADE linked service routed through the managed integration runtime.
• For any client outside the hub vNet (Power BI service, VNet data gateway, jump box, peered network), DNS for <cluster>.<region>.kusto.windows.net must resolve to the private IP. Power BI VNet data gateway in particular requires the full FQDN (clustername.region.kusto.windows.net), not the abbreviated form.

The cleanest path for the customer's prod environment is to redeploy the hub template with Access = Private rather than enabling private networking on the ADE cluster manually, so all of the above is provisioned and wired together consistently. Full reference: Configure private networking in FinOps hubs.

Secondary check for the trigger

If the storage firewall isn't the issue and the trigger still isn't firing on new exports, make sure Microsoft.EventGrid and Microsoft.CostManagementExports resource providers are registered on the subscription:

Register-AzResourceProvider -ProviderNamespace Microsoft.EventGrid
Register-AzResourceProvider -ProviderNamespace Microsoft.CostManagementExports

If still no trigger runs after a fresh export, grab the trigger run history from Data Factory Studio → Monitor → Trigger runs filtered to msexports_ManifestAdded and open a separate issue with that detail so we can take a closer look.

Regards,
Roland