Our environment has a growing number of Azure resources without consistent ownership or cost-allocation tags, and identifying the responsible team has become difficult. We have reduced the backlog from roughly 220 resources to 98, sometimes using the "turn it off and see who complains" approach, but that is not sustainable.
I can query untagged resources created within a recent time window using Azure Resource Graph Explorer, but I would like to automate detection and alert the appropriate team or manager as soon as a new untagged resource is deployed. I initially tried an Azure Policy using a deny effect, but some resource types—particularly certain AKS child resources—do not support tags, which caused valid deployments to fail.
So far, I have alerts for deployments and deletions, reader access for most development teams, and limited contributor access for emergency portal fixes. I would prefer not to run the Resource Graph query manually every week and sort through legitimate exceptions. What is the best way to automate this, and how do other organizations handle tagging enforcement without disrupting unsupported resource types?
2 Answers
A scheduled query alert can also query Azure Resource Graph directly from Log Analytics, so you may not need a Logic App or another integration layer if alerting is the only requirement. That keeps the setup simpler and avoids maintaining extra infrastructure.
You can create an Azure Resource Graph query alert and connect it to an action group. The query can look for resources created recently where the required tag is missing, so you get notified without manually running the query. Resource Graph alerting is available through the Azure Monitor workflow, and the alert can be sent to email, Teams, or another supported destination.
That sounds like exactly what I need. I had assumed Resource Graph results had to be copied into Log Analytics first, so I’ll test a scheduled query alert.