Skip to content

BYO-Vnet #2269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Jacob Struiksma (JacobStruiksma) wants to merge 5 commits into from
Closed

BYO-Vnet #2269

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
7d8314b
Add createPrivateDnsZones parameter to support centralized DNS manage…
kpnjacobstruiksma Aug 10, 2026
aee1c53
Add bring-your-own virtual network support and subnet configuration f…
kpnjacobstruiksma Aug 10, 2026
986a69e
Merge branch 'feature/private_dns_records' into feature/byo-vnet_priv…
kpnjacobstruiksma Aug 11, 2026
425b2e6
Update FinOps hub template and deployment configurations
kpnjacobstruiksma Aug 12, 2026
d95ab9f
Reorder and update NAT Gateway and private DNS zone parameters in UI …
kpnjacobstruiksma Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion docs-mslearn/toolkit/changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: FinOps toolkit changelog
description: Review the latest features and enhancements in the FinOps toolkit, including updates to FinOps hubs, Power BI reports, and more.
author: MSBrett
ms.author: brettwil
ms.date: 07/30/2026
ms.date: 08/11/2026
ms.topic: reference
ms.service: finops
ms.subservice: finops-toolkit
Expand All @@ -28,7 +28,10 @@ The following section lists features and enhancements that are currently in deve
### [FinOps hubs](hubs/finops-hubs-overview.md)

- **Added**
- Added bring-your-own virtual network support for private networking with `virtualNetworkMode` (`new` or `existing`) and `existingVirtualNetworkResourceId` for existing virtual networks (#2163).
- Added configurable subnet names for private networking deployments (#2163).
- Added VNet and private network modes, including opt-in NAT Gateway support for private mode; NAT Gateway incurs additional cost when enabled ([#2163](https://github.com/microsoft/finops-toolkit/pull/2163)).
- Added **createPrivateDnsZones** parameter (default: `true`) to skip private DNS zone and zone group creation for enterprise environments where a centralized DNS resolver manages private DNS registration. Private endpoints are still created when disabled.
- **Changed**
- Replaced redundant `tolower()` comparisons in hub KQL with case-insensitive operators (`has`, `=~`, `!~`) so the engine can use the term index instead of scanning every row ([#2213](https://github.com/microsoft/finops-toolkit/issues/2213)).
- Replaced whole-term `contains` matches with `has` across hub KQL and the query catalog (resource ID paths, licensing phrases, SKU description terms) and added a per-row operator-equivalence regression harness with unit test coverage ([#2220](https://github.com/microsoft/finops-toolkit/pull/2220)).
Expand Down
90 changes: 74 additions & 16 deletions docs-mslearn/toolkit/hubs/private-networking.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Configure private networking in FinOps hubs
description: Learn about data access options with FinOps hubs and how to configure secure access to your data with private endpoints.
author: flanakin
ms.author: micflan
ms.date: 04/01/2026
ms.date: 08/12/2026
ms.topic: how-to
ms.service: finops
ms.reviewer: micflan
Expand Down Expand Up @@ -88,7 +88,6 @@ If you need to reduce costs or simplify your FinOps hub deployment, you can remo
### Steps to remove private networking

1. **Plan the transition**:

- Identify all users and systems currently accessing the hub via private networking
- Coordinate with your network administrators about the change
- Schedule maintenance window as the hub will be temporarily inaccessible during the transition
Expand All @@ -98,7 +97,6 @@ If you need to reduce costs or simplify your FinOps hub deployment, you can remo
You have two options to redeploy your FinOps hub with public access:

**Option 1: Redeploy from existing deployment**

- Navigate to your FinOps hub resource group in the Azure portal
- Go to the **Deployments** tab on the resource group
- Find and open the original FinOps hub deployment
Expand All @@ -108,21 +106,18 @@ If you need to reduce costs or simplify your FinOps hub deployment, you can remo
- Deploy the updated configuration

