Core Overview

• Key-value metadata pairs for organizing Azure resources.
• Apply to resources, resource groups, subscriptions (not management groups).
• Enable cost tracking, automation, billing, and governance.
• All cost-accruing services support tags; track via Cost Management.
• Example: Environment=Production, CostCenter=IT-12345.

Tag Limits

Invalid Characters

• Cannot use: < > % & \ ? /
• Azure DNS: No spaces, parentheses, or starting with number.
• Traffic Manager: No spaces, #, :; cannot start with number.
• Azure Front Door: No # or :.
• Names case-insensitive; values case-sensitive.

Required Access

Common Categories

• Cost: CostCenter, Department, Project, Chargeback.
• Operational: Environment, Application, Owner, Tier.
• Governance: Classification, Compliance, DataType.
• Automation: Shutdown, Backup, Patch, RunsOn.
• Business: BusinessUnit, Owner, SLA.

Azure Policy Governance

• Deny: Prevent deployment without required tags.
• Modify: Auto-add/update tags on resources.
• Audit: Log compliance violations without enforcement.
• Remediation applies Modify to non-compliant resources.
• Scope to management groups for org-wide enforcement.

Policy Scenarios

Security Best Practices

• No sensitive data: Tags in reports, history, templates.
• No passwords/tokens: Use Key Vault instead.
• Use RBAC + Policy to restrict modifications.
• Monitor tag changes via Activity Logs.
• Validate compliance via Policy compliance dashboard.

Tag Inheritance

• Resources do NOT inherit tags from RG/subscription by default.
• Use Policy Modify effect to inherit parent tags.
• Pattern: "Inherit tag from resource group".
• Scope policies to management groups organization-wide.
• Remediation handles existing non-compliant resources.

Cost Management & Billing

• Download usage CSV; tags in "Tags" column.
• Use Cost Management for cost analysis by tag.
• cm-resource-parent tag groups costs by resource ID.
• Enable chargeback per department/business unit.
• Track budget allocations by tag value.

CLI Examples