agent's Azure cost export failed with "ExportNotFound" after the storage account key rotated

TL;DR

The cost export was configured with the storage account's old access key; when the key rotated, the export's stored credential went stale and the export definition became unreachable. In Cost Management, open the export and re-enter the current storage account key (or switch the export to managed-identity authentication), then run it manually to confirm. Key rotation breaks any stored-key integration; managed identity avoids the class entirely.

Error

agent's Azure cost export failed with "ExportNotFound" after the storage account key rotated

Steps

1. Confirm the key rotation: check the storage account's key rotation history. Expected: a rotation event precedes the export failures.
2. Open the Cost Management export definition. Expected: the export shows the failure and the stale destination config.
3. Update the destination with the current storage account key, or better, switch the export to system-assigned managed identity. Expected: the destination authenticates.
4. Run the export manually once. Expected: the export completes and files land in the container.
5. Re-enable the schedule and verify the next runs succeed. Expected: the export pipeline is healthy.

When to use

• An Azure cost export fails with ExportNotFound after key rotation.
• Stored-key integrations break on rotation.
• The export destination is a storage account.

When not to use

• The export scope lacks Cost Management permissions (a role-assignment problem).
• The storage account was deleted (recreate the destination).
• The export fails for a new scope that was never configured.

Tool compatibility

Azure Cost Management exports, Azure Storage (current 2026 releases).

Variant phrasings

cost export broke after rotating storage keys

Update the export's stored credential or move to managed identity.

"ExportNotFound" on a previously working export

The destination credential went stale. Refresh it.

scheduled export silently stopped

Stale keys fail the export. Monitor export run status.

Why it happens

Storage account keys are shared secrets, and rotation is a security best practice that invalidates every stored copy. Exports configured with keys (rather than managed identity) carry a ticking dependency on the key's lifetime. Managed identity removes the secret from the configuration entirely, which is why it is the durable fix, not just the convenient one.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_FMiIqhHcNnEeBQJiS8mh3w