Overview
Tag manager enables rule-based automation to standardize tagging across Azure resources. You can define conditional rules that automatically create and apply tags to resources that meet specified criteria.
Rules can be configured to evaluate resource attributes such as subscription, resource group, resource type, naming conventions, or other metadata. Once defined, these rules are applied across multiple subscriptions from a centralized configuration.
Business value
Tag manager removes the manual effort of applying consistent tags across Azure resources, reducing tagging errors and ensuring cost, ownership, and governance tags stay consistent as your environment scales.
Prerequisites
Required permissions
Only the Account owner and Owner roles have access to perform all Tag manager actions in Cost Analyzer, including creating, cloning, editing, deleting, and running rule configurations.
In Azure, the service principal connected to Turbo360 needs Contributor permission on the target resources, since applying a tag directly to a resource is a write operation.
How it works
- A rule configuration pairs a tag key-value with one or more criteria that determine which resources the tag applies to.
- Criteria can evaluate resource attributes such as subscription, resource group, resource type, and naming conventions.
- Once saved, a configuration runs automatically on a daily basis, starting from the time it was last saved or updated.
- Configurations can also be triggered on demand.
- Tags applied by a configuration are reflected directly in Azure on the target resources.
Steps
Use the following steps to create, run, clone, edit, and delete Tag manager rule configurations. Navigate to Settings > Tag manager to get started.
Create a rule configuration
Creating a configuration lets you automatically apply a tag key-value pair to every resource that matches your defined criteria.
- Navigate to Settings > Tag manager and select Create.
- Enter a unique name to identify the configuration, and then select Next.
- Specify the required tag key and corresponding value.
- Define the criteria that determine which resources receive the tag.
- Select Save to complete and activate the configuration.
Run a configuration on demand
Running a configuration instantly applies its rules without waiting for the next scheduled daily run. Use this option when a tag key-value or criteria change needs to take effect immediately.
- Click the Actions menu next to the configuration and select Run now.
Clone a configuration
Cloning creates a copy of an existing configuration, retaining its rules, tag key-value pairs, and criteria, so you can reuse them as a starting point without rebuilding a configuration from scratch.
- Click the Actions menu next to the configuration to be duplicated and select Clone.
- Provide a unique name for the new configuration to distinguish it from the original.
- Review and adjust the retained rules and tag key-value pairs if needed.
- Click Save to create the cloned configuration.
Edit or delete a configuration
Editing lets you update a configuration's name, rules, or tag key-value pairs. Deleting permanently removes a configuration you no longer need.
- Click the Actions menu next to the configuration.
- Select Edit to modify the configuration, or Delete to remove it permanently.
Example scenario
An administrator wants every resource in the Production resource group to carry an Environment: Production tag. They create a configuration with that tag key-value pair and a criterion matching resource group Production. The configuration runs automatically each day, tagging any new resources added to the group, and the administrator uses Run now immediately after saving to apply the tag without waiting for the next scheduled run.
Troubleshooting
-
A configuration isn't tagging a resource I expect it to tag
Cause: The resource doesn't meet all criteria defined in the rule configuration.
Fix: Review the configuration's criteria and confirm the resource's subscription, resource group, resource type, or naming pattern matches every defined condition. -
Tags haven't updated since I changed a configuration
Cause: The configuration runs automatically once daily, so changes may not appear until the next scheduled run.
Fix: Use the Run now option under the Actions menu to apply the updated rules immediately instead of waiting for the daily run. -
I don't have access to create, edit, or delete a configuration
Cause: Only the Account owner and Owner roles have access to Tag manager actions.
Fix: Ask an Account owner or Owner to perform the action, or to review your role assignment. -
A rule configuration runs but tags aren't applied to the resource in Azure
Cause: The service principal connected to Turbo360 doesn't have Contributor permission on the target resource, so the write operation to apply the tag fails.
Fix: Grant the service principal Contributor permission on the resource, resource group, or subscription scope, then run the configuration again.
FAQs
-
How often does a rule configuration run automatically?
Once daily, starting from the time the configuration was last saved or updated. If you need the configuration to apply immediately — for example after creating it or modifying criteria — use Run now from the Actions menu. -
Will Tag manager overwrite an existing tag on a resource?
Yes. If a resource already has a tag with the same key as the one defined in a rule configuration, the configuration will overwrite the existing value when it runs. Review your criteria carefully if you want to avoid overwriting intentionally set tags. -
Can a rule configuration apply tags across multiple subscriptions?
Yes. A single rule configuration can target resources across multiple subscriptions by defining subscription-level criteria or by leaving subscription criteria broad enough to match resources in multiple subscriptions. Tag manager applies the configuration from a centralized location and runs it against all matching resources regardless of which subscription they belong to. -
What happens to tags already applied in Azure if I delete a configuration in Tag manager?
Deleting a configuration removes it from Tag manager and stops future automated runs. It does not remove the tags that the configuration previously applied to resources in Azure — those tags remain on the resources until they are manually removed or overwritten by another rule. -
Can a Contributor role in Cost Analyzer manage tag configurations?
No. Tag manager actions (create, edit, clone, delete, run) are restricted to Account owner and Owner roles only. The Contributor permission referred to in the prerequisites applies to the service principal in Azure, not to Cost Analyzer user roles.