feat(finops-hub): PowerShell parity for networkMode + changelog

Adds -NetworkMode parameter to Deploy-FinOpsHub and Deploy-Hub so the
new tri-state network model (public|vnet|private) introduced for the
Sept 2025 implicit-outbound retirement is reachable from PowerShell,
not just the portal UI. Addresses the CHANGES_REQUESTED review on #2163.

Deploy-FinOpsHub (cmdlet):
- Add -NetworkMode <public|vnet|private> with ValidateSet
- Replace stale .PARAMETER EnablePublicAccess help block with accurate
  .PARAMETER NetworkMode + .PARAMETER DisablePublicAccess (deprecated)
- Version-guard the networkMode template parameter for v15.0+
- When -NetworkMode is supplied on v15+, skip enablePublicAccess so the
  two parameters never go on the wire together (bicep effectiveNetworkMode
  already lets networkMode win; sending both clutters deployment history)

Deploy-Hub.ps1 (dev script):
- Add -NetworkMode <public|vnet|private> with ValidateSet
- Keep -Private switch as deprecated back-compat alias
- -NetworkMode wins when both are supplied

infrastructure.bicep:
- Add comment noting that in vnet mode all subnets get
  defaultOutboundAccess:false with no NAT attached -- intentionally
  egress-less scaffolding for future private-mode upgrades

changelog.md:
- Document the new networkMode parameter under FinOps hubs v15 Added
- Add upgrade-impact note under Changed flagging that existing
  enablePublicAccess=false deployments will gain a NAT Gateway and
  Public IP on next deploy (NAT hours + PIP + data processing charges)
- Bump ms.date to 06/03/2026 per docs-mslearn rule

Verified end-to-end via az deployment group what-if against the built
template for all three modes:
  public:  no VNet, no NSG, no NAT (correct)
  vnet:    VNet + NSG only, no NAT (correct)
  private: VNet + NSG + NAT Gateway + Public IP + PE + DNS zones (correct)

Refs #2161 #2163

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: msbrett

docs-mslearn/toolkit/changelog.md

@@ -3,7 +3,7 @@ title: FinOps toolkit changelog
 description: Review the latest features and enhancements in the FinOps toolkit, including updates to FinOps hubs, Power BI reports, and more.
 author: MSBrett
 ms.author: brettwil
-ms.date: 05/19/2026
+ms.date: 06/03/2026
 ms.topic: reference
 ms.service: finops
 ms.subservice: finops-toolkit
@@ -47,8 +47,11 @@ _Released June 2026_
 
 ### [FinOps hubs](hubs/finops-hubs-overview.md) v15
 
+- **Added**
+  - Added tri-state `networkMode` parameter (`public` | `vnet` | `private`) to replace the binary `enablePublicAccess` switch, with corresponding `-NetworkMode` parameters in `Deploy-FinOpsHub` and the `Deploy-Hub` development script. The legacy `enablePublicAccess` parameter and `-DisablePublicAccess` switch are kept for back-compat ([#2163](https://github.com/microsoft/finops-toolkit/pull/2163)).
 - **Changed**
   - Added a callout to the `config_RunBackfillJob` backfill option clarifying that it isn't supported on Microsoft Customer Agreement (MCA) billing accounts or billing profiles ([#2113](https://github.com/microsoft/finops-toolkit/issues/2113)).
+  - Set `defaultOutboundAccess: false` on all subnets and added a NAT Gateway + static Public IP in `private` mode so deployments comply with the "Subnets should be private" policy and the September 2025 implicit-outbound retirement. **Upgrade note:** existing hubs deployed with `enablePublicAccess=false` will gain a NAT Gateway and Public IP on next deploy, which adds NAT hours, Public IP, and data-processing charges to the monthly cost ([#2161](https://github.com/microsoft/finops-toolkit/issues/2161)).
 
