[DevOps] PR Builds: Add PR deployment support to Deploy-Hub

[flanakin]

🛠️ Description

Extends Deploy-Hub.ps1 with three new parameters to support CI automation and simplified export configuration:

• -PR — Sets initials to pr for PR-based naming (e.g., pr-123-adx)
• -Scope — Configures cost data exports after deployment (managed or manual)
• -ManagedExports — Uses template-managed exports and grants the hub identity required RBAC roles on the monitored scope

Post-deployment logic handles two paths:

• Managed exports: Grants Cost Management Contributor and RBAC Administrator on the scope, passes scopesToMonitor to the template
• Manual exports: Creates a FocusCost export via New-FinOpsCostExport

Also documents the required RBAC roles for subscription/RG scopes in configure-scopes.md.

This is PR A of a multi-PR effort to add per-PR deployment CI for FinOps hubs.

📋 Checklist

🔬 How did you test this change?

• 🤏 Lint tests
• 🤞 PS -WhatIf / az validate
• 👍 Manually deployed + verified
• 💪 Unit tests
• 🙌 Integration tests

🙋‍♀️ Do any of the following that apply?

• 🚨 This is a breaking change.
• 🤏 The change is less than 20 lines of code.

📑 Did you update docs/changelog.md?

• ✅ Updated changelog (required for dev PRs)
• ➡️ Will add log in a future PR (feature branch PRs only)
• ❎ Log not needed (small/internal change)

📖 Did you update documentation?

• ✅ Public docs in docs (required for dev)
• ✅ Public docs in docs-mslearn (required for dev)
• ✅ Internal dev docs in docs-wiki (required for dev)
• ✅ Internal dev docs in src (required for dev)
• ➡️ Will add docs in a future PR (feature branch PRs only)
• ❎ Docs not needed (small/internal change)

[Copilot]

Pull request overview

This PR extends Deploy-Hub.ps1 with three new parameters (-PR, -Scope, -ManagedExports) to support CI/PR-based deployments and export configuration. It also documents required RBAC roles for subscription/resource group scopes in configure-scopes.md.

Changes:

• Added -PR, -Scope, and -ManagedExports parameters to Deploy-Hub.ps1, including post-deployment logic to either grant managed identity RBAC roles or create a manual FocusCost export via New-FinOpsCostExport
• Updated src/scripts/README.md with new parameter documentation and usage examples
• Updated docs-mslearn/toolkit/hubs/configure-scopes.md to document the required roles (Cost Management Contributor and RBAC Administrator) for subscription/resource group scopes

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
src/scripts/Deploy-Hub.ps1	Core changes: new parameters, initials logic for PR mode, managed/manual export configuration post-deployment
src/scripts/README.md	Updated parameter table and new usage examples for -PR, -Scope, and -ManagedExports
docs-mslearn/toolkit/hubs/configure-scopes.md	Added documentation for RBAC roles needed for subscription/resource group scopes with managed exports

[flanakin]

🤖 [AI][Claude] PR Update Summary

Addressed: 4 thread(s)

• ✅ Implemented: 4

1. Added "Optional." prefix to -PR parameter doc
2. Explicitly set enableManagedExports = $false for manual exports path (template defaults to true)
3. Check New-AzRoleAssignment result before reporting success, warn on failure
4. Fixed comment: "Build" → "Import" for module load

[RolandKrummenacher]

RBAC Administrator — wrong scope?

The Microsoft.Authorization/roleAssignments/write permission is needed on the storage account, not on the monitored scope. This is so Cost Management can auto-assign itself StorageBlobDataContributor to write export data (per the exports prerequisites docs).

The Bicep template already handles this — ManagedExports/app.bicep:59-63 assigns RBAC Administrator on the storage account via storageRoles.

This means:

1. The RBAC Administrator grant on $Scope in Deploy-Hub.ps1 is unnecessary — the template already assigns it where it's actually needed (storage account).
2. The docs are misleading — granting RBAC Administrator on a subscription is overly permissive and doesn't serve the stated purpose.

Only Cost Management Contributor should be needed on the monitored scope.

[RolandKrummenacher]

-PR switch vs. positional parameter confusion

-PR is declared as [switch] but this example reads as if -PR takes a value. It works because 123 binds to the positional -Name parameter, but it's misleading. Consider either:

• Making the separation explicit: ./Deploy-Hub -PR -Name 123
• Or changing -PR to a [string] that accepts the PR number directly