Use tags to organize your Azure resources

You apply tags to your Azure resources to logically organize them by categories. Each tag consists of a name and a value. For example, you can apply the name "Environment" and the value "Production" to all the resources in production. Without this tag, you may have difficulty identifying whether a resource is intended for development, test, or production. However, "Environment" and "Production" are just examples. You define the names and values that make the most sense for organizing your subscription.

After applying tags, you can retrieve all the resources in your subscription with that tag name and value. Tags enable you to retrieve related resources that reside in different resource groups. This approach is helpful when you need to organize resources for billing or management.

The following limitations apply to tags:

  • Each resource or resource group can have a maximum of 15 tag name/value pairs. This limitation only applies to tags directly applied to the resource group or resource. A resource group can contain many resources that each have 15 tag name/value pairs.
  • The tag name is limited to 512 characters, and the tag value is limited to 256 characters. For storage accounts, tag name is limited to 128 characters, and tag value is limited to 256 characters.
  • Tags applied to the resource group are not inherited by the resources in that resource group.

If you have more than 15 values that you need to associate with a resource, use a JSON string for the tag value. The JSON string can contain many values that are applied to a single tag name. An example of assigning a JSON string to the tag is shown in this article.

Note

You can only apply tags to resources that support Resource Manager operations. If you created a Virtual Machine, Virtual Network, or Storage through the classic deployment model (such as through the classic portal), you cannot apply a tag to that resource. To support tagging, redeploy these resources through Resource Manager. All other resources support tagging.

Ensure tag consistency with policies

Resource policies enable you to create standard rules for your organization. You can create policies that ensure resources are tagged with the appropriate values. For more information, see Apply resource policies for tags.

PowerShell

Version 3.0 of the AzureRm.Resources module included significant changes in how you work with tags. Before proceeding, check your version:

Get-Module -ListAvailable -Name AzureRm.Resources | Select Version

If your results show version 3.0 or later, the examples in this topic work with your environment. If you do not have version 3.0 or later, update your version by using PowerShell Gallery or Web Platform Installer before proceeding with this topic.

Version
-------
3.5.0

To see the existing tags for a resource group, use:

(Get-AzureRmResourceGroup -Name examplegroup).Tags

Which returns the following format:

Name                           Value
----                           -----
Dept                           IT
Environment                    Test

To see the existing tags for a resource with a specified resource ID, use:

(Get-AzureRmResource -ResourceId {resource-id}).Tags

Or, to see the existing tags for a resource with a specified name, and resource group, use:

(Get-AzureRmResource -ResourceName examplevnet -ResourceGroupName examplegroup).Tags

To get resource groups with a specific tag, use:

(Find-AzureRmResourceGroup -Tag @{ Dept="Finance" }).Name 

To get resources with a specific tag, use:

(Find-AzureRmResource -TagName Dept -TagValue Finance).Name

Every time you apply tags to a resource or resource group, you overwrite the existing tags on that resource or resource group. Therefore, you must use a different approach based on whether the resource or resource group has existing tags.

To add tags to a resource group without existing tags, use:

Set-AzureRmResourceGroup -Name examplegroup -Tag @{ Dept="IT"; Environment="Test" }

To add tags to a resource group with existing tags, retrieve the existing tags, add the new tag, and reapply the tags:

$tags = (Get-AzureRmResourceGroup -Name examplegroup).Tags
$tags += @{Status="Approved"}
Set-AzureRmResourceGroup -Tag $tags -Name examplegroup

To add tags to a resource without existing tags, use:

Set-AzureRmResource -Tag @{ Dept="IT"; Environment="Test" } -ResourceName examplevnet -ResourceGroupName exampleroup

To add tags to a resource with existing tags.

