Our development teams have deployed a large number of Azure resources without consistent tags or ownership information, making it difficult to determine who is responsible for them and where the costs belong. We have reduced the backlog from roughly 220 resources to 98, but identifying owners often turns into a "turn it off and see who complains" exercise.
I can query Azure Resource Graph Explorer to find recently created resources without tags, but I would like to automate the process and alert the appropriate team or manager as soon as an untagged resource is created. I have not found a clear way to connect Resource Graph results with Log Analytics.
I previously tried using Azure Policy with a deny effect for missing tags, but that caused deployment failures because some resource types and child resources do not support tags. We already alert on deployments and deletions, give development teams Reader access, and reserve limited Contributor access for emergency portal fixes.
What is the best way to automate detection and alerting for newly created untagged resources? How are other organizations handling tagging enforcement without breaking deployments?
3 Answers
You can use Azure Resource Graph queries directly with Resource Graph alerting, which is currently available as a preview feature. Point the alert at a query that finds newly created resources missing the required tags, then attach an Action Group to notify the responsible people. That avoids having to run the query manually each week.
Another useful approach is an Azure Policy that inherits tags from the resource group. Set the ownership and cost-related tags on the resource group, then use an “inherit if not present” policy where appropriate. This is usually less disruptive than denying every deployment outright. A Logic App calling Resource Graph is another option if you need more custom routing or processing.
You may not need a separate integration to accomplish this. Resource Graph queries can be run from Log Analytics, and you can create a scheduled query alert in the workspace using the Resource Graph query. The alert can then trigger an Action Group when a new untagged resource appears.
This is probably the simplest design if all you need is notification, since it avoids adding a Logic App or another processing component.
That sounds exactly like what I was looking for. I will try creating the scheduled query alert and see whether it works with our existing workspace.
A hard-deny policy is difficult to apply universally because not every Azure resource or nested resource supports tags. A practical pattern is to audit missing tags first, then deny only the resource types that reliably support them. For the exceptions, document them explicitly and use inheritance from tagged resource groups where possible.
You can also combine deployment alerts with the missing-tag query so new resources are checked shortly after creation. That gives teams feedback quickly without blocking every deployment across the environment.
I had not realized Resource Graph alerting could be used this way. I am going to test it in our development environment. Inheriting tags from the resource group also seems much safer than blocking deployments whenever a child resource does not support tags.