The Complete Azure Tagging Guide (Updated 2024)

Tags provide a fairly simple way to label resources in a way that makes sense to your organization, such as to a specific engineering team. It enables you to assign categories to your resources so you can easily group, monitor, track, and filter them in any environment.

So, how do tags and tagging work in Azure?

This bookmarkable guide on Azure tagging includes:

Table Of Contents

What Are Tags In Azure?

In Microsoft Azure, tags are metadata that consists of a key-value pair to describe a particular resource in your environment.

In particular, tagging in Azure enables you to label your resources in a logical manner, including individual resources, resource groups, and subscriptions. This helps you identify your resources wherever they are based on certain criteria you decide on as an organization.

You can then keep track of what resources you have available and where those resources are located, You can do that by organizing the resources based on criteria such as who created them, what their purpose is, and any other criteria.

This way, you can quickly query, filter, retrieve, and analyze your Azure resources’ data for management.

Microsoft Azure lets you assign tags to your resources through Azure Portal, Azure PowerShell, Azure Resource Manager JSON templates, and Azure CLI.

Here’s the kicker. You’ll need to tag a lot of your resources to get granular data on them. Yet, that tends to make tagging an endless job. So, is it worth it? Well, here are some major benefits of tagging resources in Azure.

Why Would You Use Tags In Azure?

Tags enable you to organize your Azure cloud resources to support governance, cloud financial management, and operational control.

Here are more examples of benefits and use cases of using a well-defined naming and tagging system in Azure:

What Are The Challenges With Tagging In Azure?

Tagging can be time-consuming, add complexity to Azure management, and become a never-ending battle to help stakeholders understand how your resources are organized.

But there’s more. Tags have some limitations in Azure, including:

The tag feature is not applicable to all resource types

You can check whether a resource type supports tags by visiting Tag support for Azure resources.

The maximum number of tag name-value pairs for a resource, resource group, and subscription is 50

You’d have to use a JSON string for the value if you wish to apply more tags. This JSON string can accommodate most of the values you apply to one tag name. Each subscription or resource group can have many resources with 50 tag name-value pairs each.

A tag’s name can have up to 512 characters and 256 characters for the value

Storage accounts have a 128-character tag name limit and a 256-character tag value limit.

Azure tags do not apply to classic resources

This includes Cloud Services.

IP Groups and Firewall Policies in Azure do not support PATCH operations

So operations based on the PATCH API method cannot update tags via the portal. You’d have to use update commands for these resources, such as the az network ip-group command to update an IP group’s tags.

Tag names cannot contain certain characters

You are limited to 15 tags on the following Azure resources

These limitations are specific to the Azure cloud. In general, tags, tagging, and tags management presents additional challenges, including:

Manually tagging resources is tedious and error-prone

You have to ensure all your tags are consistent. For example, while keys are case-insensitive, values are. This requires keeping everyone on your operations teams aware of your naming and metadata value conventions to prevent applying different tags to the same Azure resources.

Using Azure Policy, you can tag resources or block their creation if they lack the necessary tags.

The feature enforces rules and conventions for tagging in Azure. For example, a policy can prevent deploying resources to your subscription if they don’t comply with your organization’s expected tags.

Another policy can automatically add the tags you need when deploying resources. This means you don’t have to manually add or search for non-compliant tags in your Azure environments.

In addition, Azure lets you tag an existing resource with a remediation task and Modify effect.

Developing a comprehensive Azure tagging strategy involves input from multiple stakeholders

This can be tricky and a lot of work to coordinate. It’s something many organizations haven’t done yet or find increasingly tough to do as their cloud workloads increase rapidly.

Insufficient governance, enforcement, and consistency

As circumstances change, including team members, cloud services, and leadership, any existing tagging conventions will inevitably become obsolete if not actively maintained.

As part of this maintenance, it is essential that a specific individual, team, or role applies Azure tagging best practices continuously to maintain the integrity of the tagging system. How?

15 Azure Tagging Best Practices to Apply Right Away

If you follow these simple guidelines when tagging Azure resources, you can create a robust system for identifying them. And this can facilitate better governance, security, and cost management for your organization.

1. Decide on a common or several naming and tagging conventions and stick to them

Identify the most relevant, simple, and effective way to tag resources with representatives from different areas of your organization. The tags should reflect their daily routines, workflows, and culture. This approach leads to buy-in and the commitment you need to maintain these standards in the future.

2. Tag from the get-go

You can apply tags to existing Azure resources. But you’ll be better off applying them right when you create the resource. This best practice ensures you can start tracking performance, cost, security, and other insights right from the beginning, ensuring you don’t miss anything.

3. Start small and grow as you go

It can be challenging to design for simplicity, especially if you have a lot of resources to monitor or want more detailed metadata. Yet, if you want to prevent overwhelm and make learning easier for your team, start with the tags that are absolutely necessary. You can add more tags as the need arises.

