This is the Lesson 3 of the "Azure Governance - Free training" serie. This document presents Azure Tags in-depth and lists all key items you should now when designing your Azure Tags model. Finally, the document describes all methods/tools (GUI & CLI) you can use to create and apply Azure Tags to your Azure environment.

1. Module 3
Azure
Tags
Azure Free Training
Azure Governance Model
By Hicham KADIRI
Fabruary 07, 2019
A K&K Group Company

2. Contoso Ltd.
About me
Microsoft MVP
• Windows Expert-IT Pro (2014-2015)
• Cloud and Datacenter Management (2016)
• Enterprise Mobility /RDS (2017)
• CDCM /Azure (2018)
Founder
@BecomeITExpert.com
Co-Founder
@K&K Group
Think {Cloud /DevOps /Security}
IT Author (+10 eBooks)
• RDS 2012 R2 and 2016 Pocket Consultant
• RDS & OS Security & Hardening guide
• Azure CLI 2.0 Pocket Consultant
• GPO, PowerShell, AppLocker …
Lead Cloud Architect /Az Expert
• Working for several large companies
and international group including
Thales, Areva, Rabobank, Gemalto,
Vinci, CE, BP…etc
IT Blogger
• hichamkadiri.wordpress.com
• AskTheCloudExpert.wordpress.com
• ~2millions views ☺
/hicham_kadiri
/in/hichamkadiri
TechNet Contributor (Top 0,5%)
• MTFC (Microsoft Technical French Contributor)
• MCC (Microsoft Community Contributor)
Hicham KADIRI (aka #HK)

3. Document Objectives
• Reminder about Azure Governance
• Explains the importance of Tags in
the Microsoft Azure environment
• Keys items You Should Know
• Azure Tags : Limitations
• Required Rights for Azure Tags
• Recommended Tags for Azure
• Azure GUI & CLI Tools you can use
to create and Apply Azure Tags
• DEMO : HowTo Tag your Azure RG
and Resources

4. Contoso Ltd.
Reminder about
Azure Governance
#HK

5. Contoso Ltd.
#HK

6. Contoso Ltd.
Azure Tags
Why it’s important ?
#HK

7. Contoso Ltd.
Microsoft Azure Tags
What is it and Why it’s important ?
• Azure Tags provide a way to logically organize resources with properties that you
define. Tags become very helpful when you need to organize resources for billing or
management.
• They consists of key/value pairs, where the key is what you want to identify the resource by, and the
value is the value of your identifier (key)
• Azure Tags must be defined in your
global Azure Governance
Document when designing
your target Azure environment.
#HK

8. Contoso Ltd.
Azure Tags
Keys items You Should Know
#HK

9. Contoso Ltd.
Microsoft Azure Tags
Keys Items You Should Know
• You can only apply tags to resources that support Resource Manager operations
▪ VMs, Virtual Networks and Storage created through the classic deployment model must be re-
deployed through Resource Manager to support tagging
• A good way around this is to tag the resource group they belong too instead.
▪ All ARM resources support tagging
• Tags are free-form text so consistent correct spelling is very important
• Tag names can't contain these characters: <, >, %, &, , ?, /
• Each tag is automatically added to the subscription-wide taxonomy
• Application or resource specific tags will “pollute” the tag list for the entire subscription.
#HK

10. Contoso Ltd.
Azure Tags
Limitations
#HK

11. Contoso Ltd.
Microsoft Azure Tags
Limitations
• Not all resource types support tags. To determine if you can apply a tag to a specific resource type,
see Tag support for Azure resources.
• Each resource or resource group can have a maximum of 15 tag name/value pairs
• A resource group can contain many resources that each have 15 tag name/value pairs
• The tag name is limited to 512 characters, and the tag value is limited to 256 characters.
• For storage accounts, the tag name is limited to 128 characters, and the tag value is limited to 256 characters
• Azure VMs are limited to a total of 2048 characters for all tag names and values.
• (by default) Tags applied to the resource group are not inherited by the resources in that resource
group.
• To apply all tags from a resource group to its resources, you have to do it manually (using a PS/Az scripts)
• Through the relationship you can easily find resource by filtering by tagged resource group
• We recommend keeping the tags to the resource group unless they are resource specific.
#HK

