Use Tags to Organize AI Foundry Resources

Risk Level: Low (generally tolerable level of risk)

Rule ID: AIServices-008

Ensure that user-defined tags are being used for labeling, collecting, and organizing AI Foundry instances within your Microsoft Azure account. User-defined tags are name/value pairs that enable you to categorize resources and view consolidated billing by applying the same tag to multiple cloud resources. TrendAI Vision One™ Cloud Risk Management recommends the following tagging schema to help you identify and manage your AI Foundry resources:

Name: used to identify individual cloud resources.
Role: used to describe the function of a specific resource (e.g., web tier, app tier, and database tier).
Environment: used to distinguish between different stages (e.g., development, staging, and production).
Owner: used to identify the person responsible for the cloud resource.

Security

Reliability

Performance
efficiency

Cost
optimisation

Operational
excellence

As your Microsoft Azure cloud environment is becoming more and more complex, it requires better management strategies. Using a tagging schema can help you gain more visibility across your Azure cloud resources and organize them more efficiently. You can use tags for different scenarios such as tracking resource owners and their stack level, identify which resources are incurring the highest costs, and filter available resources based on a particular deployment stage. While not directly a security control, proper tagging supports security governance by enabling resource identification, ownership tracking, and policy enforcement across AI Foundry deployments.

Audit

To determine if your Azure AI Foundry instances are using the recommended tagging schema, perform the following operations:

Using Azure Console

Sign in to the Microsoft Azure Portal.
Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.
Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.
From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure AI Foundry for Value, then choose Apply to list the Azure AI Services (AI Foundry) instances available in the selected subscription.
Click on the name (link) of the AI Foundry instance that you want to examine.
In the resource navigation panel, choose Tags to view the tag set(s) created for the selected AI Foundry instance.
On the Tags page, search the Name column for the following combination of tag names (tag names are case insensitive): Name, Role, Environment, and Owner. If the verified resource does not have the same exact combination of tag names, the selected Azure AI Foundry instance is not using the recommended tagging schema.

Using Azure CLI

Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
```
az account list
	--query '[*].id'
```

The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
```
az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
```
Run cognitiveservices account list command (Windows/macOS/Linux) with custom output filters to list the resource identifier (ID) of each Azure AI Services (AI Foundry) instance available within the current subscription:
```
az cognitiveservices account list
	--query '[?(kind==`AIServices`)].id'
```

The command output should return the requested AI Foundry instance identifiers:

[
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.CognitiveServices/accounts/cc-project5-ai-service-instance",
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.CognitiveServices/accounts/cc-project5-ai-foundry-instance"
]

Run tag list command (Windows/macOS/Linux) with the ID of the Azure AI Foundry instance that you want to examine as the identifier parameter, to describe the tag set(s) created for the selected AI instance:

az tag list
	--resource-id "/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.CognitiveServices/accounts/cc-project5-ai-service-instance"
	--output table
	--query 'properties.tags'

The command output should return a table with the requested tagging information:
```
Project     Type
----------  -----------
project5    unmanaged
```
Check the first row of the table returned by the tag list command output for the following combination of tag names (tag names are case insensitive): Name, Role, Environment, and Owner. If the verified resource does not have the same exact combination of tag names, the selected Azure AI Foundry instance is not using the recommended tagging schema.

Remediation / Resolution

To implement the recommended tagging schema for your Microsoft Azure AI Foundry instances, perform the following operations:

Using Azure Console

Sign in to the Microsoft Azure Portal.
Navigate to All resources blade available at https://portal.azure.com/#browse/all to access all your Microsoft Azure cloud resources.
Choose the Azure subscription that you want to access from the Subscription equalls all filter box and choose Apply.
From the Type equals all filter box, select Type for Filter, Equals for Operator, and Azure AI Foundry for Value, then choose Apply to list the Azure AI Services (AI Foundry) instances available in the selected subscription.
Click on the name (link) of the AI Foundry instance that you want to examine.
In the resource navigation panel, choose Tags to access the resource tagging configuration page.
On the Tags page, use the Name and Value text fields to create the following tagging schema (tag names are case insensitive, tag values are case sensitive):
1. For tag names use Name, Role, Environment, and Owner.
2. For tag values use your own metadata as specified below:
  1. The Name tag value can be used to identify individual cloud resources (e.g., ai-foundry-nlp-westeurope).
  2. The Role tag value can be used to describe the function of a specific resource (e.g., workspace).
  3. The Environment tag value can be used to distinguish between different stages (e.g., production).
  4. The Owner tag value can be used to identify the person responsible for the cloud resource (e.g., data-science-team).

Using Azure CLI

Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account:
```
az account list
	--query '[*].id'
```

The command output should return the requested subscription identifiers (IDs):

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output):
```
az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd
```
Run cognitiveservices account list command (Windows/macOS/Linux) with custom output filters to list the name and the associated resource group for each Azure AI Services (AI Foundry) instance available within the current subscription:
```
az cognitiveservices account list
	--output table
	--query '[?(kind==`AIServices`)].{name:name, resourceGroup:resourceGroup}'
```

The command output should return the requested AI Foundry instance identifiers:

Name                               ResourceGroup
-------------------------------    ------------------------------
cc-project5-ai-service-instance    cloud-shell-storage-westeurope
cc-project5-ai-foundry-instance    cloud-shell-storage-westeurope

Run cognitiveservices account update command (Windows/macOS/Linux) with the ID of the Azure AI Foundry instance that you want to configure as the identifier parameter, to tag the selected instance using the recommended tagging schema. Replace the tag values within the --tags parameter with your own metadata. Include the original (existing) tags in the --tags parameter list:
```
az cognitiveservices account update
	--name cc-project5-ai-service-instance
	--resource-group cloud-shell-storage-westeurope
	--tags 'name=ai-foundry-nlp-westeurope' 'role=workspace' 'environment=production' 'owner=data-science-team' 'project=project5' 'type=unmanaged'
	--query 'tags'
```

The command output should return all the tag sets assigned to the selected AI Foundry instance:

{
	"name": "ai-foundry-nlp-westeurope",
	"owner": "data-science-team",
	"environment": "production",
	"project": "project5",
	"role": "workspace",
	"type": "unmanaged"
}

References

Azure Official Documentation
Define your naming convention
Use tags to organize your Azure resources and management hierarchy

Azure Command Line Interface (CLI) Documentation
az account list
az account set
az cognitiveservices account list
az tag
az cognitiveservices account update

Publication date Sep 10, 2025

Audit

Using Azure Console

Using Azure CLI

Remediation / Resolution

Using Azure Console

Using Azure CLI

References

Related AIServices rules