Azure cost export fails - the storage account firewall blocks Cost Management exports
Fixes Azure Cost Management exports that fail against a firewalled storage account. Covers allowing trusted Azure services, adding the Cost Management service exception, and verifying the next scheduled export. Use when exports fail with storage access errors. Not for export schema problems.
TL;DR
Cost Management exports run from Azure's backend, not from your network, so a storage firewall that blocks public access blocks the export too. Allow trusted Azure services on the storage account (or add the documented exception), then confirm the next scheduled export lands.
Use this when
- A scheduled cost export fails or produces no files.
- The storage account has firewall rules or public access disabled.
- The export worked before the firewall was tightened.
Not for this skill when
- The export lands but the CSV looks wrong. That is a schema or scope problem.
- The failure names authentication. Check the export's identity instead.
Steps
- Open the storage account networking settings and confirm the firewall is the blocker: temporarily check whether exports to an un-firewalled account succeed. Verify: you have isolated the firewall as the cause.
- Enable the exception for trusted Azure services on the storage account firewall. Verify: the setting is saved.
- If your policy forbids the broad trusted-services exception, check the current docs for the Cost Management specific network exception and apply that instead. Verify: the documented exception is in place.
- Trigger a manual run of the export or wait for the next schedule. Verify: files appear in the container.
- Confirm the file contents are fresh (check the date in the filename and a recent row). Verify: the export covers the expected period.
Private endpoint variant
With private endpoints and no public access at all, the export needs the documented private-connectivity support. Verify: the export identity can reach the storage account over the private path.
Compatibility: Azure Cost Management exports, all storage account tiers that support firewalls.
Why it happens
The export writer is a multi-tenant Azure service calling your storage account over the public endpoint. Firewall rules that default-deny public traffic cannot tell that caller apart from the internet, so the write is refused.
Edge cases / pitfalls
- The trusted-services exception is broad by design. If that is unacceptable, the narrower documented exception is the alternative.
- Firewall changes can take several minutes to take effect. Do not conclude it failed on the first retry.
- Exports do not backfill every missed run; check for gaps after the fix.
- A storage account key rotation can break the export independently of the firewall. Check both.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_egbEVtsyQoDGkE77iBj-ww