Azure / Guide 3

Tagging and governance with Azure Policy

A tag strategy finance can use, and Azure Policy to enforce it.

Tags answer the questions that come up every month: who owns this, what does it belong to, and who pays for it. Azure Policy makes sure the answers are there, and keeps configuration within the rules without relying on everyone remembering them.

A tag strategy that finance can use

Keep the set small and required. A good starting point:

Rules worth writing down:

• Agree on the exact names and allowed values. Environment=Prod, env=production and Environment=PROD are three different answers in a cost report. Tag names are case-insensitive, but values are case-sensitive.
• Tags don't inherit by default. A tag on a resource group isn't automatically on the resources in it. Use policy (below) to copy it down.
• Limits: up to 50 tags per resource, resource group or subscription; names up to 512 characters (128 for storage accounts) and values up to 256.
• Don't put secrets or personal data in tags. Many people and tools can read them.

Azure Policy in one minute

A policy definition is a rule (for example "resources must have a CostCenter tag"). An initiative groups definitions. An assignment applies a definition or initiative at a scope: a management group, subscription or resource group. Each rule has an effect:

Start new rules with Audit to see the impact, then switch to Deny or Modify once the estate is clean.

Built-in tag policies to use

Search for these in Policy > Definitions:

• Require a tag on resource groups: every new resource group must have the tag.
• Inherit a tag from the resource group if missing (Modify): copies the resource group's tag onto resources that don't have it.
• Inherit a tag from the subscription if missing (Modify): the same, from the subscription.
• Require a tag and its value on resources: for tags with a fixed value in a scope.

A combination that works well: require CostCenter, Owner and Environment on resource groups, and inherit them onto resources. People then only have to tag the resource group.

Assign it in the portal the first time. Modify and DeployIfNotExists policies need a managed identity with permission to make the change, and the portal creates the identity and its role assignment for you (Policy > Assignments > Assign policy, then tick Create a remediation task for existing resources).

Check compliance and fix existing resources

# Compliance summary for the current subscription
Get-AzPolicyStateSummary | Select-Object -ExpandProperty PolicyAssignments |
    Select-Object PolicyAssignmentId, @{n='NonCompliant';e={$_.Results.NonCompliantResources}}

# Non-compliant resources for one assignment
Get-AzPolicyState -Filter "ComplianceState eq 'NonCompliant' and PolicyAssignmentName eq 'inherit-costcenter'" |
    Select-Object ResourceId, PolicyDefinitionName

# Apply a Modify policy to resources that existed before it was assigned
$assignment = Get-AzPolicyAssignment -Name 'inherit-costcenter'
Start-AzPolicyRemediation -Name "remediate-costcenter-$(Get-Date -Format yyyyMMdd)" `
    -PolicyAssignmentId $assignment.Id -ResourceDiscoveryMode ReEvaluateCompliance

For a direct list of what's missing which tags, across every subscription, run Get-AzUntaggedResources.ps1.

Tags in cost reports

Cost Management can apply resource group and subscription tags to usage records, even when the resources themselves aren't tagged (Cost Management > Settings > Tag inheritance). Turn it on so cost reports by tag are complete from day one. It doesn't change the tags on the resources; policy does that.

Other policies worth assigning early

• Allowed locations: keep resources in the regions you've approved (data residency and support).
• Allowed virtual machine size SKUs: stops accidental very large VMs in non-production.
• Not allowed resource types: block services you don't support.
• Configure diagnostic settings to send logs to your Log Analytics workspace.
• The Microsoft cloud security benchmark initiative, which Microsoft Defender for Cloud assigns, for a security baseline.