Assign policy definitions for tag compliance

You use Azure Policy to enforce tagging rules and conventions. By creating a policy, you avoid the scenario of resources being deployed to your subscription that don't have the expected tags for your organization. Instead of manually applying tags or searching for resources that aren't compliant, you create a policy that automatically applies the needed tags during deployment. Tags can also now be applied to existing resources with the new Modify effect and a remediation task. The following section shows example policy definitions for tags.

Policy definitions

Name (Azure portal)	Description	Effect(s)	Version (GitHub)
Add a tag to resource groups	Adds the specified tag and value when any resource group missing this tag is created or updated. Existing resource groups can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed.	modify	1.0.0
Add a tag to resources	Adds the specified tag and value when any resource missing this tag is created or updated. Existing resources can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed. Does not modify tags on resource groups.	modify	1.0.0
Add a tag to subscriptions	Adds the specified tag and value to subscriptions via a remediation task. If the tag exists with a different value it will not be changed. See https://aka.ms/azurepolicyremediation for more information on policy remediation.	modify	1.0.0
Add or replace a tag on resource groups	Adds or replaces the specified tag and value when any resource group is created or updated. Existing resource groups can be remediated by triggering a remediation task.	modify	1.0.0
Add or replace a tag on resources	Adds or replaces the specified tag and value when any resource is created or updated. Existing resources can be remediated by triggering a remediation task. Does not modify tags on resource groups.	modify	1.0.0
Add or replace a tag on subscriptions	Adds or replaces the specified tag and value on subscriptions via a remediation task. Existing resource groups can be remediated by triggering a remediation task. See https://aka.ms/azurepolicyremediation for more information on policy remediation.	modify	1.0.0
Append a tag and its value from the resource group	Appends the specified tag with its value from the resource group when any resource which is missing this tag is created or updated. Does not modify the tags of resources created before this policy was applied until those resources are changed. New 'modify' effect policies are available that support remediation of tags on existing resources (see https://aka.ms/modifydoc).	append	1.0.0
Append a tag and its value to resource groups	Appends the specified tag and value when any resource group which is missing this tag is created or updated. Does not modify the tags of resource groups created before this policy was applied until those resource groups are changed. New 'modify' effect policies are available that support remediation of tags on existing resources (see https://aka.ms/modifydoc).	append	1.0.0
Append a tag and its value to resources	Appends the specified tag and value when any resource which is missing this tag is created or updated. Does not modify the tags of resources created before this policy was applied until those resources are changed. Does not apply to resource groups. New 'modify' effect policies are available that support remediation of tags on existing resources (see https://aka.ms/modifydoc).	append	1.0.1
Inherit a tag from the resource group	Adds or replaces the specified tag and value from the parent resource group when any resource is created or updated. Existing resources can be remediated by triggering a remediation task.	modify	1.0.0
Inherit a tag from the resource group if missing	Adds the specified tag with its value from the parent resource group when any resource missing this tag is created or updated. Existing resources can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed.	modify	1.0.0
Inherit a tag from the subscription	Adds or replaces the specified tag and value from the containing subscription when any resource is created or updated. Existing resources can be remediated by triggering a remediation task.	modify	1.0.0
Inherit a tag from the subscription if missing	Adds the specified tag with its value from the containing subscription when any resource missing this tag is created or updated. Existing resources can be remediated by triggering a remediation task. If the tag exists with a different value it will not be changed.	modify	1.0.0
Require a tag and its value on resource groups	Enforces a required tag and its value on resource groups.	deny	1.0.0
Require a tag and its value on resources	Enforces a required tag and its value. Does not apply to resource groups.	deny	1.0.1
Require a tag on resource groups	Enforces existence of a tag on resource groups.	deny	1.0.0
Require a tag on resources	Enforces existence of a tag. Does not apply to resource groups.	deny	1.0.1
Requires resources to not have a specific tag.	Denies the creation of a resource that contains the given tag. Does not apply to resource groups.	Audit, Deny, Disabled	2.0.0

Next steps

• To learn about tagging resources, see Use tags to organize your Azure resources.
• Not all resource types support tags. To determine if you can apply a tag to a resource type, see Tag support for Azure resources.