The Purpose of Tags
Slide deck explaining Azure tags: key/value metadata labels for organizing resources, searching, cost allocation, and reporting. Covers tag best practices, consistency, inheritance, enforcement with Azure Policy, and common use cases.
Tags
Introduction to Azure tags: key/value metadata labels for organizing and reporting on Azure resources.
Tags
Introduction to Azure tags: key/value metadata labels for organizing and reporting on Azure resources.
Why Azure tags matter
Tags help you organize and report on resources without changing your Azure hierarchy. Cloud gets messy fast: lots of resources, shared ownership. Tags add flexible labels across any structure. Great for search, grouping, and cost reporting. Tags are metadata (not permissions).
What is a tag?
A tag is a key/value (name/value) label attached to Azure resources for organization and reporting. Tag format: Key=Value (example: Environment=Prod). Can be applied to: resource, resource group, subscription. Metadata only (doesn't change resource behavior). Best used with a small, consistent tag set.
What tags are for
Tags are for organization and reporting—especially search, ownership, and cost allocation. Organize and search: filter resources by tag (example: App=Checkout). Ownership: track who owns what (example: Owner=PlatformTeam). Cost allocation: group spend by CostCenter / Department / Environment. Works across resource groups and subscriptions.
What tags are NOT
Tags are metadata: not security, not hierarchy, and not a place for sensitive data. Not security: use Azure Role-Based Access Control (Azure RBAC). Not a replacement for resource groups/subscriptions. Not secret storage: tags are plain text. Use tags to label, not to protect.
Tag consistency prevents drift
Consistent tag keys and values keep search and reporting reliable. Agree on a small standard tag set (4–6 keys). Avoid key drift: Env vs Environment. Avoid value drift: Prod vs prod. Consistency equals clean reporting and filtering.
Tag inheritance is not automatic
By default, resources don't inherit tags from resource groups or subscriptions. Resource group tags do not automatically apply to contained resources. Subscription tags do not automatically apply to all resources. For reliable reporting, tag the actual resources. Treat tagging as a deliberate standard, not an assumption.
Enforce tagging with Azure Policy
Azure Policy can require or apply tags to keep tagging consistent at scale. Azure Policy: governance rules for resource compliance. Require tags at creation (example: Environment). Add/append tags during deployment. Remediate existing resources (when supported).
Tags in cost reporting: reality check
Cost views by tag depend on usage records and data refresh, and not every charge carries tags. Many costs need the tag on the resource (not only on the resource group). Tag-based views appear after Cost Management refresh. Some charges may not include tags as expected. Best practice: apply tags early and consistently.
Example: allocate costs by Department tag
Use Department or CostCenter tags to allocate spend even when teams share subscriptions. Problem: shared subscription, need costs by department. Tag approach: Department=Sales (or CostCenter=1234). Group costs by tag in Azure Cost Management. Watch for refresh delays and incomplete tagging on some charges.
Example: troubleshoot with Environment plus App tags
Tags let you filter across resource groups to find exactly the resources you need. Use cross-cutting filters: Environment=Prod, App=Checkout. Find production resources fast in the Azure portal. Works across multiple resource groups. Resource groups equals lifecycle; tags equals flexible labels.
Tags don't restrict access
A tag like DataClassification=Confidential is descriptive, not protective. Tags do not grant/block access. Use Azure Role-Based Access Control (Azure RBAC) for permissions. Use tags for reporting/automation signals. Use Azure Policy to enforce tag presence (not access control).
Key takeaways
Use tags for organization and reporting, and pair them with standards and enforcement. Tags equals metadata for search, grouping, and cost reporting. Azure RBAC controls access; tags don't. No automatic inheritance: plan and enforce (Azure Policy).