Configure managed exports

[bpatel1410]

I am finding Configure managed exports a bit confusing and hoping for some help.

1. After deploying FinOps, are we assigning Azure Data Factory Managed Identity access to read data across?
2. To assign Managed Identity EnrollmentReader, do we need a Service Principle?

[MSBrett]

Simplest thing would be to configure the exports manually and point them at the MSExports container like we recommend for MCA accounts.

Assuming you're configuring this for an EA using the managed exports feature (adding the scope to the config file) you'll need to grant "Enrollment Reader" permissions to the system assigned managed identity for Azure Data Factory.

• You can get the object ID for the system assigned managed identity from Settings/Managed Identities tab of Azure Data Factory.
• You can grant it enrollment reader permissions using Add-FinOpsServicePrincipal or by followowing the guidance for doing the REST post against the API.

[bpatel1410]

Thank you for the help. The key was to grant "Enrollment Reader" permissions to the system assigned managed identity for Azure Data Factory.