**Option 2: Deploy latest toolkit version**

- Install the latest current version of the FinOps toolkit
- Use the same resource group name, hub name, and Data Explorer cluster name as your existing deployment
- These values can be obtained from the original deployment template or the config.json file in your hub storage account
- On the **Advanced** tab, set **Access** to **Public**
- Deploy with the same configuration to update your existing hub

3. **Verify the changes**:

- Confirm that storage accounts, Data Explorer, and Key Vault are accessible via public endpoints
- Test data access from Power BI and other connected systems
- Verify that Azure Data Factory pipelines continue to run successfully

4. **Clean up networking resources** (optional):

- Once you've confirmed the hub is working correctly with public access, you can delete the networking resources to stop incurring networking costs
- Delete resources in the following order to avoid dependency conflicts:
1. Private endpoints
Expand Down Expand Up @@ -155,19 +150,82 @@ If you need to reduce costs or simplify your FinOps hub deployment, you can remo

## FinOps hub virtual network

When private access is selected, your FinOps hub instance includes a virtual network to ensure communication between its various components remain private.
When private access is selected, choose your mode using **virtualNetworkMode**:

- Set **virtualNetworkMode** to `new` to create a new virtual network and subnets.
- Set **virtualNetworkMode** to `existing` to use your existing virtual network. In this mode, set **existingVirtualNetworkResourceId**.

### Virtual network mode and parameter usage

The following table shows which network parameters are used in each mode when private access is enabled (**enablePublicAccess** = `false`).

| Parameter | `new` mode | `existing` mode | Notes |
| ------------------------------------ | ---------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **virtualNetworkMode** | Used | Used | Selects whether FinOps hubs creates a VNet or reuses one. |
| **privateEndpointSubnetName** | Used | Used | Subnet name used for storage, Key Vault, and script storage private endpoints. |
| **scriptSubnetName** | Used | Used | Subnet name used for deployment script container groups. |
| **dataExplorerSubnetName** | Used | Used | Subnet name used for Azure Data Explorer private endpoint. |
| **createPrivateDnsZones** | Always on | Used | In `new` mode, FinOps hubs always creates private DNS zones and links them to the created virtual network. In `existing` mode, set to `false` to skip private DNS zones, zone groups, and virtual network links. |
| **virtualNetworkAddressPrefix** | Used | Ignored | Used only when creating a new VNet. |
| **enableNatGateway** | Used | Ignored | NAT Gateway is only created/attached when mode is `new`. |
| **existingVirtualNetworkResourceId** | Ignored | Used | Required in `existing` mode to target your VNet. |

In `new` mode:

- Set **virtualNetworkAddressPrefix** to define the VNet address space.
- FinOps hubs always creates the required private DNS zones and links them to the new virtual network.
- The virtual network can be any subnet size from **/8** to **/26**, with a minimum of **/26** (64 IP addresses) required.
- The default IP range is **10.20.30.0/26**.
- FinOps hubs creates three subnets from this range: **/28** for private endpoints, **/28** for deployment scripts, and **/27** reserved for Azure Data Explorer private endpoints.
- Choose a larger range (for example, **/24**) if you need more private address space for adjacent services like Power BI VNet Data Gateway.

In `existing` mode:

### Existing mode: bring your own virtual network subnet requirements and mapping

- The virtual network can be any subnet size from **/8** to **/26**, with a minimum of **/26** (64 IP addresses) required. The default is **/26** to conserve IP addresses while providing the minimum required subnet sizes for Container Services (used during deployments for running scripts) and Data Explorer.
- The IP range can be set at the time of deployment and defaults to **10.20.30.0/26**. Choose a larger subnet (like **/24** or smaller) if you need additional address space for services such as Power BI VNet Data Gateway.
If you're using an existing virtual network, configure these settings before deploying FinOps hubs:

If necessary, you can create the virtual network, subnets, and optionally peer it with your hub network before deploying FinOps hubs if you follow these requirements:
- Set **existingVirtualNetworkResourceId** to your VNet resource ID.
- Set **createPrivateDnsZones** to `true` to let FinOps hubs create the required private DNS zones, link them to your existing virtual network, and attach private endpoints to those zones.
- Set **createPrivateDnsZones** to `false` if your organization manages private DNS separately. In this case, FinOps hubs still creates private endpoints, but doesn't create private DNS zones, private DNS zone groups, or virtual network links.
- **virtualNetworkAddressPrefix** is ignored.
- FinOps hubs uses your existing VNet address space and the subnet names you provide.