12. Contoso Ltd.
Azure Tags
Required « Rights »
#HK

13. Contoso Ltd.
Microsoft Azure Tags
Required “Rights”
• To create and apply tags to resources (or RG), the user must have write access to
that resource type. To apply tags to all resource types, use the Contributor role. To
apply tags to only one resource type, use the contributor role for that resource.
• For example, to apply tags to Azure Virtual Machines, use the Virtual Machine
Contributor.
#HK

14. Contoso Ltd.
Azure Tags
Recommended « Tags »
#HK

15. Contoso Ltd.
Microsoft Azure Tags
Recommended Tags for Resource Groups
• Here are some recommended Tags you can use for your Azure environment :
• Note : The above tags could help you identify the resources easily, but there is no “one size fits all”, so consider what fits your needs. Tags are
listed on your Azure bill, so you will also be able to see what a specific resource or group of resources – costs if you use tags to identify them
#HK
Tag Name State Description Tag Value
ResourceOwner Required Full Name of the Resource Owner First Name, Last Name (or
Email Address)
ApplicationName Required The Name of application hosted on Azure resource KKGroupHRApp
Project Code/ID Optional The Tag Value must contains a Project Code or ID KKGroupHRAppProjectCode
CostCenter Required Provides a charge code or cost center to attribute the bill for the resources
too
Cost Center of Application
EnvironmentType Required Provides information on what the resource group is used for (useful for
maintenance, policy enforcement...)
Dev, Training, Test, Prod
ExpirationDate Optional Provides a date when the environment is expected to be removed Expiration Date in UTC
OpeningHours Optional Useful for Azure VM. You can set an opening hours > eg: 8:00AM to 8:00PM X:00AM to Y:00PM
DistributionList Optional Email for warning when incident, scheduled maintenance are open Email Address

16. Contoso Ltd.
Azure GUI & CLI Tools you can use
To create and apply Tags
#HK

17. Contoso Ltd.
Azure GUI & CLI Tools you can use
To create and apply Azure Tags
• Azure Tags can be created and applied using different GUI & CLI Tools :
• GUI :
▪ Azure Portal
• CLI
▪ Windows PowerShell (using AzureRM Module)
▪ Azure CLI 2.0
#HK

18. Contoso Ltd.
Azure GUI & CLI Tools you can use
To create and apply Azure Tags
• Azure Tags can also be created, managed and updated using REST API interface
• Refer to the following link to read more :
https://docs.microsoft.com/fr-fr/rest/api/resources/tags
#HK

19. Contoso Ltd.
HowTo Tag
Your Azure Resource Groups and Resources
#HK

20. Contoso Ltd.
Create, apply and view Azure Tags
using Azure Portal

21. Contoso Ltd.
HowTo #1 [Part1]
Create, apply and view Azure Tags via Azure Portal
• Connect to Azure Portal
• https://portal.azure.com
• Select the RG or Resource you want
to Tag
• From the RG (or Resource) Blade,
click on “Tags”
• Add your Tags :
• Tag Name
• Tag Value
• Click “Save”
#HK

22. Contoso Ltd.
HowTo #1 [Part2]
Create, apply and view Azure Tags via Azure Portal
• Existing Tags can be re-used and applied to any resource groups or Azure resource
• In the following example, EnvironmentType tag will be re-used and applied to “hk-training-rds-rg”
resource group. This time, the tag value will be “Training”
#HK

23. Contoso Ltd.
HowTo #1 [Part3]
Create, apply and view Azure Tags via Azure Portal
• Once created and applied, tags are automatically displayed in the
Overview :
#HK

24. Contoso Ltd.
HowTo #1 [Part4]
Create, apply and view Azure Tags via Azure Portal
• To bulk assign tags to multiple resources, click on “All resources” (or from any list of resources), select
the checkbox for the resources you want to assign the tag.
• Select Assign tags, and add your Tags
• When done, click “Save”:
#HK

25. Contoso Ltd.
HowTo #1 [Part5]
Create, apply and view Azure Tags via Azure Portal
• To view all resources with Tags,
select “All services” and then “Tags”
• Select the tag for viewing resources.
• All resources with that tag are displayed.
#HK

26. Contoso Ltd.
HowTo #1 [Part6]
Create, apply and view Azure Tags via Azure Portal
• To delete a tag, select the trash icon. Then, Click Save..
#HK

