Improve FinOps hubs deployment UI: ADX/Fabric exclusivity and Remote Hub settings

[RolandKrummenacher]

⚠️ Problem

The current FinOps hubs deployment UI in the Azure Portal does not make it clear that Azure Data Explorer and Microsoft Fabric are mutually exclusive options. Both sections appear as independent optional configurations, but internally Fabric takes priority and ADX is silently ignored if both are configured (see hub.bicep#L193):

var useFabric = !empty(fabricQueryUri)
var useAzureDataExplorer = !useFabric && !empty(dataExplorerName)  // Prefer Fabric over Azure Data Explorer

This can lead to:

1. User confusion - Users may configure both thinking they'll get both capabilities
2. Wasted effort - Users spend time configuring ADX settings that will be ignored
3. Unexpected behavior - No warning or error is shown when both are configured

Additionally, the Remote Hub configuration parameters (remoteHubStorageUri, remoteHubStorageKey, enablePurgeProtection) are not exposed in the UI at all, requiring users to deploy via CLI/PowerShell.

🛠️ Solution

1. Make ADX/Fabric exclusivity clear in the UI:

   • Option A: Use radio buttons to select between "None", "Azure Data Explorer", or "Microsoft Fabric"
   • Option B: Disable one section when the other has values entered
   • Option C: Add a visible warning message when both are configured explaining Fabric takes priority

2. Add Remote Hub section to the UI:

   • Add an optional "Remote Hub" section with:
     • Remote Hub Storage URI (text input)
     • Remote Hub Storage Key (secure/password input)
     • Enable Purge Protection checkbox (only relevant when Remote Hub is configured)
   • Include help text explaining that Remote Hub mode forwards processed data to a central hub instead of storing locally

ℹ️ Additional context

Current UI screenshot:
The UI shows ADX and Fabric as independent optional sections with no indication they're mutually exclusive.

Architecture constraints:

• A hub can use ADX OR Fabric for analytics, not both
• Remote Hub satellites forward data to a central hub - they don't store data locally
• Key Vault is only created when Remote Hub is configured (to store the storage key securely)
• enablePurgeProtection only applies to the Key Vault, so it's only relevant for Remote Hub deployments

Alternative considered:

• Allow both ADX and Fabric simultaneously - Ruled out because the data pipelines are designed to target one analytics backend, and supporting both would significantly complicate the architecture without clear user benefit.

🙋‍♀️ Ask for the community

We could use your help:

1. Please vote this issue up (👍) to prioritize it.
2. Share which option (A, B, or C) you prefer for showing ADX/Fabric exclusivity.
3. Let us know if you're using Remote Hub and what additional UI fields would be helpful.