Can't make FinOps Toolkit work

[rocknsalt]

Hello.
Maybe you can assist me because I don't know what am I doing wrong as I did many iterations of the FinOps Toolkit hub deployment and none of them worked.
My deployment scenario:

1. Enable the CostManagementExports and EventGrid resource providers at the nominated subscription
2. Use the following link to deploy FinOps Hub template: https://aka.ms/finops/hubs/deploy
3. During configuration check Managed Exports and enter a name for cluster (afaik this is needed for Data Explorer to work)
4. Data Factory access. Deployments > hub > Outputs, copy managedIdentityId and grant it READER role to a subscription I want conduct FinOps for.
5. Access FinOps' storage account and add subscription scope into settings.json

Now the problems

1. To backfill historical data I use "Option 1: Using config_RunBackfillJob pipeline", but I'm getting the following error in the Output:
   {"error":{"code":"RBACAccessDenied","message":"The client does not have authorization to perform action. Request ID: 23d2d2d-88b4-4256-9d3b-3f23f2d2"}}. I checked Activity Log and couldn't identity what permissions is lacking. Documentation says nothing about it either.
2. Deploy the dashboard. When I use cluster URI in the Azure Data Explorer, I get completely empty Dashboard with No results found everywhere and 'order' operator: Failed to resolve scalar expression named 'Total' at Monthly trend by service name sections.

What am I missing?

[helderpinto]

Hi, @rocknsalt. Did you configure the subscription scope in the settings.json blob according to the required format?

"scopes": [
  {
    "scope": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
  }
]

[rocknsalt]

Hi, @rocknsalt. Did you configure the subscription scope in the settings.json blob according to the required format?

"scopes": [
  {
    "scope": "/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e"
  }
]

Yes, I did.

[RolandKrummenacher]

Hi @rocknsalt, thanks for reporting this.

Issue 1: RBACAccessDenied on backfill

The Reader role is not sufficient for managed exports. The backfill pipeline needs to create and run Cost Management exports on your target subscription, which requires write permissions to the Microsoft.CostManagement/exports resource provider.

You need to assign the Cost Management Contributor role to the Data Factory managed identity on the target subscription (the one you added to settings.json). You can find the managed identity details from Deployments > hub > Outputs (managedIdentityId).

Note: The RBAC Administrator role you may see referenced in the docs is assigned automatically by the deployment on the hub storage account — you do not need to assign that yourself.

We acknowledge the documentation doesn't currently call out the specific role needed for subscriptions. This will be improved in the next release.

Issue 2: Empty dashboard / Failed to resolve scalar expression named 'Total'

This is a cascading effect of issue 1. Because the exports couldn't run, no data was ingested into Data Explorer. The dashboard queries use a pivot() operator that creates a Total column from aggregated data — when there's no data at all, that column doesn't exist, and order by Total fails.

Once you fix the permissions and data starts flowing, the dashboard should populate correctly.

[flanakin]

FYI - We have an office hours on March 4 at 0730 AM Pacific / 1330 UTC, if you are available.

https://aka.ms/ftk/office-hours

[rocknsalt]

To close the issue.
We managed to kick off the hub by going into Data Factory and triggering consequently the following pipelines:

1. config_StartExportProcess
2. config_RunExportJobs
3. config_ConfigureExports
   Waited 30 minutes and it Hub worked.