The problem In Part 1 we built a FinOps pipeline on Azure Databricks that merges Azure infrastructure billing and Databricks DBU usage into one FOCUS-format cost lakehouse. It works. But if the workspace it runs in was assembled by clicking through the Azure portal, you own an environment nobody can review, reproduce, or roll back. Portal-built platforms fail quietly. The network rule someone added during an incident is undocumented. The second workspace differs from the first in ways nobody can list.

The problem Every month, your Databricks platform produces two bills. Azure invoices the virtual machines, local SSDs, premium storage, and network egress your clusters run on, while Databricks meters DBU consumption in its own system tables. The number everyone actually wants, the true cost of a single workload, exists in neither. So teams do what teams always do: they export both datasets to Excel and reconcile them by hand. It is slow, it is error-prone, and it has to be redone every month because hyperscalers restate billing data retroactively.

The problem Basic Keycloak permissions can be granted via the roles present in system clients. The realm-management client is used in most cases. However, there is a problem: existing permissions cannot be configured to meet your needs and provide too much access. You can make a user to manage all users in the realm or manage no one. There are two possible scenarios in this case. Only a limited number of developers have access to the realm, which makes them responsible for managing test users.