Azure Tagging Policy

Question

I have a policy applied at the subscription level and I want tags to be inherited by both resource groups and individual resources. However, Azure Policy only provides a built-in policy to inherit subscription tags to resources, and it does not cover resource groups.

Is there any alternative approach—other than creating a custom Azure Policy—to ensure tag inheritance for resource groups as well?

Answer 1

Hello Mittal Priyamvada (BD/ICA-CAE),

You have a subscription-level Azure Policy that enforces tag inheritance. The built-in policy only applies subscription tags to resources, not to resource groups. You want resource groups to also inherit tags automatically, but without creating a custom policy.

Azure Policy's built-in functionality is limited in that it can only automatically enforce tag inheritance from the subscription to resources, not to resource groups. Resource groups, being a higher-level container, are not inherently included in this inheritance model. As a result, you need to either work around this limitation using automation or scripting or find a governance tool that can manage tagging across all levels of your subscription hierarchy.Here are a few alternative approaches:

Create an automation runbook that periodically checks for missing tags in resource groups and applies the subscription-level tags to them.

Create an Azure Automation Account in Azure portal > Create a Runbook to Apply Tags: A runbook is a set of instructions that Azure Automation executes to perform tasks. We'll create a runbook to apply subscription tags to resource groups.

You can use the below sample PowerShell script to apply tags from the subscription to resource groups:

# Get Subscription tags
$subscription = Get-AzContext
$tags = (Get-AzSubscription -SubscriptionId $subscription.Subscription.Id).Tags

# Get all resource groups in the subscription
$resourceGroups = Get-AzResourceGroup
foreach ($rg in $resourceGroups) {
    # Check if tags already exist, if not, apply them
    if ($rg.Tags -eq $null) {
        Set-AzResourceGroup -ResourceGroupName $rg.ResourceGroupName -Tag $tags -Force
        Write-Output "Tags applied to Resource Group: $($rg.ResourceGroupName)"
    } else {
        Write-Output "Tags already exist for Resource Group: $($rg.ResourceGroupName)"
    }
}

 This script Retrieves the subscription tags, Gets all resource groups in the subscription. If tags are not already applied to a resource group, it applies the subscription tags to the resource group. You can save the runbook and verify the script, click Publish to make it ready for execution.

Schedule the Runbook: You can schedule the runbook to run at specific intervals to ensure tags are consistently applied to resource groups.

Manage schedules in Azure Automation | Microsoft Learn

You can Test the above Runbook: Tutorial - Create a PowerShell Workflow runbook in Azure Automation | Microsoft Learn

Another alternative approach you can use is Azure CLI is script to apply subscription tags to resource groups on demand or through scheduled tasks.

Hope this helps! Let me know if you have any further questions! Thanks.

Reference:

Policy definitions for tagging resources - Azure Resource Manager | Microsoft Learn

Use tags to organize your Azure resources and management hierarchy - Azure Resource Manager | Microsoft Learn