How to find resources without tags in Azure

Before you start

Use an Azure account with read access to the subscriptions you want to check. The built-in Reader role is enough to run Resource Graph queries; assign it at each subscription or a scope above. The Microsoft references list no separate Resource Graph licence.

Know what the query covers. Resource Graph is a near real-time index, so a tag added a moment ago can take time to appear. The query reads resources only: resource groups and subscriptions are in a separate table and keep their own tags. Classic resources such as Cloud Services don't support tags. The examples read Azure and export a CSV; they don't add or change any tag. The script's finally block disconnects the account and clears its saved Azure contexts.

Option 1

Find resources without tags with PowerShell

Install the modules once, sign in, and query the subscriptions the account can read. The script follows every page of results.

Install-Module -Name Az.Accounts, Az.ResourceGraph -Repository PSGallery -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-AzAccount -ErrorAction Stop
try {
    $subscriptionIds = @(
        Get-AzSubscription | Where-Object State -eq 'Enabled' | Select-Object -ExpandProperty Id
    )
    if ($subscriptionIds.Count -eq 0) {
        Write-Output 'No enabled subscriptions are available to this account.'
        return
    }
    $query = @(
        'Resources'
        '| where tostring(tags) in ("", "{}")'
        '| project id, name, type, resourceGroup, subscriptionId, location'
        '| order by id asc'
    ) -join ' '
    $rows = [System.Collections.Generic.List[object]]::new()
    $skipToken = $null
    do {
        $arguments = @{ Query = $query; Subscription = $subscriptionIds; First = 1000 }
        if ($skipToken) { $arguments.SkipToken = $skipToken }
        $page = Search-AzGraph @arguments
        foreach ($record in $page.Data) { $rows.Add($record) }
        $skipToken = $page.SkipToken
    } while ($skipToken)
    if ($rows.Count -eq 0) {
        Write-Output 'Every resource in these subscriptions has at least 1 tag.'
    } else {
        $rows | Select-Object name, type, resourceGroup, subscriptionId, location, id |
            Export-Csv -Path './untagged-resources.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($rows.Count) untagged resources saved to untagged-resources.csv."
    }
} finally {
    Disconnect-AzAccount | Out-Null
}

The CSV holds each resource's name, type, resource group, subscription, location and resource ID. The filter keeps resources with no tags property and those with an empty set. To look for 1 missing tag rather than no tags at all, change the filter to '| where isempty(tostring(tags.CostCenter))' with your tag's name, written in the case it was given: this way of reading a tag matches its name with its case. Resource Graph paging needs id in the results, so keep it if you edit the query.

Option 2

Find untagged resources in Azure Resource Graph Explorer

1. Sign in to the Azure portal with an account that can read the subscriptions.
2. Search for resource graph and choose Resource Graph Explorer.
3. To change its scope, choose Directory, then choose the directory, management group or subscription to query.
4. Paste this read-only query in Query 1 and choose Run query:
   KQL

   Resources
   | where tostring(tags) in ('', '{}')
   | project id, name, type, resourceGroup, subscriptionId, location
   | order by id asc

5. Review the resources in Results.

This suits an occasional check with the results on screen straight away. For a file you can keep and compare each month, use PowerShell or Altivane.

Common questions

The resource group is tagged. Why are its resources listed?

Resources don't inherit the tags of their resource group or subscription. Cost Management can apply them to cost records with tag inheritance, which leaves the resources themselves as they are.

Why can't I tag some of the resources listed?

Not every resource type supports tags, and classic resources don't support them at all. Microsoft keeps a list of tag support for each resource type; leave those rows out of your count.

Can Azure stop untagged resources being created?

Yes, with Azure Policy definitions that require or add a tag. To see what such a policy finds, see how to find non-compliant resources in Azure Policy.