tags inheritance from resourcegroup upon creation and update of a resourcegroup

Question

tags inheritance from resourcegroup upon creation and update of a resourcegroup

moti jirata 25

I have now a policy that enforce inheritance on required tags from resource group but its only upon creation of the resource group but i want this to apply to updating the resource group as well. Is there a way to do that or do i need something like a logicapp to trigger this?

Stanislav Zhelyazkov 29,826 Reputation points MVP Volunteer Moderator

2026-08-19T05:35:28.3966667+00:00

@moti jirata please provide your policy to understand fully the actual issue. Note that if you are using Modify effect the effect will evaluate only when a resource is created or updated. Do not expect that if the resource not updated it will trigger the modify effect. You could also start remediation task to reach compliance of those resources.

2 answers

Your answer

Stanislav Zhelyazkov 29,826 Reputation points MVP Volunteer Moderator

2026-08-19T05:35:28.3966667+00:00

@moti jirata please provide your policy to understand fully the actual issue. Note that if you are using Modify effect the effect will evaluate only when a resource is created or updated. Do not expect that if the resource not updated it will trigger the modify effect. You could also start remediation task to reach compliance of those resources.

Answer 1

Hello moti jirata

Thank you for posting your query on Microsoft Q&A platform.

Azure Policy can enforce tag inheritance from a Resource Group by using the built-in "Inherit a tag from the resource group" policy (Modify effect). This policy applies when a resource is created or updated and can also be applied to existing resources through a remediation task.

However, if you later update the tag value on the Resource Group, Azure Policy does not automatically propagate that change to all existing resources in real time. Existing resources are updated only when:

The resource is updated and re-evaluated by policy, or
A remediation task is run for the policy assignment. citeturn2search1turn2search3

If your requirement is to immediately synchronize tag changes from a Resource Group to all resources whenever the Resource Group tag is modified, Azure Policy alone does not provide an event-driven update mechanism.

In that scenario, you would need an automation solution such as Azure Automation, Azure Functions, or Logic Apps triggered by Resource Group change events.

Microsoft documentation:

Azure Policy tag governance and built-in tagging policies:

Policy definitions for tagging resources

Tag inheritance and Modify effect examples:

Using tags in Azure Policy definitions

Built-in sample: Inherit a tag from the Resource Group:

Inherit a tag from the resource group

So, for your scenario, the supported Microsoft approach is to use a Modify policy with remediation. If you need immediate updates whenever a Resource Group tag changes, you will need to supplement Azure Policy with an automation workflow.

I hope the details shared above helped in addressing your concern.

If the suggested resolution resolved the issue, kindly consider marking the answer as "Accepted" and "Upvote" it. This helps other community members who may encounter a similar issue in the future.

If you’re still experiencing the problem or need further clarification, please feel free to share additional information so we can continue investigating and assist you further.

Thanks,
Suchitra.

Answer 2

Yes. Azure Policy can apply tag inheritance on both create and update of resources, not just at initial creation.

For this scenario, use the built-in modify policy Inherit a tag from the resource group. Its documented behavior is:

it adds or replaces the specified tag and value from the parent resource group
it runs when any resource is created or updated
existing resources can be brought into compliance by triggering a remediation task

Important limitation: updating the resource group tag does not by itself update every child resource immediately unless those resources are updated or remediated. To push the changed tag value to already existing resources after the resource group tag changes, run a remediation task against that policy assignment.

If the goal is:

New or updated resources inherit the current resource group tag: use the built-in Inherit a tag from the resource group policy.
Already existing resources get updated after the resource group tag changes: trigger a remediation task.

In the Azure portal, the assignment flow for the built-in inheritance policy is:

Go to Policy.
Select Assignments.
Select Assign Policy.
Choose the Scope.
Select the built-in definition Inherit a tag from the resource group if missing.
Provide the tag name to inherit.

If the requirement is to automatically react every time a resource group tag changes and immediately propagate that change to all resources without waiting for resource updates or manually starting remediation, that behavior is not described as native Azure Policy behavior in the provided material. The supported Azure Policy path in the documentation is to use modify plus remediation.

References: