Enforce tag usage on Azure resources using Tag policies

How do you find out for which project or environment a certain Azure resource was created?

How do you find out which team is responsible for the costs related to a resource or resource group?

These are just some of the questions that can be answered easily using the support of tags on Azure resources.

Azure supports adding tags to resources. These can be added when the resource is created. These can also be added or updated at a later moment:

Tags are just key-value pairs giving more context to your resources. You can describe eg. the project it is used for, the creation date, the owner, the customer, the environment.

You can just add any key-value pair you have in mind.

Once added, the tags are shown in the portal:

Tags can then be selected while filtering Azure costs, as seen in the portal:

Now, you have a better understanding of the context of this resource group.

Unfortunately, adding tags is optional by default. And in the portal, these must be added by hand at first. Therefore, these are not always added by users or entered wrong just because the purpose is not yet clear to them.

Luckily, Azure offers policies to enforce adding tags.

This way, it’s not optional anymore. And, tags can be inherited too.

Let’s see how this is done.