Azure Resource Tag Compliance Enforcer

Overview

This flow enforces Azure resource-tagging governance using the Azure Resource Manager (ARM) connector. On a daily schedule it enumerates every resource in a target subscription, checks each one against a required-tag policy (e.g. owner, costcenter, environment), writes every violation to a Dataverse audit table, and posts a compliance scorecard to a Microsoft Teams channel. When an opt-in toggle is enabled it can also auto-apply default tag values to non-compliant resources.

Why it matters: untagged resources break cost allocation (chargeback) and ownership accountability. A daily automated sweep - with an audit trail and optional remediation - keeps the tag estate clean without waiting for a manual quarterly portal review.

Ships Off (demo).

Use Case

A cloud governance / FinOps team mandates tags for chargeback and ownership. They need continuous detection of untagged resources, a durable audit trail for trend reporting, a daily scorecard the team can act on, and optional automatic remediation - not a manual portal review.

Flow Architecture

Environment Variables

Connectors & Connections

Note — All connections are referenced as solution connection references; the flow is portable between environments as long as a connection is mapped at import time.

Customization Guide

Almost every realistic variant of this flow can be implemented by changing environment variable values. A few cases require small edits inside the flow definition — those are called out explicitly below.

Required-tag policy

Edit flowlibs_RequiredTags (keys) and flowlibs_TagDefaultsJson (defaults), keeping them aligned and mirroring your Azure Policy tag requirements.

Enable auto-remediation

Set flowlibs_TagAutoRemediate to true; grant the ARM connection Tag Contributor and test per resource type.

Narrow the scope

Add a $filter (e.g. resourceType eq Microsoft.Storage/storageAccounts) or page with $top/nextLink for very large subscriptions.

Email the owner

Add Office 365 Outlook SendEmailV2 in the violation branch addressed to the resource's owner tag with the missing-tag list.

Cost overlay

Join the Tag Violations table with Cost Management data to quantify untagged spend and trend it in Power BI.

Key Expressions

The flow is intentionally light on Power Fx / WDL gymnastics — the heaviest expressions are the branch-name concatenation and the approval outcome check. They are listed below in the order they appear in the flow.

coalesce(items('Apply_To_Each_Resource')?['tags'], json('{}'))

filter(variables('varRequiredTags'), not(contains(outputs('Compose_Existing_Tags'), item())))

if(equals(variables('varTotalResources'),0),100,div(mul(sub(variables('varTotalResources'),variables('varViolationCount')),100),variables('varTotalResources')))

union(json(variables('varTagDefaultsJson')), coalesce(body('Get_Resource_Detail')?['tags'], json('{}')))