Azure Cloud Billing Wiki

Azure Tagging Strategies

Why Tagging Matters for MSPs

Azure tags are name-value pairs that you apply to resources for organization, cost allocation, and automation. For MSPs, effective tagging is foundational to:

  • Accurate client billing (showback/chargeback)
  • Cost allocation by department, project, or environment
  • Resource management and automation
  • Compliance reporting and governance
  • Identifying optimization opportunities

Without a solid tagging strategy, you're flying blind on cost attribution and resource management.

Tag Fundamentals

What Can Be Tagged

Most Azure resources support tags:

  • Virtual Machines
  • Storage Accounts
  • SQL Databases
  • App Services
  • Resource Groups
  • Subscriptions (limited)

Tag Limitations

Technical Constraints

  • Maximum 50 tags per resource
  • Tag name: 512 characters max
  • Tag value: 256 characters max
  • Tag names and values are case-insensitive for storage but case-sensitive for retrieval
  • Cannot contain: <, >, %, &, \, ?, /

Inheritance

  • Tags on Resource Groups do NOT automatically apply to contained resources
  • Must use Azure Policy or scripts to propagate tags

Performance

  • Large-scale tag updates can take time
  • Use Azure Resource Graph for querying tagged resources efficiently

Essential Tags for MSPs

Core Tag Schema

Environment

Tag Name: Environment
Allowed Values: Production, Staging, Development, Test, DR
Purpose: Separate prod from non-prod for cost and access control

CostCenter

Tag Name: CostCenter
Allowed Values: Client name, department code, or project ID
Purpose: Primary cost allocation dimension

Owner

Tag Name: Owner
Allowed Values: Email address or team name
Purpose: Responsibility tracking and contact for issues

Application

Tag Name: Application
Allowed Values: Application or workload name
Purpose: Group resources by application for cost analysis

CreatedDate

Tag Name: CreatedDate
Allowed Values: YYYY-MM-DD format
Purpose: Track resource age, identify orphaned resources

CreatedBy

Tag Name: CreatedBy
Allowed Values: Email or service principal name
Purpose: Audit trail, accountability

Criticality

Tag Name: Criticality
Allowed Values: Critical, High, Medium, Low
Purpose: Inform backup, DR, and support priorities

ExpirationDate (Optional)

Tag Name: ExpirationDate
Allowed Values: YYYY-MM-DD format
Purpose: Auto-cleanup dev/test resources, prevent sprawl

Project (Optional)

Tag Name: Project
Allowed Values: Project name or code
Purpose: Track costs by project or initiative

Client-Specific Tags

For Multi-Tenant MSPs

Tag Name: ClientID
Allowed Values: Unique client identifier
Purpose: Separate costs in shared subscriptions (avoid if possible)

For Multi-Department Clients

Tag Name: Department
Allowed Values: HR, Finance, Sales, IT, Marketing, etc.
Purpose: Departmental chargeback

Tagging Strategy by Scenario

Scenario 1: Single Client per Subscription

Approach: Use subscriptions as billing boundary, tags for internal allocation.

Recommended Tags:

  • Environment (Production, Development)
  • Application (App name)
  • Owner (Team email)
  • CostCenter (Department, if applicable)

Benefit: Simplest model. Subscription-level cost reports suffice for client billing. Tags used for internal showback to client departments.

Scenario 2: Multiple Clients in Shared Subscription

Approach: Use tags for primary cost allocation (NOT RECOMMENDED but sometimes necessary).

Recommended Tags:

  • ClientID (REQUIRED)
  • Environment
  • Application
  • Owner

Critical: Mandatory tagging policy + regular compliance audits.

Limitation: Shared resources (VNets, Key Vaults) difficult to allocate. Best practice is separate subscriptions per client.

Scenario 3: Chargeback to Departments

Approach: Client has centralized IT but departments are billed separately.

Recommended Tags:

  • Department (REQUIRED)
  • Project (optional)
  • Environment
  • Application
  • Owner

Process:

  1. Resources tagged at creation
  2. Monthly cost export filtered by Department tag
  3. Allocate shared resources (networking, security) proportionally or by defined formula
  4. Generate chargeback reports

MSP Opportunity: Offer chargeback management as premium service.

Scenario 4: Project-Based Billing

Approach: Track costs by client project for time-limited initiatives.

