Azure policy to allow tags with certain names (value doesn't matter)

Javier Garcia Maroto 0

Hi everyone,

I have a list of allowed tags, I don't mean the value that the tag contains but only the name of the tag. The purpose of this is that all the tenant's resources only have tags that are included in this list.

Because of this I need a policy that checks that during the process of creating a new resource only tags that are among those allowed are being introduced. I don't know if this is possible to manage with a policy or if there is another way.

Thanks to all and greetings.

Vinod Pittala 335 Reputation points Microsoft Vendor

2025-02-20T01:05:23.97+00:00
Hello Javier Garcia Maroto,

You can manage this by using a azure policy. for this you'll need to define a custom policy that evaluates your tags on a resource during its creation. If the tags do not match the allowed names, the policy should prevent the resource from being created.

Below is the example policy definition that will examine how we can request for specific tags on resource creation. The policy uses anyOf keyword which means that if any of the tags are not set then the effect will be deny.

{ "mode": "Indexed", "policyRule": { "if": { "anyOf": [ { "field": "[concat('tags[', parameters('Tag-1'), ']')]", "exists": "false" }, { "field": "[concat('tags[', parameters('Tag-2'), ']')]", "exists": "false" }, { "field": "[concat('tags[', parameters('Tag-3'), ']')]", "exists": "false" } ] }, "then": { "effect": "deny" } }, "parameters": { "Tag-1": { "type": "String", "metadata": { "displayName": "your tag name", "description": "example: xxx" } }, "Tag-2": { "type": "String", "metadata": { "displayName": "your tag name", "description": "example: yyy" } }, "Tag-3": { "type": "String", "metadata": { "displayName": "your tag name", "description": "example: zzz" } } } }

After the creation of the policy you will need to assign it on a specific location/resource-group/subscription. In the parameters dialog you will need to provide the evaluation parameters. and you need to provide the tag name for policy parameters and azure parameters. In the end Azure will request from the user the specific parameters, Tag-1, Tag-2, Tag-3.

Once assign the policy try out creating a resource with those 3 Tags, if any one of the Tag missing the validation will fail and the deployment cannot start until the tags are created.

I've done the same on my lab and succeeded.

Hope this helps!

Please reply if you have any challenges.

Thanks
Javier Garcia Maroto 0 Reputation points

2025-02-20T10:54:34.9366667+00:00
Hello @Vinod Pittala ,

Thank you very much for your reply and help. I have followed the steps you have indicated:

I have created a new policy definition with the code you have sent me directly by copy+paste.

I have assigned the policy to a subscription that we have as a sandbox. When making the assignment I had to enter the names of the 3 tags in the parameters section.

This whole process has been carried out without errors.

To verify the operation of the policy I have created a new resource group in the subscription but it seems that the policy is not doing anything, it lets me create the resource without tags or with tags with names different from the 3 entered in parameters.

Greetings.
Vinod Pittala 335 Reputation points Microsoft Vendor

2025-02-20T23:22:22.5966667+00:00

Hello Javier Garcia Maroto,

Sure please. let me know the findings.
Vinod Pittala 335 Reputation points Microsoft Vendor

2025-02-21T19:07:27.7233333+00:00

Hello Javier Garcia Maroto,

Did you get a chance to check with adding other tags or no tags for the resource creation.
Thank you

Share via

Azure policy to allow tags with certain names (value doesn't matter)

Your answer