Azure resources with no associated tags

You might want a list of resources that have no tags associated with them when doing the following:

• Managing Azure cloud infrastructure

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

Using tags on resources allows an IT department to better organize cloud-based resources. Tags facilitate the identification of assets running specific work loads, department ownership, business process priority, and cost related information. Finding a large inventory of untagged assets is an important input for monitoring and managing tagging policy in the use of cloud based resources. You want to create a search to help your IT department do this.

1. Run the following search: 

sourcetype=mscs:resource:* 
|search _raw!=*tags* 
|dedup id, name, location 
|table id, name, location tags.* 
|fillnull value="Untagged!"

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

Sample results for this search are shown in the table below. This search can serve as input to a potential automation process to assign tags or request owners to formulate and assign tags to their assets. Splunk Phantom could be used for such an automation project by putting the results of the search into a playbook that formats an email to the owner of the untagged asset requiring tagging to be put into place. Azure’s Cloud Adoption Framework contains a decision guide for resource naming and the use of tags.