`new-azcostmanagementexport` only works with SAS token

### Description

The New-AzCostManagementExport cmdlet should not require a SAS token when -DestinationResourceId is provided, per [documentation](https://learn.microsoft.com/en-us/powershell/module/az.costmanagement/new-azcostmanagementexport?view=azps-15.5.0).

However no matter what parameters are passed, the following error is returned:
`Key-based authentication is currently disabled on this storage account. To proceed, please enable "Allow storage account key access".`

### Issue script & Debug output

```PowerShell
PS /home/[username]> $export = New-AzCostManagementExport `
>> -Name $REPORT_NAME `
>> -DefinitionType $REPORT_TYPE `
>> -Scope $REPORT_SCOPE `
>> -DestinationResourceId $sa.Id `
>> -DestinationContainer $STORAGE_ACCOUNT_CONTAINER `
>> -DestinationRootFolderPath $STORAGE_FOLDER `
>> -DefinitionTimeframe "Custom" `
>> -TimePeriodFrom $TIME_PERIOD_FROM `
>> -TimePeriodTo $TIME_PERIOD_TO `
>> -DataSetGranularity "Daily" `
>> -Format "csv"
DEBUG: 3:48:09 PM - [ConfigManager] Got [True] from [DisplaySecretsWarning], Module = [], Cmdlet = [].
DEBUG: 3:48:09 PM - GetAzureRMContextCommand begin processing with ParameterSet 'GetSingleContext'.
DEBUG: 3:48:09 PM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [Az.Accounts], Cmdlet = [Get-AzContext]. Returning default value [True].
DEBUG: 3:48:09 PM - [ConfigManager] Got [True] from [DisplaySecretsWarning], Module = [], Cmdlet = [].
DEBUG: 3:48:09 PM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 3:48:09 PM - [ConfigManager] Got nothing from [CheckForUpgrade], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 3:48:09 PM - No authentication telemetry is found for the current cmdlet with Id 7099743f-2b2f-41c5-94eb-8f7b0e8b530a.
DEBUG: AzureQoSEvent: Module: Az.Accounts:5.3.3; CommandName: Get-AzContext; PSVersion: 7.5.5; IsSuccess: True; Duration: 00:00:00.0020452; SanitizeDuration: 00:00:00.0003216
DEBUG: 3:48:09 PM - [ConfigManager] Got [True] from [EnableDataCollection], Module = [], Cmdlet = [].
DEBUG: 3:48:09 PM - GetAzureRMContextCommand end processing.
DEBUG: 3:48:09 PM - [ConfigManager] Got [True] from [DisplaySecretsWarning], Module = [], Cmdlet = [].
DEBUG: [CmdletBeginProcessing]: Starting command
DEBUG: CmdletBeginProcessing:
DEBUG: CmdletProcessRecordStart:
DEBUG: CmdletGetPipeline:
DEBUG: CmdletBeforeAPICall:
DEBUG: URLCreated: //providers/Microsoft.Billing/billingAccounts/[account info redacted]
DEBUG: RequestCreated: //providers/Microsoft.Billing/billingAccounts/[account info redacted]
DEBUG: HeaderParametersAdded:
DEBUG: BodyContentSet:
DEBUG: 3:48:09 PM - [ConfigManager] Got nothing from [DisableInstanceDiscovery], Module = [], Cmdlet = []. Returning default value [False].
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com//providers/Microsoft.Billing/billingAccounts/[account info redacted]/providers/Microsoft.CostManagement/exports/AzureBillingExport_ActualCost_20260418-20260419?api-version=2021-10-01

Headers:
x-ms-unique-id : 2
x-ms-client-request-id : 21bb7f54-d651-4fb1-a00b-0d0a21c2c65b
CommandName : Az.CostManagement.internal\New-AzCostManagementExport
FullCommandName : New-AzCostManagementExport_CreateExpanded
ParameterSetName : __AllParameterSets
User-Agent : AzurePowershell/v15.4.0,PSVersion/v7.5.5,Az.CostManagement/0.1.0,cloud-shell_1.0

Body:
{
"properties": {
"deliveryInfo": {
"destination": {
"resourceId": "/subscriptions/[redacted]/resourceGroups/[redacted]/providers/Microsoft.Storage/storageAccounts/[redacted]",
"container": "azurecostexports",
"rootFolderPath": "export"
}
},
"definition": {
"timePeriod": {
"from": "2026-04-18T00:00:00+00:00",
"to": "2026-04-19T00:00:00+00:00"
},
"dataSet": {
"granularity": "Daily"
},
"type": "ActualCost",
"timeframe": "Custom"
},
"format": "csv"
}
}

DEBUG: BeforeCall:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Cache-Control : no-cache
Pragma : no-cache
session-id : 852990a5-04b8-45a7-b271-eae0485229a5
x-ms-request-id : 7fcf8f2b-517e-4d7e-b747-979bf3a4e406
x-ms-correlation-id : f7a1a8dc-9429-4f0e-a671-8855a205c354
x-ms-correlation-request-id : d64d1cf8-b6a4-4ca1-aa80-301e7f20f285
x-ms-client-request-id : 21bb7f54-d651-4fb1-a00b-0d0a21c2c65b
X-Powered-By : ASP.NET
x-ms-operation-identifier :
x-ms-ratelimit-remaining-tenant-reads: 249
x-ms-routing-request-id : SOUTHCENTRALUS:20260420T154815Z:d64d1cf8-b6a4-4ca1-aa80-301e7f20f285
Strict-Transport-Security : max-age=31536000; includeSubDomains
X-Content-Type-Options : nosniff
X-Cache : CONFIG_NOCACHE
X-MSEdge-Ref : Ref A: B5CAE6A6640244ADA5EF7004C7E793E0 Ref B: SN4AA2022303019 Ref C: 2026-04-20T15:48:09Z
Date : Mon, 20 Apr 2026 15:48:14 GMT

Body:
{
"error": {
"code": "400",
"message": "The exports service is not authorized to access the specified storage account 'sadatabricksexport'. For more information see: https://go.microsoft.com/fwlink/?linkid=2127915 (Request ID: 7fcf8f2b-517e-4d7e-b747-979bf3a4e406)"
}
}

DEBUG: ResponseCreated:
DEBUG: BeforeResponseDispatch:
New-AzCostManagementExport_CreateExpanded: /home/[username]/.local/share/powershell/Modules/Az.CostManagement/0.4.2/CostManagement.Autorest/custom/New-AzCostManagementExport.ps1:237
Line |
237 | Az.CostManagement.internal\New-AzCostManagementExport @PSBoun …
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| The exports service is not authorized to access the specified storage account 'sadatabricksexport'. For more information see: https://go.microsoft.com/fwlink/?linkid=2127915
| (Request ID: 7fcf8f2b-517e-4d7e-b747-979bf3a4e406)
DEBUG: [Finally]: Getting exception 'Microsoft.Azure.Commands.Common.Exceptions.AzPSCloudException: InternalException' from response
DEBUG: Finally:
DEBUG: CmdletAfterAPICall:
DEBUG: [CmdletProcessRecordAsyncEnd]: Finish HTTP process
DEBUG: CmdletProcessRecordAsyncEnd:
DEBUG: CmdletProcessRecordEnd:
DEBUG: AzureQoSEvent: Module: Az.CostManagement:0.4.2; CommandName: New-AzCostManagementExport; PSVersion: 7.5.5; IsSuccess: False; Duration: 00:00:06.4534700; SanitizeDuration: 00:00:00; Exception: InternalException;
```

