How to Tag Azure Managed Application Resource Group (NOT the Managed Resource Group resources)

Rod Joyce 21

I have built an Azure Managed Application. I tag all the resources in the mainTemplate ARM json and this tags all the resources that are deployed into the Managed Resource Group.

However, I cannot figure out how to tag the Managed Application itself on install of my application.

A customer has an Azure Policy to require tags on all resources and this is causing it to fail validation.

SwathiDhanwada-MSFT 17,326 Reputation points

2022-11-17T03:57:57.227+00:00

@Rod Joyce Welcome to Microsoft Q & A Community Forum. I am looking into it and provide an update soon.
Anonymous

2022-12-29T21:36:46.327+00:00

any update on this?
I am facing the same issue. I develop a managed application and intend to publish on Azure Marketplace.

I set a tag policy on all resource groups.

If I deploy the managed application from the marketplace UI in Azure Portal, it will fail to create the managed resource group due to lack of tags.
I know I can do it via ARM template and programmatically. However, from the end user (my customer)'s perspective, I wouldnt expect every single one of them to deploy programmatically.

Internet search is not yielding any useful info on how to tweak the mainTemplate.json and createUiDefiniton.json.

There is a TagByResource UI element example but that is tagging the resources inside the managed resource group. I need to tag the managed resource group itself.
Andrew Sumner 20 Reputation points

2023-07-11T00:22:12.3466667+00:00

Any update on this?
Rod Joyce 21 Reputation points

2023-07-11T01:41:16.33+00:00

FYI, I hit this again today. Using the MSI which has Admin rights I am UNABLE to add the tags through the UI to the Managed Resource Group:

{"details":[{"code":"AuthorizationFailed","message":"The client 'xyz' with object id 'xyz4b3fe-7c7c-4c35-ae18-e690b8c9a3e9' does not have authorization to perform action 'Microsoft.Resources/tags/write' over scope '/subscriptions/xxx-36f2-4f92-b69a-bace62c2bbb5/resourceGroups/xxxoring-RG/providers/Microsoft.Solutions/applications/xxx/providers/Microsoft.Resources/tags/default' or the scope is invalid. If access was recently granted, please refresh your credentials."}]}
Andrew Sumner 20 Reputation points

2023-07-11T11:16:16.27+00:00

I'm also hitting a problem with the deployment failing because of tagging policy violations on the managed application. I can't see any way of tagging managed applications as it falls outside the scope of the template.
Zeeshaan A 0 Reputation points

2024-02-19T17:34:04.2066667+00:00

I am also hitting the same issue, is it fixed now? Or does anyone knows any workaround?