4. Simple does it

A single key-value pair is easier to manage than multi-value tags.

5. Set up rules for Azure tagging and enforce them

Your Azure tagging strategy should be consistent throughout, from abbreviations to spelling. By establishing this governance structure, you ensure that everyone knows what tags to use, when, where, and how to query them without causing confusion or compromising analytics.

6. Use Azure-recommended tagging conventions

This is straightforward. By following standard Azure tagging and naming conventions, you can prevent a variety of issues, such as being unable to collect or locate tagged resources. Remember, monitoring reports that contain errors or misleading information can be more detrimental than having no reports at all.

7. Use multiple built-in policies and apply them as a single initiative.

The advantage of this approach is that you can apply many built-in Azure policies. These built-in policies enable you to require a particular tag or a specified tag with a value. You can add multiple instances of the built-in policy under an initiative. You can then deploy that initiative to your management group, resource group, or subscription.

With this approach, you may need to apply several policies to have a full-fledged tagging strategy, but you’ll be using built-in policies to enforce tagging on Azure.

8. Automate tagging according to your organization’s conventions with Azure Policy

Here are a few examples of tag policies you can create and deploy:

Azure policies simplify tags management in the Azure cloud, so your teams don’t have to spend a lot of time manually searching, tracking, and organizing tags — or dealing with conflicting and outdated tags.

9. Test your tagging policies and conventions

Prior to running specific tags in production, verify that they work as intended. By testing, you can also see exactly what level of granularity you can expect in the future. You can add more tags to subcategorize related resources if you want to refine your classification even further.

10. Align technical (functional and operational) tags with engineering requirements

Consider tagging your Azure resources according to your engineers’ language, such as the name of the workload, environment, application, or service. For example, you can use the key Team A with the value production. This simplifies tagging, ensuring your technical teams understand exactly what a resource is for without needing to figure out a fancy new convention.

11. Align Azure cost allocation tags with business units and accounting conventions

Also, you’ll want to ensure that your Finance and Operations, or FinOps teams, speak the same language. Hence, tag usage and associated costs with dimensions such as cost center, team, product, service, etc. These tags reflect business interests.

By mapping an Azure asset’s business value to its operational costs, you can more easily tell if you are making the most of the resource, for example.

12. Add more tags to your Azure cost reports if you need to

You can apply extra tags using any of the existing tag names and values in your Azure usage report. This is particularly useful when you want to generate a report that summarizes the costs multiple tags incur in a subscription. This means you can make corrections wherever and whenever you need to support more accurate cost allocation.

13. Audit your tags regularly

Establish a cycle where a team comprising different stakeholders, such as finance and engineering, audits the tags. In addition to making sure tags and values are up-to-date, you should analyze if they serve their intended purpose or if they need to be modified.

14. Govern your Azure Resource Groups

Keep the following in mind about resources and resource groups in Azure:

Azure Resource Groups provide a quicker way to group together related Azure resources, so you can manage them as a single unit. Resource Groups help you to quickly identify and manage all the resources associated with a particular project, application, or service. They also help you to control access to the resources in the group and apply policies to them.

15. Establish a policy for handling untagged resources

Azure tags are not applicable to all resources. The problem with untagged resources is that they are a blind spot, for a variety of reasons such as security, cost, or performance concerns. So, define a policy to guide your people through what to do about untagged resources. How?

When life gives you untagged resources, you can’t just tag ’em up and move on!

Besides, there are also untaggable and shared resources in multi-tenant environments to take care of. This data can be harder to collect, leaving you with a major blindspot in your Azure cloud management.

If you’re feeling overwhelmed, in the dark, and your current cost tool just ain’t cutting it, CloudZero can help — even if you have imperfect tags.

What To Do If Your Tagging Is A Mess

CloudZero helps you capture data about tagged, untagged, untaggable, and shared resources with a unique, code-driven approach — all without endless tagging.

By combining metadata about resource usage with context from your infrastructure and applications, CloudZero delivers cloud cost intelligence.

Better yet, CloudZero organizes and breaks down that data into immediately actionable intelligence, and by role; engineering, finance, and FinOps.

Each stakeholder can view their costs and usage in their own language, cultivating a cost-aware culture:

Plus, the data is available for CFO, CTO, and board meetings in a visual, easy-to-digest format, including COGS and gross margin data. The leadership can then answer questions such as:

No need to take our word for it.

Remitly uses CloudZero to allocate 50% more costs without tagging. ResponseTap used CloudZero to identify unallocated resources and saved 18% in annual cloud spend. Beamble now turns multi-tenant infrastructure costs into per-customer metrics. CloudZero saved Drift $2.4 million in annual spend. Take advantage of CloudZero’s proven results. — it’s free.

Author: Cody Slingerland

Cody Slingerland, a FinOps certified practitioner, is an avid content creator with over 10 years of experience creating content for SaaS and technology companies. Cody collaborates with internal team members and subject matter experts to create expert-written content on the CloudZero blog.