## TL;DR
Cost Management exports run from Azure's backend, not from your network, so a storage firewall that blocks public access blocks the export too. Allow trusted Azure services on the storage account (or add the documented exception), then confirm the next scheduled export lands.

## Use this when
- A scheduled cost export fails or produces no files.
- The storage account has firewall rules or public access disabled.
- The export worked before the firewall was tightened.

## Not for this skill when
- The export lands but the CSV looks wrong. That is a schema or scope problem.
- The failure names authentication. Check the export's identity instead.

## Steps
1. Open the storage account networking settings and confirm the firewall is the blocker: temporarily check whether exports to an un-firewalled account succeed. Verify: you have isolated the firewall as the cause.
2. Enable the exception for trusted Azure services on the storage account firewall. Verify: the setting is saved.
3. If your policy forbids the broad trusted-services exception, check the current docs for the Cost Management specific network exception and apply that instead. Verify: the documented exception is in place.
4. Trigger a manual run of the export or wait for the next schedule. Verify: files appear in the container.
5. Confirm the file contents are fresh (check the date in the filename and a recent row). Verify: the export covers the expected period.

### Private endpoint variant
With private endpoints and no public access at all, the export needs the documented private-connectivity support. Verify: the export identity can reach the storage account over the private path.

Compatibility: Azure Cost Management exports, all storage account tiers that support firewalls.

## Why it happens
The export writer is a multi-tenant Azure service calling your storage account over the public endpoint. Firewall rules that default-deny public traffic cannot tell that caller apart from the internet, so the write is refused.

## Edge cases / pitfalls
- The trusted-services exception is broad by design. If that is unacceptable, the narrower documented exception is the alternative.
- Firewall changes can take several minutes to take effect. Do not conclude it failed on the first retry.
- Exports do not backfill every missed run; check for gaps after the fix.
- A storage account key rotation can break the export independently of the firewall. Check both.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_egbEVtsyQoDGkE77iBj-ww