### Environment data

```PowerShell
Azure cloud shell

Name Value
---- -----
PSVersion 7.5.5
PSEdition Core
GitCommitId 7.5.5
OS Microsoft Azure Linux 3.0
Platform Unix
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 5.3.3 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script 2.2.0 Az.Billing {Get-AzBillingAccount, Get-AzBillingInvoice, Get-AzBillingPeriod, Get-AzBillingProfile…}
Script 11.4.0 Az.Compute {Add-AzGalleryInVMAccessControlProfileVersionRulesIdentity, Add-AzGalleryInVMAccessControlProfileVersionRulesPrivile…
Script 0.4.2 Az.CostManagement {Get-AzCostManagementExport, Get-AzCostManagementExportExecutionHistory, Invoke-AzCostManagementExecuteExport, Invok…
Script 7.25.1 Az.Network {Add-AzApplicationGatewayAuthenticationCertificate, Add-AzApplicationGatewayBackendAddressPool, Add-AzApplicationGat…
Script 9.0.3 Az.Resources {Export-AzResourceGroup, Export-AzTemplateSpec, Get-AzDenyAssignment, Get-AzDeployment…}
Script 9.6.0 Az.Storage {Add-AzRmStorageContainerLegalHold, Add-AzStorageAccountManagementPolicyAction, Add-AzStorageAccountNetworkRule, Clo…
Script 1.1.3 Az.Tools.Predictor {Disable-AzPredictor, Enable-AzPredictor, Open-AzPredictorSurvey, Send-AzPredictorRating}
Script 0.0.0.10 AzureAD.Standard.Preview {Add-AzureADApplicationOwner, Add-AzureADDeviceRegisteredOwner, Add-AzureADDeviceRegisteredUser, Add-AzureADDirector…
Script 0.9.3 AzurePSDrive
```

### Error output

```PowerShell
HistoryId: 20

Message : [400] : Key-based authentication is currently disabled on this storage account. To proceed, please enable "Allow storage account key access". For instructions on how to
change this setting, please visit https://aka.ms/sharedkey. (Request ID: 9eba70a7-7537-4982-ac67-e145e1eabc00)
StackTrace :
Exception : System.Exception
InvocationInfo : {New-AzCostManagementExport_CreateExpanded}
Line : Az.CostManagement.internal\New-AzCostManagementExport @PSBoundParameters

Position : At /home/[username]/.local/share/powershell/Modules/Az.CostManagement/0.4.2/CostManagement.Autorest/custom/New-AzCostManagementExport.ps1:237 char:9
+ Az.CostManagement.internal\New-AzCostManagementExport @PSBoun …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 20
```

Start with Az.CostManagement/custom/New-AzCostManagementExport.ps1 at line 237 and review the New-AzCostManagementExport invocation and request shown in the report. Reproduce the export using -DestinationResourceId with storage account key access disabled, then determine whether the cmdlet or the Cost Management service rejects the configuration. Done means the documented resource-ID destination works without requiring a SAS token or key access.

Written by the indexing model from the issue text.