Resource Tagging in Azure: Organize and Track Your Cloud Costs

What Tags Are

A tag is a key-value pair attached to an Azure resource or resource group. Both the key and the value are plain strings. Tags are stored as metadata on the resource — they do not affect how the resource operates.

Examples of valid tags:

environment: production
team: platform-engineering
application: payments-api
cost-center: CC-1042
owner: alice@example.com

Tags show up in Azure Cost Management, the portal resource list, CLI output, and ARM template exports. Once you tag resources consistently, you can filter and group them in every Azure management tool.

The 50-tag limit per resource is rarely a practical constraint. Most well-designed tagging strategies use 5-8 tags per resource.

Why Tagging Matters for Cost Attribution

Azure bills at the subscription level by default. Without tags, a $10,000 monthly bill shows you which services cost what (compute, storage, networking) but not which team, product, or project generated that cost.

With tags, Cost Management can break the same bill down by any tag dimension. If every resource has an application tag, you can see exactly how much the payments-api application costs versus the data-pipeline. If you also have a cost-center tag, you can send accurate chargeback reports to each business unit.

The catch is consistency. Cost attribution only works if every resource has the relevant tags. A single untagged storage account that belongs to the payments team will appear as unallocated cost. This is why enforcement via Azure Policy matters as much as the tagging taxonomy itself.

See Monitoring Your First Azure Subscription for how to set up cost views filtered by tags in Cost Management.

A Recommended Tagging Taxonomy

There is no universal standard, but the following four-to-six tag set covers the most common needs for a team or small organization. These tag names are widely used and recognized across the Azure community:

Start with just environment, team, and application if the full set feels like too much overhead initially. These three give you the most useful cost views and are easy to explain to everyone on a team.

Applying Tags via Azure CLI

Tagging a Resource Group

az group update \
  --name myapp-dev-rg \
  --set tags.environment=dev \
  --set tags.team=platform \
  --set tags.application=payments-api

The —set tags.key=value syntax adds or updates individual tags without removing existing ones. This is safe to run on resources that already have some tags.

Tagging at Resource Creation

You can apply tags when creating a resource using the —tags flag, which takes a space-separated list of key=value pairs:

az storage account create \
  --name myappstorage001 \
  --resource-group myapp-dev-rg \
  --location eastus \
  --sku Standard_LRS \
  --tags environment=dev team=platform application=payments-api cost-center=CC-1042

Bulk-Tagging All Resources in a Resource Group

To apply a tag to every resource in a resource group at once, use a loop over the resource IDs:

az resource list --resource-group myapp-dev-rg --query "[].id" --output tsv | \
  xargs -I {} az resource tag --ids {} --tags environment=dev team=platform

This gets all resource IDs in the group as tab-separated values, then calls az resource tag on each one. Be aware that this replaces the entire tags object on each resource rather than merging — use —set tags.key=value syntax if you want to add tags without overwriting others.

A safer merge approach for bulk operations:

for id in $(az resource list --resource-group myapp-dev-rg --query "[].id" --output tsv); do
  az resource update --ids "$id" --set tags.environment=dev tags.team=platform
done

Reading Tags on a Resource

az resource show \
  --resource-group myapp-dev-rg \
  --name myappstorage001 \
  --resource-type Microsoft.Storage/storageAccounts \
  --query tags

This returns just the tags object for the resource as JSON, making it easy to verify that tags were applied correctly.

Applying Tags in the Portal

In the portal, every resource has a Tags section in its left sidebar or in the resource overview pane. Click on Tags to see the current tags and add or edit them. The interface is a simple key-value form. Click Save when done.

A useful portal feature: the Tags page in the portal’s top-level navigation (search for “Tags”) shows all tags across your subscription with counts of how many resources use each tag value. This is a quick audit of tag coverage — if environment shows 47 resources but your subscription has 60 resources, 13 resources are untagged for environment.

Tags in Cost Management

Once tags are applied consistently, Cost Management becomes significantly more useful. In the portal, navigate to Cost Management and open Cost analysis. Use the Group by dropdown to group costs by any tag key. Selecting “Group by: Tag: application” shows a breakdown of how much each application spent in the selected period.

There is an important delay to be aware of: tags applied today appear in cost data after a 24-48 hour processing delay. Historical costs before a tag was applied are not retroactively attributed to the tag. This means applying tags on existing resources will only improve your cost views for future billing periods.

Enforcing Tags with Azure Policy

Asking teams to add tags manually is a policy in words. Enforcing tags with Azure Policy is a policy in code. Azure Policy can deny resource creation if a required tag is missing, or it can automatically apply a tag if none is specified.

Microsoft provides built-in policy definitions for common tagging scenarios. In the portal, navigate to Policy > Definitions and search for “tag” to see them:

• Require a tag on resources — denies creation of any resource missing the specified tag.
• Add or replace a tag on resources — automatically applies a tag with a specified value, overriding any existing value for that key.
• Inherit a tag from the resource group — copies a specified tag from the parent resource group to child resources at creation time.

A practical enforcement setup for a new subscription:

1. Assign the “Require a tag on resources” policy for the environment and team tags at the subscription level.
2. Set the policy effect to “Deny” so resource creation fails if tags are missing.
3. Create an exemption for the subscription’s default resource group and any Azure-managed resource groups (the ones starting with NetworkWatcherRG or AzureBackupRG).

With this in place, no one can create an untagged resource by accident. The policy enforces the tagging standard without requiring manual audits. See Azure Resource Hierarchy for context on where policies can be assigned in the management hierarchy.