Recommended Tags:

  • Project (REQUIRED)
  • ExpirationDate (cleanup trigger)
  • Owner
  • Environment

Process:

  • Tag all project resources with Project tag
  • Monitor costs in Cost Analysis filtered by Project
  • Decommission after ExpirationDate
  • Bill client for project's total Azure spend

Implementing Tagging

Option 1: Manual Tagging

Azure Portal

  • Select resource
  • Navigate to Tags section
  • Add/modify tags
  • Click Save

Pros: Simple, no scripting required
Cons: Tedious, error-prone, doesn't scale

When to Use: Small number of resources, one-time tagging

Option 2: Azure Policy

Enforce Tagging at Creation

Create Azure Policy that:

  • Requires specific tags before resource creation
  • Denies deployment if tags missing
  • Automatically applies default tags

Example Policy: Require CostCenter Tag

{
  "if": {
    "field": "tags['CostCenter']",
    "exists": "false"
  },
  "then": {
    "effect": "deny"
  }
}

Inherit Tags from Resource Group

{
  "if": {
    "field": "tags['Environment']",
    "exists": "false"
  },
  "then": {
    "effect": "modify",
    "details": {
      "roleDefinitionIds": [
        "/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
      ],
      "operations": [
        {
          "operation": "add",
          "field": "tags['Environment']",
          "value": "[resourceGroup().tags['Environment']]"
        }
      ]
    }
  }
}

Pros: Enforces compliance, prevents untagged resources
Cons: Requires planning, can block deployments if not configured thoughtfully

Best Practice: Start with "Audit" effect, then move to "Deny" once processes stabilized.

Option 3: PowerShell/CLI Scripts

Bulk Tagging Existing Resources

PowerShell Example: Tag All VMs in Resource Group

$resourceGroup = "Production-RG"
$tags = @{
    "Environment" = "Production"
    "CostCenter" = "ClientA"
    "Owner" = "admin@clienta.com"
}

$resources = Get-AzResource -ResourceGroupName $resourceGroup
foreach ($resource in $resources) {
    Set-AzResource -ResourceId $resource.ResourceId -Tag $tags -Force
}

Azure CLI Example

az resource tag --tags Environment=Production CostCenter=ClientA \
  --resource-group Production-RG

Pros: Fast bulk operations, scriptable
Cons: Requires scripting knowledge, risk of errors

Option 4: Infrastructure as Code (IaC)

Terraform Example

resource "azurerm_virtual_machine" "example" {
  name                = "example-vm"
  location            = "East US"
  resource_group_name = azurerm_resource_group.example.name

  tags = {
    Environment = "Production"
    CostCenter  = "ClientA"
    Application = "WebApp"
    Owner       = "admin@clienta.com"
    CreatedDate = "2025-01-15"
  }
}

Pros: Tags versioned with infrastructure code, consistent deployment
Cons: Only works for IaC-managed resources

Best Practice: Combine IaC for new resources + scripts for existing resources + Policy for enforcement.

Tag Governance

Naming Conventions

Use Consistent Casing

  • Choose PascalCase, camelCase, or lowercase
  • Stick to one standard across all resources
  • Document in internal wiki

Example Standard

  • Tag Names: PascalCase (e.g., "CostCenter")
  • Tag Values: lowercase (e.g., "production", "clienta")

Allowed Values

Define Permitted Values

  • Prevents typos and inconsistency
  • Use Azure Policy to enforce
  • Document in client onboarding materials

Example: Environment Tag

  • Allowed: "production", "staging", "development", "test"
  • Blocked: "prod", "dev", "uat" (use standard values)

Tag Auditing

Regular Compliance Checks

  • Weekly: Run query to find untagged resources
  • Monthly: Validate tag values against allowed list
  • Quarterly: Review tag schema for needed additions

Azure Resource Graph Query

Resources
| where tags !contains "Environment" or tags !contains "CostCenter"
| project name, type, resourceGroup, tags

Remediation Process

  1. Identify untagged resources
  2. Research ownership/purpose
  3. Apply appropriate tags
  4. If purpose unknown, mark for deletion review

Tag Documentation

Maintain Tag Schema Document

Include:

  • Tag name and purpose
  • Allowed values
  • Required vs. optional
  • Who assigns each tag (developer, MSP, client)
  • Examples

Share with Stakeholders

  • Client IT teams
  • MSP technical staff
  • Finance/billing teams

Using Tags for Cost Management

Cost Analysis Filters

Azure Portal

  1. Navigate to Cost Management + Billing
  2. Go to Cost Analysis
  3. Add Filter: Tag = [TagName]:[TagValue]
  4. View costs attributed to that tag

