Tag governance across 100,000 resources

A tagging standard is usually defined early in cloud adoption and works for the first few months. The problem surfaces once the estate passes a few tens of thousands of resources and ownership is spread across a dozen or more teams.

Why policy alone is not enough

Azure Policy handles one scenario well: blocking the creation of a resource without a required tag. It does not address three situations that always occur in a large tenant:

1. Resources that predate the policy. Deny mode does not apply retroactively, and bulk remediation requires a deliberate decision about default values.
2. Resources created by services. Cluster nodes, managed disks and public IP addresses are provisioned automatically and frequently bypass tag inheritance logic.
3. Tags that are syntactically valid but meaningless. owner: it passes validation and carries no information at chargeback time.

An approach that works

In practice a two-layer model proves effective: policy blocks new violations, while recurring PowerShell automation deals with the state that already exists.

$resources = Search-AzGraph -Query @"
Resources
| where isnull(tags['CostCenter']) or tags['CostCenter'] == ''
| project id, name, type, resourceGroup, subscriptionId
"@ -First 1000

$resources | Group-Object subscriptionId |
    Select-Object Name, Count | Sort-Object Count -Descending

Using Azure Resource Graph rather than iterating over subscriptions matters in practice: a tenant-wide query returns in seconds, whereas walking Get-AzResource through every subscription can take hours and runs into API throttling.

Reporting beats brute-force enforcement

Automatically backfilling missing tags with a default value creates the appearance of order. Recurring reports to subscription owners work better: a list of unassigned resources, their monthly cost and a deadline for completing the data. Cost shown next to an owner’s name is more effective than any technical policy.

Conclusion

Tag governance at scale is a process, not a configuration. Policy protects the future, automation cleans up the past and reporting sustains the state — remove any one of those three layers and the standard degrades within a few quarters.