When **enablePublicAccess** is set to `false`, FinOps hubs uses the following requirements and subnet mapping:

| Subnet parameter | Default subnet name | Minimum size | Required configuration | Contains |
| ----------------------------- | --------------------------- | ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| **privateEndpointSubnetName** | **private-endpoint-subnet** | **/28** | Service endpoint recommended: **Microsoft.Storage** | Azure Resource Manager private endpoints for hub storage (`blob`, `dfs`), Key Vault (`vault`), and deployment script storage (`blob`) |
| **scriptSubnetName** | **script-subnet** | **/28** | Subnet delegation required: **Microsoft.ContainerInstance/containerGroups**. Service endpoint recommended: **Microsoft.Storage**. Outbound routing required if default outbound is blocked. | Deployment script container groups (Azure Container Instances) |
| **dataExplorerSubnetName** | **dataExplorer-subnet** | **/27** | Outbound routing required if default outbound is blocked. | Azure Data Explorer cluster private endpoint (`cluster`) |

Virtual network requirement: minimum **/26** address space.

> [!NOTE]
> Data Factory managed private endpoints (for storage, Key Vault, and Data Explorer) are created in the Data Factory managed virtual network, not as Azure Resource Manager private endpoints in your bring-your-own virtual network subnets.

> [!NOTE]
> Azure Data Explorer private endpoints commonly consume 8 private IPs in the subnet baseline (engine endpoint, data management endpoint, and transient storage endpoints). This baseline doesn't scale linearly with **dataExplorerSkuCapacity** (node count). Additional private IP usage is primarily tied to high-ingestion scenarios that scale transient storage endpoints. The **/27** minimum in bring-your-own virtual network mode is kept to provide operational headroom.

### Bring your own virtual network NSG settings

If your existing subnets have NSGs attached, configure rules that allow the same baseline traffic pattern FinOps hubs configures when it creates a new virtual network.

| Direction | Priority | Rule | Source | Destination | Port/Protocol | Access |
| --------- | -------- | ----------------------------- | ----------------- | -------------- | ------------- | ------ |
| Inbound | 100 | AllowVnetInBound | VirtualNetwork | VirtualNetwork | Any / Any | Allow |
| Inbound | 200 | AllowAzureLoadBalancerInBound | AzureLoadBalancer | Any | Any / Any | Allow |
| Inbound | 4096 | DenyAllInBound | Any | Any | Any / Any | Deny |
| Outbound | 100 | AllowVnetOutBound | VirtualNetwork | VirtualNetwork | Any / Any | Allow |
| Outbound | 200 | AllowInternetOutBound | Any | Internet | Any / Any | Allow |
| Outbound | 4096 | DenyAllOutBound | Any | Any | Any / Any | Deny |

Apply these rules to the NSGs used by the private endpoint, script, and Data Explorer subnets, or configure equivalent rules in your central firewall/segmentation architecture.

> [!NOTE]
> FinOps hubs only creates/attaches NAT Gateway when it creates a new virtual network. In bring-your-own virtual network mode, configure outbound routing in your own network architecture.

- The virtual network should be a minimum of **/26** in size (64 IP addresses) but can be any size up to **/8** (16,777,216 IP addresses).
- The name should be `<HubName>-vNet`.
- The virtual network must be divided into three subnets with the service delegations as specified:
- **private-endpoint-subnet** (**/28**) – no service delegations configured; hosts private endpoints for storage and key vault.
- **script-subnet** (**/28**) – delegated to container services for running scripts during deployment.
- **dataExplorer-subnet** (**/27**) – delegated to Azure Data Explorer.
You can override all subnet names at deployment time. FinOps hubs uses the configured names for both new and existing virtual network modes.

<br>

Expand Down
Loading