 <!-- prettier-ignore-start -->
 > [!div class="nextstepaction"]

src/powershell/Public/Deploy-FinOpsHub.ps1

@@ -84,8 +84,11 @@
     .PARAMETER DataExplorerFinalRetentionInMonths
     Optional. Number of months of data to retain in the Data Explorer *_final_v* tables. Default: 13.
 
-    .PARAMETER EnablePublicAccess
-    Optional. Enable public access to the data lake.  Default: true.
+    .PARAMETER NetworkMode
+    Optional. Network access mode for the hub. Allowed: "public" (default — no virtual network, all resources publicly reachable), "vnet" (virtual network + NSG scaffold for future use, public endpoints remain), "private" (full virtual network with private endpoints and NAT Gateway + static public IP for outbound egress). When specified, takes precedence over -DisablePublicAccess. Requires hub template v15.0 or later. Default: not set (template falls back to -DisablePublicAccess for older templates, or "public" when neither is supplied).
+
+    .PARAMETER DisablePublicAccess
+    Optional. DEPRECATED — use -NetworkMode instead. Disable public access to the data lake. When -NetworkMode is also supplied, -NetworkMode wins. Default: false.
 
     .PARAMETER VirtualNetworkAddressPrefix
     Optional. Address space for the workload. A /26 is required for the workload. Default: "10.20.30.0/26".
@@ -187,6 +190,11 @@ function Deploy-FinOpsHub
         [int]
         $DataExplorerFinalRetentionInMonths = 13,
 
+        [Parameter()]
+        [ValidateSet('public', 'vnet', 'private')]
+        [string]
+        $NetworkMode,
+
         [Parameter()]
         [switch]
         $DisablePublicAccess,
@@ -281,7 +289,13 @@ function Deploy-FinOpsHub
                 $parameterSplat.TemplateParameterObject.Add('dataExplorerCapacity', $DataExplorerCapacity)
                 $parameterSplat.TemplateParameterObject.Add('dataExplorerRawRetentionInDays', $DataExplorerRawRetentionInDays)
                 $parameterSplat.TemplateParameterObject.Add('dataExplorerFinalRetentionInMonths', $DataExplorerFinalRetentionInMonths)
-                $parameterSplat.TemplateParameterObject.Add('enablePublicAccess', -not $DisablePublicAccess)
+                # networkMode (v15+) wins over enablePublicAccess; only send the legacy parameter
+                # when -NetworkMode wasn't supplied or the template is older than v15.0.
+                $useNetworkMode = $PSBoundParameters.ContainsKey('NetworkMode') -and ($Version -eq 'latest' -or [version]$Version -ge '15.0')
+                if (-not $useNetworkMode)
+                {
+                    $parameterSplat.TemplateParameterObject.Add('enablePublicAccess', -not $DisablePublicAccess)
+                }
                 $parameterSplat.TemplateParameterObject.Add('virtualNetworkAddressPrefix', $VirtualNetworkAddressPrefix)
                 $parameterSplat.TemplateParameterObject.Add('exportRetentionInDays', $ExportRetentionInDays)
                 $parameterSplat.TemplateParameterObject.Add('ingestionRetentionInMonths', $IngestionRetentionInMonths)
@@ -299,6 +313,11 @@ function Deploy-FinOpsHub
                 $parameterSplat.TemplateParameterObject.Add('enableManagedExports', $EnableManagedExports.IsPresent)
             }
 
+            if (($Version -eq 'latest' -or [version]$Version -ge '15.0') -and $PSBoundParameters.ContainsKey('NetworkMode'))
+            {
+                $parameterSplat.TemplateParameterObject.Add('networkMode', $NetworkMode)
+            }
+
             if ($Version -eq 'latest' -or [version]$Version -ge '13.0')
             {
                 $parameterSplat.TemplateParameterObject.Add('enablePurgeProtection', $EnablePurgeProtection.IsPresent)

src/scripts/Deploy-Hub.ps1

@@ -88,11 +88,14 @@
     .PARAMETER ManagedExports
     Optional. Use managed exports instead of manual exports. Requires -Scope. Grants the hub managed identity the required roles on the scope and passes scopesToMonitor to the template.
 