Group By Tags

  • Group by Tag in Cost Analysis
  • Create pie chart showing spend by CostCenter
  • Export to CSV for reporting

Budget Alerts by Tag

Tag-Based Budgets

  • Create budget scoped to resources with specific tag
  • Example: Budget for all "Environment:Production" resources
  • Alert when approaching threshold

Client-Specific Budgets

  • Budget for "ClientID:ClientA" resources
  • Proactive monitoring per client
  • Automated alerts to MSP and client

Showback/Chargeback Reports

Monthly Process

  1. Export Azure cost data
  2. Filter/group by CostCenter or Department tag
  3. Allocate shared resources (proportional or flat)
  4. Generate report by cost center
  5. Share with client finance team

Automation
Use Azure Cost Management API to programmatically generate reports. See Azure Billing APIs & Automation.

Advanced Tagging Techniques

Dynamic Tagging with Azure Functions

Auto-Tag New Resources

  • Azure Function triggered on resource creation (Event Grid)
  • Read resource properties
  • Apply tags based on naming convention or resource group
  • Ensures compliance even if developer forgets

Tag-Based Automation

Auto-Shutdown by Environment

  • Dev/test VMs tagged "Environment:Development"
  • Azure Automation runbook shuts down all dev VMs at 7 PM
  • Reduces non-prod costs by 60%

Backup Policies by Criticality

  • "Criticality:Critical" → Daily backups, 30-day retention
  • "Criticality:Medium" → Weekly backups, 14-day retention
  • "Criticality:Low" → No backup policy

Tag-Based Access Control

RBAC Scoped to Tags (Limited Support)

  • Use Azure Policy to control who can modify specific tags
  • Prevent developers from changing "CostCenter" tag
  • Restrict "Environment:Production" tagging to approved users

Common Tagging Mistakes

Mistake 1: No Tagging Strategy

  • Resources deployed without tags
  • Impossible to allocate costs accurately
  • Solution: Start with basic schema, enforce via Policy

Mistake 2: Overly Complex Schema

  • 20+ tags per resource
  • Confusing, inconsistent application
  • Solution: Start with 5-7 essential tags, expand as needed

Mistake 3: Inconsistent Values

  • "Prod", "Production", "PROD" all used
  • Breaks cost analysis
  • Solution: Define and enforce allowed values

Mistake 4: Not Propagating Tags

  • Resource Group tagged but not resources
  • Tags don't inherit automatically
  • Solution: Use Policy to enforce inheritance

Mistake 5: Set-and-Forget

  • Tags applied once, never updated
  • Resources change owners, projects end
  • Solution: Regular audits and cleanup

Tag Migration Strategy

For Existing Azure Environments Without Tags

Phase 1: Assessment (Week 1)

  • Inventory all resources
  • Define tag schema
  • Identify owners for each resource

Phase 2: Policy Creation (Week 2)

  • Create Azure Policies for required tags
  • Set to "Audit" mode initially
  • Document tag schema

Phase 3: Bulk Tagging (Week 3-4)

  • Script bulk tagging for existing resources
  • Start with production resources
  • Validate tags applied correctly

Phase 4: Enforcement (Week 5)

  • Switch Policies to "Deny" mode
  • Block creation of untagged resources
  • Communicate change to all stakeholders

Phase 5: Maintenance (Ongoing)

  • Weekly compliance audits
  • Quarterly schema reviews
  • Continuous improvement

Tagging Best Practices Checklist

  • [ ] Define core tag schema (5-10 tags)
  • [ ] Document tag names, purposes, and allowed values
  • [ ] Create Azure Policies to enforce required tags
  • [ ] Implement tag inheritance from Resource Groups
  • [ ] Train staff and clients on tagging standards
  • [ ] Set up Cost Analysis views filtered by key tags
  • [ ] Schedule weekly tag compliance audits
  • [ ] Review and update tag schema quarterly
  • [ ] Automate tagging where possible (IaC, Functions)
  • [ ] Use tags in billing/chargeback processes

Next Steps

  • Use tags with Azure Cost Management Tools for detailed reporting
  • Implement MSP Billing Best Practices showback/chargeback using tags
  • Automate tag enforcement and reporting with Azure Billing APIs & Automation

Effective tagging transforms chaos into clarity. Invest the effort upfront, reap benefits continuously.