27. Contoso Ltd.
Create, apply and view Azure Tags
using AzureRM Module

28. Contoso Ltd.
HowTo #2 [Part1]
Create, apply and view Azure Tags via AzureRM PS Module
• To view existing Azure Tags for a specific resource group, run the following PS command :
#HK

29. Contoso Ltd.
HowTo #2 [Part2]
Create, apply and view Azure Tags via AzureRM PS Module
• To see the existing tags for a resource that has a specified name and resource group, run the
following PS command :
#HK

30. Contoso Ltd.
HowTo #2 [Part3]
Create, apply and view Azure Tags via AzureRM PS Module
• To get resource groups or resource that have a specific tag, run the following PS commands :
#HK

31. Contoso Ltd.
HowTo #2 [Part4]
Create, apply and view Azure Tags via AzureRM PS Module
• To get resource that have a specific tag name, run the following PS commands :
#HK

32. Contoso Ltd.
HowTo #2 [Part5]
Create, apply and view Azure Tags via AzureRM PS Module
• To add tags to a resource group without existing tags, run the following PS commands :
• Important note :
• Every time you apply tags to a resource or a resource group, you overwrite the existing tags on that resource or resource
group. Therefore, you must use a different approach based on whether the resource or resource group has existing tags.
#HK

33. Contoso Ltd.
HowTo #2 [Part6]
Create, apply and view Azure Tags via AzureRM PS Module
• To apply all tags from a resource group to its resources, and not retain existing tags on the resources,
run the following PS Script :
#HK

34. Contoso Ltd.
HowTo #2 [Part7]
Create, apply and view Azure Tags via AzureRM PS Module
• To remove all tags, pass an empty hash table:
#HK

35. Contoso Ltd.
Create, apply and view Azure Tags
using Azure CLI 2.0

36. Contoso Ltd.
HowTo #3 [Part1]
Create, apply and view Azure Tags via Azure CLI 2.0
• To view existing Azure Tags for a specific resource group, run the following az
command :
#HK

37. Contoso Ltd.
HowTo #3 [Part2]
Create, apply and view Azure Tags via Azure CLI 2.0
• To see the existing tags for a resource that has a specified name, type, and resource
group, run the following az command :
#HK

38. Contoso Ltd.
HowTo #3 [Part3]
Create, apply and view Azure Tags via Azure CLI 2.0
• To get resource groups that have a specific tag, run the following az command :
#HK

39. Contoso Ltd.
HowTo #3 [Part4]
Create, apply and view Azure Tags via Azure CLI 2.0
• To get all the resources that have a particular tag and value, run the following az
command :
#HK

40. Contoso Ltd.
HowTo #3 [Part5]
Create, apply and view Azure Tags via Azure CLI 2.0
• To add tags to a resource group without existing tags, run the following az
command :
#HK

41. Contoso Ltd.
HowTo #3 [Part6]
Create, apply and view Azure Tags via Azure CLI 2.0
• To add tags to a resource without existing tags, run the following az command :
#HK

42. Contoso Ltd.
HowTo #3 [Part7]
Create, apply and view Azure Tags via Azure CLI 2.0
• To apply all tags from a resource group to its resources, and not retain existing tags
on the resources, run the following az script :
#HK

43. Contoso Ltd.
HowTo #3 [Part8]
Create, apply and view Azure Tags via Azure CLI 2.0
• To apply all tags from a resource group to its resources, and retain existing tags on
resources, run the following az script :
#HK

44. Contoso Ltd.
HowTo #3 [Part9]
Create, apply and view Azure Tags via Azure CLI 2.0
• To remove all tags for a specific subscription, you can use az tag delete command :
#HK

45. Contoso Ltd.
Do you have any Azure
Project (Design/Architecture/Migration)?
If yes, feel free to contact us
Your Contacts
Hicham KADIRI
Lead Cloud Architect /Azure Advisor & Microsoft MVP
hicham.kadiri@k-nd-k-group.com
+33 (0)6 52 97 72 84
Mohsine CHOUGDALI
Key Account Manager
mohsine.chougdali@k-nd-k-group.com
+33 6 66 26 55 15
A K&K Group Company

46. Contoso Ltd.
#HK o_O
/hicham_kadiri
/in/hichamkadiri
Subscribe to my Blog
hichamkadiri.wordpress.com

47. Contoso Ltd.
End of Lesson
Hope this Helps ☺