$tags = (Get-AzureRmResource -ResourceName examplevnet -ResourceGroupName examplegroup).Tags
$tags += @{Status="Approved"}
Set-AzureRmResource -Tag $tags -ResourceName examplevnet -ResourceGroupName examplegroup

To apply all tags from a resource group to its resources, and not retain existing tags on the resources, use the following script:

$groups = Get-AzureRmResourceGroup
foreach ($g in $groups) 
{
    Find-AzureRmResource -ResourceGroupNameEquals $g.ResourceGroupName | ForEach-Object {Set-AzureRmResource -ResourceId $_.ResourceId -Tag $g.Tags -Force } 
}

To apply all tags from a resource group to its resources, and retain existing tags on resources that are not duplicates, use the following script:

$groups = Get-AzureRmResourceGroup
foreach ($g in $groups) 
{
    if ($g.Tags -ne $null) {
        $resources = Find-AzureRmResource -ResourceGroupNameEquals $g.ResourceGroupName 
        foreach ($r in $resources)
        {
            $resourcetags = (Get-AzureRmResource -ResourceId $r.ResourceId).Tags
            foreach ($key in $g.Tags.Keys)
            {
                if ($resourcetags.ContainsKey($key)) { $resourcetags.Remove($key) }
            }
            $resourcetags += $g.Tags
            Set-AzureRmResource -Tag $resourcetags -ResourceId $r.ResourceId -Force
        }
    }
}

To remove all tags, pass an empty hash table.

Set-AzureRmResourceGroup -Tag @{} -Name examplegroup

Azure CLI

To see the existing tags for a resource group, use:

az group show -n examplegroup --query tags

Which returns the following format:

{
  "Dept"        : "IT",
  "Environment" : "Test"
}

To see the existing tags for a resource with a specified resource ID, use:

az resource show --id {resource-id} --query tags

Or, to see the existing tags for a resource with a specified name, type, and resource group, use:

az resource show -n examplevnet -g examplegroup --resource-type "Microsoft.Network/virtualNetworks" --query tags

To get resource groups with a specific tag, use az group list.

az group list --tag Dept=IT

To get all the resources with a particular tag and value, use az resource list.

az resource list --tag Dept=Finance

Every time you apply tags to a resource or resource group, you overwrite the existing tags on that resource or resource group. Therefore, you must use a different approach based on whether the resource or resource group has existing tags.

To add tags to a resource group without existing tags, use:

az group update -n examplegroup --set tags.Environment=Test tags.Dept=IT

To add tags to a resource without existing tags, use:

az resource tag --tags Dept=IT Environment=Test -g examplegroup -n examplevnet --resource-type "Microsoft.Network/virtualNetworks"

To add tags to a resource that already has tags, retrieve the existing tags, reformat that value, and reapply those tags with the new tags:

jsonrtag=$(az resource show -g examplegroup -n examplevnet --resource-type "Microsoft.Network/virtualNetworks" --query tags)
rt=$(echo $jsonrtag | tr -d '"{},' | sed 's/: /=/g')
az resource tag --tags $rt Project=Redesign -g examplegroup -n examplevnet --resource-type "Microsoft.Network/virtualNetworks"

To apply all tags from a resource group to its resources, and not retain existing tags on the resources, use the following script:

groups=$(az group list --query [].name --output tsv)
for rg in $groups 
do 
  jsontag=$(az group show -n $rg --query tags)
  t=$(echo $jsontag | tr -d '"{},' | sed 's/: /=/g')
  r=$(az resource list -g $rg --query [].id --output tsv) 
  for resid in $r 
  do 
    az resource tag --tags $t --id $resid
  done 
done

To apply all tags from a resource group to its resources, and retain existing tags on resources, use the following script:

groups=$(az group list --query [].name --output tsv)
for rg in $groups 
do 
  jsontag=$(az group show -n $rg --query tags)
  t=$(echo $jsontag | tr -d '"{},' | sed 's/: /=/g')
  r=$(az resource list -g $rg --query [].id --output tsv) 
  for resid in $r 
  do 
    jsonrtag=$(az resource show --id $resid --query tags)
    rt=$(echo $jsonrtag | tr -d '"{},' | sed 's/: /=/g')
    az resource tag --tags $t$rt --id $resid
  done 
done

Templates

To tag a resource during deployment, add the tags element to the resource you are deploying. Provide the tag name and value.