+    .PARAMETER NetworkMode
+    Optional. Network access mode. Allowed: "public" (no VNet), "vnet" (VNet + NSG scaffold, public endpoints remain), "private" (VNet + private endpoints + NAT Gateway). Takes precedence over -Private. Requires hub template v15 or later. Default: not set.
+
     .PARAMETER Private
-    Optional. Deploy with private networking (VNet and private endpoints). Default: false.
+    Optional. DEPRECATED — use -NetworkMode private instead. Deploy with private networking (VNet and private endpoints). Default: false.
 
     .PARAMETER VirtualNetworkAddressPrefix
-    Optional. Virtual network address prefix for private networking. Requires a /26 CIDR block. When set, also sets -Private. Default: "10.20.30.0/26".
+    Optional. Virtual network address prefix for private networking. Requires a /26 CIDR block. When set, also enables private mode. Default: "10.20.30.0/26".
 
     .PARAMETER Build
     Optional. Build the template before deploying.
@@ -116,6 +119,8 @@ param(
     [switch]$Remove,
     [string]$Scope,
     [switch]$ManagedExports,
+    [ValidateSet('public', 'vnet', 'private')]
+    [string]$NetworkMode,
     [switch]$Private,
     [string]$VirtualNetworkAddressPrefix,
     [string]$Location,
@@ -283,16 +288,30 @@ else
     $params.enableManagedExports = $false
 }
 
-# Private networking (infer from VNet prefix if provided)
-if ($VirtualNetworkAddressPrefix) { $Private = $true }
-if ($Private)
+# Network mode (preferred) / private networking back-compat
+# -NetworkMode wins over -Private. -VirtualNetworkAddressPrefix implies private mode when
+# neither -NetworkMode nor -Private is set.
+if ($NetworkMode)
 {
-    $params.enablePublicAccess = $false
+    $params.networkMode = $NetworkMode
     if ($VirtualNetworkAddressPrefix)
     {
         $params.virtualNetworkAddressPrefix = $VirtualNetworkAddressPrefix
     }
-    Write-Host "  Private networking: enabled (VNet $($VirtualNetworkAddressPrefix ?? '10.20.30.0/26'))"
+    Write-Host "  Network mode: $NetworkMode$(if ($NetworkMode -ne 'public') { " (VNet $($VirtualNetworkAddressPrefix ?? '10.20.30.0/26'))" })"
+}
+else
+{
+    if ($VirtualNetworkAddressPrefix) { $Private = $true }
+    if ($Private)
+    {
+        $params.enablePublicAccess = $false
+        if ($VirtualNetworkAddressPrefix)
+        {
+            $params.virtualNetworkAddressPrefix = $VirtualNetworkAddressPrefix
+        }
+        Write-Host "  Private networking: enabled (VNet $($VirtualNetworkAddressPrefix ?? '10.20.30.0/26'))"
+    }
 }
 
 # Resource group

src/templates/finops-hub/modules/Microsoft.FinOpsHubs/Core/infrastructure.bicep

@@ -25,6 +25,9 @@ var finopsHubSubnetName = 'private-endpoint-subnet'
 var scriptSubnetName = 'script-subnet'
 var dataExplorerSubnetName = 'dataExplorer-subnet'
 
+// In vnet mode, all subnets are deployed with defaultOutboundAccess:false but no NAT Gateway
+// is attached — they are intentionally egress-less scaffolding for future private-mode upgrades.
+// NAT Gateway is only attached to script + dataExplorer subnets when privateRouting is enabled.
 var subnets = !hub.options.vnetIntegration ? [] : [
   {
     name: finopsHubSubnetName