Apply literal value to tag name

The following example shows a storage account with two tags (Dept and Environment) that are set to literal values:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "resources": [
    {
      "apiVersion": "2016-01-01",
      "type": "Microsoft.Storage/storageAccounts",
      "name": "[concat('storage', uniqueString(resourceGroup().id))]",
      "location": "[resourceGroup().location]",
      "tags": {
        "Dept": "Finance",
        "Environment": "Production"
      },
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "Storage",
      "properties": { }
    }
    ]
}

Apply object to tag element

You can define an object parameter that stores several tags, and apply that object to the tag element. Each property in the object becomes a separate tag for the resource. The following example has a parameter named tagValues that is applied to the tag element.

{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "tagValues": {
      "type": "object",
      "defaultValue": {
        "Dept": "Finance",
        "Environment": "Production"
      }
    }
  },
  "resources": [
    {
      "apiVersion": "2016-01-01",
      "type": "Microsoft.Storage/storageAccounts",
      "name": "[concat('storage', uniqueString(resourceGroup().id))]",
      "location": "[resourceGroup().location]",
      "tags": "[parameters('tagValues')]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "Storage",
      "properties": {}
    }
  ]
}

Apply JSON string to tag name

To store many values in a single tag, apply a JSON string that represents the values. The entire JSON string is stored as one tag that cannot exceed 256 characters. The following example has a single tag named CostCenter that contains several values from a JSON string:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "resources": [
    {
      "apiVersion": "2016-01-01",
      "type": "Microsoft.Storage/storageAccounts",
      "name": "[concat('storage', uniqueString(resourceGroup().id))]",
      "location": "[resourceGroup().location]",
      "tags": {
        "CostCenter": "{\"Dept\":\"Finance\",\"Environment\":\"Production\"}"
      },
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "Storage",
      "properties": { }
    }
    ]
}

Portal

  1. To view the tags for a resource or resource group, select the Tags icon.

    Select tags on resource and resource group blades

  2. You see the existing tags for the resource. If you have not previously applied tags, the list is empty.

    Show existing tags on resource and resource group blades

  3. To add a tag, type a name and value, or select an existing one from the dropdown menu. Select Save.

    Add new tag

  4. To view all the resources with a tag value, select > (More services), and enter the word Tags into the filter text box. Select Tags from the available options.

    Find tags via the Browse hub

  5. You see a summary of the tags in your subscriptions.

    Show all tags

  6. Select any of the tags to display the resources and resource groups with that tag.

    Show tagged resources

  7. Select Pin blade to dashboard for quick access.

    Pin tags to the Dashboard

  8. You can select the pinned tag from the dashboard to see the resources with that tag.

    Pin tags to the Dashboard

REST API

The portal and PowerShell both use the Resource Manager REST API behind the scenes. If you need to integrate tagging into another environment, you can get tags with a GET on the resource id and update the set of tags with a PATCH call.

Tags and billing

Tags enable you to group your billing data. For example, if you are running multiple VMs for different organizations, use the tags to group usage by cost center. You can also use tags to categorize costs by runtime environment; such as, the billing usage for VMs running in production environment.

You can retrieve information about tags through the Azure Resource Usage and RateCard APIs or the usage comma-separated values (CSV) file. You download the usage file from the Azure accounts portal or EA portal. For more information about programmatic access to billing information, see Gain insights into your Microsoft Azure resource consumption. For REST API operations, see Azure Billing REST API Reference.

When you download the usage CSV for services that support tags with billing, the tags appear in the Tags column. For more information, see Understand your bill for Microsoft Azure.

See tags in billing

Next steps